ISO/IEC 27001
Information security management systems - Requirements
Overview
Specifies requirements for establishing, implementing, maintaining and continually improving an information security management system (ISMS). Provides a systematic approach to managing sensitive company information.
Applicability
Organizational security management and governance
Relevance to Network and Information Security Directive (NIS2)
Key Coverage Areas
Standard Sections & Chapters
Organizational controls
People controls
Physical controls
Technological controls
Policies for information security
Threat intelligence
Information security for use of cloud services
User endpoint devices
Privileged access rights
Information access restriction
Management of technical vulnerabilities
Related Network and Information Security Directive (NIS2) Articles
Article I: SECTORS OF HIGH CRITICALITY
View Article →Comprehensive security controls for critical sectors
Implementation Guidance:
Essential entities must implement full ISO 27001 ISMS with all applicable controls
Mapped Obligations:
- Stricter incident reporting timelines and penalties for non-compliance
Article II: OTHER CRITICAL SECTORS
View Article →Core security management for important entities
Implementation Guidance:
Important entities should implement ISO 27001 ISMS focusing on key controls
Mapped Obligations:
- Cybersecurity risk management measures must be implemented
- Incident reporting obligations apply with specified timelines
Article 6: Definitions
View Article →Strategic security governance and policy framework
Implementation Guidance:
Establish national-level ISMS aligned with ISO 27001 governance requirements
Mapped Obligations:
- Using these definitions to properly classify incidents, risks, and cyber threats
Article 20: Governance
View Article →Leadership and organizational cybersecurity governance
Implementation Guidance:
Establish top management commitment and governance structure per ISO 27001
Mapped Obligations:
- Management bodies must formally approve all cybersecurity risk-management measures
- Management must oversee implementation of cybersecurity measures
- Management can be held personally liable for non-compliance
- Management members must undergo mandatory cybersecurity training
- Organizations should provide regular cybersecurity training to all employees
Article 21: Cybersecurity risk-management measures
View Article →Risk assessment and treatment, organizational and technological controls
Implementation Guidance:
Implement comprehensive ISMS with risk management, access control, vulnerability management, incident response
Mapped Obligations:
- Set up incident handling procedures
- Ensure business continuity through backup management and disaster recovery plans
- Secure supply chains by assessing suppliers and service providers
- Manage security in system development and maintenance including vulnerability handling
- Provide basic cyber hygiene practices and cybersecurity training
- Implement cryptography and encryption policies where appropriate
- Enforce human resources security, access control and asset management
- Use multi-factor or continuous authentication where appropriate
Article 22: Union level coordinated security risk assessments of critical supply chains
View Article →ICT readiness for business continuity
Implementation Guidance:
Integrate ICT continuity into overall business continuity
Mapped Obligations:
- Member states must participate in EU-level coordinated supply chain risk assessments when requested
- Organizations may need to provide information about their critical ICT supply chains for assessment
- Stakeholders must cooperate with Commission and ENISA during supply chain evaluations
Article 23: Reporting obligations
View Article →Information security event management and reporting
Implementation Guidance:
Implement event logging, monitoring, and reporting to authorities
Mapped Obligations:
- Report significant incidents to CSIRT or competent authority without undue delay
- Submit early warning within 24 hours of becoming aware of incident
- Submit incident notification within 72 hours with initial assessment
- Submit final report within one month after incident notification
- Notify recipients/customers of services about significant incidents that may affect them
- Cooperate with authorities on cross-border incident information sharing
Article 28: Database of domain name registration data
View Article →Supplier relationships and supply chain policy
Implementation Guidance:
Define and monitor supplier security requirements and agreements
Article 32: Supervisory and enforcement measures in relation to essential entities
View Article →Performance evaluation and auditing
Implementation Guidance:
Conduct regular audits and assessments of cybersecurity measures
Mapped Obligations:
- Comply with binding instructions to prevent or remedy incidents
- Ensure management has power and liability for compliance
Quick Information
- Organization
- ISO/IEC
- Category
- Information Security Management
- Certification
- ✓ Available