Your security and compliance glossary

All the terms you need to know when you’re trying to get compliance audit ready, fast.

Show filters

What is the ISO 27001 security standard?

The ISO/IEC 27001 standard provides requirements for information security management systems (ISMS). Published by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC), the ISO 27001 security standard is a set of best practices that support organizations in managing their information security by addressing people, processes, and technology. The standard applies to organizations of any size or type and is technology- and vendor-neutral.


‍The ISO/IEC 27001 standard engages a risk-based approach to information security, requiring organizations to identify information security risks pertinent to their organization and the space in which they operate, and to select the appropriate controls to address those risks.


‍ISO 27001 comprises 114 controls divided into 14 categories. There is no requirement to implement the full list of ISO 27001’s controls; rather, they are possibilities for an organization to consider based on its particular needs. The 14 categories are:


  • Information security policies
  • Organization of information security and assignment of responsibility
  • Human resource security
  • Information asset management
  • Employee access control
  • Encryption and management of sensitive information
  • Physical and environmental security
  • Operations security
  • Communications security
  • System acquisition, development, and maintenance
  • Supplier relationships
  • Information security incident management
  • Information security aspects of business continuity management
  • Compliance

‍ISO 27001 is a world-class standard that can support an organization in proving its security practices to potential customers. The full standard provides a wide range of controls an organization can utilize to ensure its approach to information security is comprehensive.

Additional resources you might like:

Security
Blog
Lessons from Vanta’s WebAuthn migration

Rob Picard and Jess Chang from Vanta's Security team explain why and how we migrated to WebAuthn as the mandatory way to log into Okta.

Security
Event
Ask Me (Almost) Anything: AI & Compliance

Wondering about AI and what it means for your company’s compliance program? You can ask these privacy and security experts (almost) anything! Join Vanta’s AM(almost)A on June 27 at 10 am PT and 1 pm ET to connect with Matt Cooper, Senior Manager of Privacy, Risk, & Compliance, and Rob Picard, Security Lead, on emerging trends in AI and compliance. They’ll answer questions and share practical advice to help you navigate this evolving landscape and stay ahead of the curve.

Security
Guide
How to minimize third-party risk with vendor management

Get insights and best practices from security & compliance experts on how to manage third-party vendor risk in this free guide.

Get compliant and
build trust, fast.