ISO/IEC 27001
ISO/IEC 27001 is the international standard that specifies requirements for an information security management system (ISMS). The current edition is ISO/IEC 27001:2022, amended in February 2024 by Amendment 1, and organizations are certified against it by accredited third-party certification bodies, not by ISO itself.
The 2024 amendment is narrow: it adds climate change as an issue the organization must consider when setting the context of its ISMS (clauses 4.1 and 4.2), and changes no controls. The identity work sits in Annex A: 5.15 Access control, 5.16 Identity management, 5.17 Authentication information, 5.18 Access rights, 8.2 Privileged access rights and 8.5 Secure authentication, which auditors test through evidence of provisioning, access reviews, prompt deprovisioning, MFA coverage and privileged access control. Unlike a SOC 2 report, which is an auditor's attestation read by customers, ISO 27001 produces a certificate with a declared scope and a Statement of Applicability, so check the scope covers the systems you care about.
See also: identity controls for ISO 27001, SOC 2, IAM audit preparation, access certification, joiner-mover-leaver
Related on Start with Identity
- GlossaryIGA
Identity Governance and Administration. The discipline of managing who has access to what, why, and for how long. Covers access certification, segregation of du
- GlossaryOSCAL (Open Security Controls Assessment Language)
OSCAL (Open Security Controls Assessment Language) is a NIST-led set of machine-readable formats, in XML, JSON and YAML, for writing down security controls and
- GlossarySegregation of Duties (SoD)
Ensuring no single user can complete a sensitive process unilaterally, for example, both creating and approving a vendor payment. SoD policies are encoded into
- RankingCompliant CIAM Platforms: SOC 2 Type II, ISO 27001:2022 & HIPAA
The most compliance-ready CIAM platforms in 2026: Auth0, Stytch, MojoAuth, WorkOS, Ping Identity, Clerk, SSOJet, and Frontegg. Ranked on SOC 2 Type II, ISO 2700
- RankingCompliant IGA Platforms: SOC 2, ISO 27001:2022 & FedRAMP
The most compliance-ready IGA platforms in 2026: SailPoint, Saviynt, Omada, One Identity, and RSA Governance. Ranked on SOC 2 Type II, ISO 27001:2022, FedRAMP,
- RankingCompliant PAM Platforms: SOC 2, ISO 27001:2022, HIPAA & FedRAMP
The most compliance-ready PAM platforms in 2026: CyberArk, BeyondTrust, Delinea, One Identity Safeguard, and WALLIX. Ranked on SOC 2 Type II, ISO 27001:2022, HI