ISO 27001 is a standard of the International Organization for Standardization. It describes the requirements for an Information Security Management System (ISMS) and is comparable to other ISO management systems like ISO 9001 (quality management). ISO 27001 is the only standard of the ISO 2700X family for which a certification can be obtained. Annex A of the standard lists information security controls, which are further described in ISO 27002. ISO 27001 und ISO 27002 look at information security as a whole and do not only cover IT security, but also additional aspects such as physical security.
