# What is ISO/IEC 27001, in plain terms?

ISO/IEC 27001 is the international standard for running an information security management system. That is a repeatable way for an organisation to decide which security risks matter, treat them and keep improving. It does not prescribe one set of tools. Instead it requires you to understand your context and obligations, have management commit and assign responsibilities, assess risks, choose controls to treat them, operate those controls, measure how they work, run internal audits and management reviews, and correct what falls short. Its annex lists reference controls, from policies and supplier management to logging, monitoring and network security, and you explain which you apply. An organisation can have an accredited certification body audit it and issue a certificate, which is what customers usually ask for. Certification covers a defined scope, so always check which sites, services and teams the certificate actually includes. For a mid-sized company it is a serious project, mostly about people and process rather than technology.

FAQ: [Security standards: ISO 27001, SOC 2](https://netsenx.com/en/faq/standards) · https://netsenx.com/en/faq/what-is-iso-27001

## Read next

- https://netsenx.com/en/compliance
- https://netsenx.com/en/security
- https://netsenx.com/en/nis2-readiness

## Related questions

- [What is an information security management system?](https://netsenx.com/en/faq/what-is-an-isms)
- [What is a statement of applicability in ISO 27001?](https://netsenx.com/en/faq/what-is-a-statement-of-applicability)
- [What is SOC 2, and why do customers ask for it?](https://netsenx.com/en/faq/what-is-soc-2)
- [What is the difference between a SOC 2 Type 1 and a Type 2 report?](https://netsenx.com/en/faq/soc-2-type-1-vs-type-2)
- [Do we need ISO 27001 or SOC 2?](https://netsenx.com/en/faq/iso-27001-or-soc-2-which-do-we-need)