ISO 27001 specifies what an ISMS must include: context and scope, leadership, risk assessment and treatment, support, operation, performance evaluation and improvement. Certification assesses whether the system exists and keeps running.
See ISO 27001.
Read more
Related terms
- ISO 27001
- ISO/IEC 27001 is the international standard for an information security management system, certified by an accredited body on a three-year cycle.
- Management review
- Management review is the recurring review in which top management assesses whether the management system is still suitable, adequate and effective.
- Statement of Applicability
- The Statement of Applicability is the mandatory ISO 27001 document listing which Annex A controls apply, which are excluded and why.