ISO/IEC 27001 (ISO 27001)
International standard for an Information Security Management System (ISMS). 2022 edition.
ISO 27001 is the standard on which an organisation builds and certifies its Information Security Management System (ISMS). The key word is “system.” Not a collection of documents, but a mechanism in which risk drives the selection of controls and controls are backed by evidence.
The 2022 edition contains 93 controls in Annex A, grouped into four domains: organisational, people, physical, and technological. You do not implement all of them blindly; you implement only those justified by your risk analysis, and you document the rationale for any exclusions in the Statement of Applicability (SoA).
Implementation typically takes between six months and eighteen months. Certification is not the finish line; it is the start of ongoing maintenance, with surveillance audits every year. The most common failure is documentation that lives in files and stops reflecting reality within a few months.
In practice: see the relevant RealSec module.
The set of policies, processes, and controls through which an organisation manages information security. The core of ISO 27001.
Statement of Applicability: the ISO 27001 document declaring which Annex A controls you apply and why.
Business Impact Analysis: an assessment of which processes are critical and how quickly they must be restored after a disruption.
Compliance that connects.
Terms are the map. RealSec ties them to processes, systems and vendors in one engine.