The ISO 27000 series is a comprehensive framework for information security, applicable to organisations of every size and sector. Together the standards provide a methodology for establishing an Information Security Management System (ISMS) to protect financial data, intellectual property, employee information and more.
Where it came from
The series traces back to British Standard BS 7799 (1995), itself derived from security frameworks developed within the Royal Dutch/Shell Group. The UK’s Department of Trade and Industry commissioned the work in 1993, which led to ISO/IEC 17799:2000 and, in time, to today’s ISO 27000 family maintained under ISO/IEC JTC 1 SC 27.
The core standards
- ISO 27000 — overview and vocabulary for the whole series
- ISO 27001 — the requirements for an ISMS, and the only standard in the series that organisations can be audited and certified against
- ISO 27002 — detailed implementation guidance for the security controls
The wider family
The series spans dozens of standards that extend the core in specific directions, including:
- Implementation & management: 27003 (implementation), 27004 (measurement), 27005 (risk management), 27006 (requirements for certification bodies), 27007/27008 (auditing)
- Cloud & privacy: 27017 (cloud security controls), 27018 (PII in public clouds), 27701 (privacy information management)
- Technical security: 27031 (ICT continuity), 27032 (cybersecurity), 27033 (network security), 27034 (application security), 27040 (storage security)
- Incident & forensics: 27035 (incident management), 27037–27043 (digital evidence and investigation)
- Supply chain & sector guidance: 27036 (supplier relationships), 27011 (telecoms), 27019 (energy), 27799 (health information)
Why it matters
Adopting the framework delivers security protection, regulatory compliance, stakeholder confidence, systematic risk management, a culture of continuous improvement and competitive differentiation.
Getting certified
Certification to ISO 27001 follows a familiar path: become familiar with the standard, assure compliance, run a gap analysis, plan and implement, train your people, conduct internal audits, then the Stage 1 and Stage 2 certification audits, certificate issuance, and ongoing maintenance. The series continues to evolve, with new standards under development for digital forensics, AI/ML security, IoT and privacy engineering, and existing standards reviewed on roughly five-year cycles.