Specifies the requirements for establishing, implementing, maintaining and continually improving an information security management system within the context of the organization. This document also includes requirements for the assessment and treatment of information security risks tailored to the needs of the organization. The requirements set out in this document are generic and are intended to be applicable to all organisations, regardless of type, size or nature. Excluding any of the requirements specified in Clauses 4 to 10 is not acceptable when an organization claims conformity to this document.
Related standards
- ZWS ISO/IEC 27002:2022 (Information security, cybersecurity and privacy protection — Information security controls)
- ZWS ISO/IEC 27003:2017 (Information technology – Security techniques – Information security management systems – Guidance)
- ZWS ISO/IEC 27004:2016 (Information technology – Security techniques – Information security management systems – Monitoring, measurement, analysis and evaluation)
- ZWS ISO/IEC 27005:2022 (Information security, cybersecurity and privacy protection — Guidance on managing information security risks)
- ZWS ISO/IEC 27032:2023 (Cybersecurity – Guidelines for internet security)