ISO 27001-Information Security Management System

Organisations are seeking to demonstrate to their stakeholders, business partners and customers some form of 'fit for purpose' assurance regarding their information security.A small gap in an information security management system may have dramatic

Consequences. Organisations need to define and maintain controls to avoid risk of leakage or destruction of confidential information.ISO/IEC 27001 gives information on measures, on what effects they have and how to implement them. The standard defines the desired best practice methods for controlling (Protecting) information - Confidentiality, Integrity & Availability.

ISO/IEC 27001 formally specifies a management system that is intended to bring information security under explicit management control. Being a formal specification means that it mandates specific requirements. Organizations that claim to have adopted ISO/IEC 27001 can therefore be formally audited and certified compliant with the standard (more below). ISO/IEC 27001 compliance certificate provides assurance that the

Management system for information security is in place, but says little about the absolute state of information security within the organization. Technical security controls such as antivirus and firewalls are not normally audited in ISO/IEC 27001 certification audits.