# iso-27001

Source: https://startwithidentity.com/glossary/iso-27001/
Last updated: 2026-10-17
License: content by Start with Identity. Cite the source URL.

---

ISO/IEC 27001 is the international standard that specifies requirements for an information security management system (ISMS). The current edition is [ISO/IEC 27001:2022](https://www.iso.org/standard/27001), amended in February 2024 by [Amendment 1](https://www.iso.org/standard/88435.html), and organizations are certified against it by accredited third-party certification bodies, not by ISO itself.

The 2024 amendment is narrow: it adds climate change as an issue the organization must consider when setting the context of its ISMS (clauses 4.1 and 4.2), and changes no controls. The identity work sits in Annex A: 5.15 Access control, 5.16 Identity management, 5.17 Authentication information, 5.18 Access rights, 8.2 Privileged access rights and 8.5 Secure authentication, which auditors test through evidence of provisioning, [access reviews](https://startwithidentity.com/glossary/access-certification/), prompt [deprovisioning](https://startwithidentity.com/glossary/deprovisioning/), MFA coverage and privileged access control. Unlike a [SOC 2](https://startwithidentity.com/glossary/soc2/) report, which is an auditor's attestation read by customers, ISO 27001 produces a certificate with a declared scope and a Statement of Applicability, so check the scope covers the systems you care about.

See also: [identity controls for ISO 27001](https://startwithidentity.com/guides/compliance/identity-controls-for-iso-27001/), [SOC 2](https://startwithidentity.com/glossary/soc2/), [IAM audit preparation](https://startwithidentity.com/guides/compliance/iam-audit-preparation-guide/), [access certification](https://startwithidentity.com/glossary/access-certification/), [joiner-mover-leaver](https://startwithidentity.com/glossary/joiner-mover-leaver/)