ISO/IEC 27001:2022 Sécurité de l'information, cybersécurité et protection de la vie privée – Systèmes de gestion de la sécurité de l'information – Exigences

ISO/IEC 27001 is the leading international standard for information security management. It specifies the requirements for establishing, implementing, maintaining, and continually improving an information security management system (ISMS) — a risk-based approach to protecting the confidentiality, integrity, and availability of information. It applies to organisations of any size or sector and is independently certifiable by accredited bodies.

The current edition was published in October 2022, updating the 2013 version and refreshing its Annex A catalogue to 93 controls grouped into four themes: organisational, people, physical, and technological. Organisations holding 2013 certificates were required to transition to the 2022 edition by 31 October 2025. Certification is widely used to demonstrate security maturity to customers, partners, and regulators.