ISO 27001

ISO/IEC 27001 is the international standard that sets out the requirements for an information security management system, or ISMS. It does not describe a technology but an organisation: identifying the risks weighing on information, deciding on the measures, applying them, checking them and improving them continuously. Its value rests on certification by an accredited body, which attests to an independent audit. Two precautions before relying on it at a provider: check the scope of the certificate, which may cover only part of the activity or a single site, and its validity date. It covers security in general, without distinguishing personal data, which is the subject of ISO 27701.