Kerson Wallaw
400-3 Place Ville Marie, Montréal QC H3B 2E3
Ph: (514) 312-1555
Book a free consult
Pick a time · Request a callback

ISO 27001, security as a system.

ISO/IEC 27001 is the international standard for managing information security. It is voluntary, but more and more clients, tenders and supply chains ask for it.

Talk to an expertRelated insights

ISO 27001 in brief.

Type
International standard, certifiable
Current edition
ISO/IEC 27001:2022, with Amendment 1:2024
Standard setter
ISO and IEC (JTC 1/SC 27)
Certified by
Accredited certification bodies
Accreditation in Canada
Standards Council of Canada
Cycle
Three-year certificate, yearly surveillance audits

What, why and who.

What it is

The standard sets requirements for an information security management system (ISMS): understanding your context, leadership, risk assessment and treatment, objectives, operations, performance evaluation and improvement. Annex A lists 93 reference controls in four themes: organizational, people, physical and technological.

Why it exists

To manage information security as a business system rather than a collection of tools, so risks are identified, treated and reviewed continuously, and so you can prove it to others through independent certification.

Who it applies to

Any organization, of any size or sector. It is often required by contract, by public tenders or by larger clients assessing their suppliers, and it is the reference for many sector-specific schemes.

Authority and enforcement

ISO and IEC publish the standard. Certification bodies audit and certify organizations; they are themselves accredited by national bodies that belong to the International Accreditation Forum, in Canada the Standards Council of Canada. There is no regulator or fine; the certificate is the sanction.

How it got here.

  1. 1995

    British Standard BS 7799, the origin of the series.

  2. 2005

    First edition, ISO/IEC 27001:2005.

  3. 2013

    Second edition, ISO/IEC 27001:2013.

  4. 2022-10-25

    Third edition: Annex A restructured to 93 controls, new controls such as threat intelligence, cloud security and data leakage prevention, and a new clause on planning changes.

  5. 2024

    Amendment 1 adds climate change as an issue organizations must consider.

  6. 2025-10-31

    End of the transition: certificates to the 2013 edition are no longer valid.

  7. 2026-07-03

    ISO/IEC 27000:2026, the vocabulary and overview standard, is updated.

What it changes.

Systems and tools

  • Asset inventory and configuration management
  • Monitoring, logging and data leakage prevention
  • Secure development and cloud security controls

Processes

  • Risk assessment and risk treatment plan
  • Internal audits and corrective action
  • Supplier security management
  • Business continuity and ICT readiness

Governance

  • Defined ISMS scope and security policy
  • Statement of Applicability against Annex A
  • Leadership commitment and management review
  • Awareness, competence and documented information

If you do not comply

  • Major nonconformities at surveillance or recertification audits
  • Suspension or withdrawal of the certificate
  • Lost tenders and contracts that require certification
  • Failed supplier due diligence with larger clients

Changes ahead.

Announced and upcoming changes

  • Under reviewISO/IEC 27001:2022 is under systematic review. No new edition or second amendment has been announced.
  • WatchISO/IEC 27001 and 27002 are expected to align progressively with the 2026 vocabulary standard; no timeline is set.

Status checked 2026-10-03. Dates can move; confirm with the official sources below.

This website stores cookies on your computer. Cookie Policy