The standard and the ISMS

ISO/IEC 27001, usually just called ISO 27001, is the leading international standard for information security. It is published jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC), and it is used by organisations of every size and sector around the world.

What ISO 27001 actually specifies is the requirements for an Information Security Management System, or ISMS. That phrase sounds abstract, so it's worth unpacking. An ISMS is not a piece of software and it is not a firewall. It is a structured, documented way of managing information security across a whole organisation: the policies you write, the risks you assess, the controls you put in place, the training you deliver, the incidents you learn from, and the way leadership checks it is all working.

A management system, not a tech checklist

The word to focus on is "management." ISO 27001 does not tell an organisation which antivirus product to buy or how long passwords must be. Instead it requires the organisation to understand its own risks and then choose, apply, and keep improving the controls that address them. Technology is part of the answer, but so are people and processes. A brilliant firewall does not help if someone props open the server room door or emails a client list to the wrong address.

What counts as information

The ISMS protects information in every form it takes: data in systems and cloud services, files on laptops and phones, paper documents, conversations, and even knowledge in people's heads. If it has value to the organisation or could cause harm if lost or exposed, it is in scope.

Why this matters to you

Because an ISMS covers people and processes, not just technology, it covers you. How you handle email, documents, passwords, visitors, and unexpected requests is part of the system that ISO 27001 describes. This course explains the standard at the level you need: enough to understand why the rules exist and what is expected of you day to day.