Risk & compliance
What is ISO 27001?
Also known as: ISO/IEC 27001, ISO 27001:2022, ISMS
ISO/IEC 27001 is the international standard for an information security management system (ISMS): a risk-based way to manage information security that an organisation can be certified against.
The 2022 edition has management system clauses 4 to 10 (context, leadership, planning including risk assessment and treatment, support, operation, performance evaluation and improvement) and Annex A with 93 controls in four themes: organisational, people, physical and technological.
Certification requires a risk assessment, a risk treatment plan, a Statement of Applicability, internal audits and a management review, followed by an external certification audit.
How Clateway helps
- GRC and compliance software with AI – AI-powered GRC software: generate ISO 27001, NIS2, DORA and GDPR policies, run your Statement of Applicability, controls, audit findings and management review in one place.
- ISO 27001 risk register and risk assessment – An ISO 27001 risk register with heat maps, risk appetite, treatment plans, acceptances and AI suggestions from your own systems, vulnerabilities and vendors.