ISO/IEC 27001

What it is

The full title of the current edition, ISO/IEC 27001:2022, is “Information security, cybersecurity and privacy protection - Information security management systems - Requirements”. ISO describes it as the world’s best-known standard for information security management systems. It was published in October 2022, with an amendment in 2024 adding climate action changes.

An ISMS is not a product or a set of technical settings. It is the way an organisation decides what information it holds, what could go wrong with it, which controls it will use to manage those risks, and how it checks and improves them over time. ISO says the risk process can be adapted to an organisation’s size and needs, and the standard is meant for organisations of any size and sector.

How certification works

Certification is optional. An organisation can implement ISO/IEC 27001 without being certified. Those that want a certificate are audited by a certification body, and ISO notes that a certificate from an accredited body gives an extra layer of confidence, because the accreditation independently confirms the certification body’s competence.

Why it matters for a UK small or regulated business

Cyber Essentials checks five technical controls. ISO/IEC 27001 covers how security is managed across the whole business, through risk assessment and treatment, written policies, internal audits and management reviews. It is widely recognised outside the UK, so large enterprise and overseas customers often ask for it by name. For most small UK businesses it comes after Cyber Essentials, once a customer specifically requires it.

How Microsoft 365 fits

Much of the evidence an ISO/IEC 27001 auditor asks for lives in Microsoft 365: who has access and who approved it, how admin rights are controlled, how devices are secured, how email is protected and what the audit logs show. A well-run tenant with documented settings, MFA, managed devices and controlled admin roles makes many of those questions straightforward to answer. It doesn’t replace the management system itself.

How &DEV helps: our cyber assurance uplift for regulated firms puts the Microsoft 365 controls in place and documents them, and our team includes an ISO/IEC 27001 Lead Implementer.