ISO/IEC 27001

ISO/IEC 27001 is the international standard that sets out the requirements for an information security management system (ISMS): the policies, processes and controls an organization uses to manage information security risk. It's published jointly by ISO and the IEC, and the current edition is ISO/IEC 27001:2022 (ISO).

What it is

The standard asks an organization to set the scope of its ISMS, assess its information security risks, choose controls to treat them, and keep improving the system over time. The aim is to protect the confidentiality, integrity and availability of information through risk management.

A 2024 amendment (Amd 1:2024) added climate action changes. People often say "ISO 27001"; the formal name includes IEC because the two bodies publish it together.

Certification is possible but not required. An external certification body audits the ISMS against the standard and issues the certificate. ISO itself doesn't certify anyone.

Why it matters

A certificate tells a buyer that an independent auditor found the vendor runs security as a managed system, with owners, risk reviews and improvement over time, rather than as a set of one-off fixes. Enterprise security reviews often ask for it, or for a SOC 2 report.

In AI CodeOps

AI CodeOps isn't ISO/IEC 27001 certified. The Trust page lists the controls in place today. For your own audits, the audit log and signed evidence packs record who changed what and how each change was approved.