{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/iso-27001","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/iso-27001/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/iso-27001/"},"term":{"en":"ISO 27001","da":"ISO 27001"},"aka":{"en":["ISO/IEC 27001","ISMS standard"],"da":["ISO/IEC 27001"]},"domain":["security"],"cluster":"compliance","layer":"governance","status":"current","era":2005,"summary":{"en":"The international standard for running an information security management system that can be certified.","da":"Den internationale standard for at drive et ledelsessystem for informationssikkerhed, som man kan opnå certificering efter."},"body":{"formal":{"en":"An international standard, current edition 2022, whose clauses 4-10 set the requirements for an information security management system - context, leadership, planning, support, operation, performance evaluation and improvement - with Annex A listing 93 controls to choose from.","da":"En international standard, nuværende udgave fra 2022, hvis afsnit 4-10 stiller kravene til et ledelsessystem for informationssikkerhed - kontekst, ledelse, planlægning, støtte, drift, evaluering og forbedring - mens anneks A rummer 93 kontroller at vælge imellem."},"plain":{"en":"A set of house rules for running security as a daily routine rather than a one-off clean-up - written so that an outside inspector can check it is really followed.","da":"En husorden for at drive sikkerhed som fast rutine frem for en engangsoprydning - skrevet, så en udefrakommende kan kontrollere, at den faktisk bliver fulgt."},"inPractice":{"en":"Danish state bodies must follow ISO 27001, so the security lead at a ministry uses its clauses to set the scope, run the risk assessment, pick controls from Annex A and report maturity each year - without seeking a certificate.","da":"Danske statslige myndigheder skal følge ISO 27001, så den sikkerhedsansvarlige i et ministerium bruger standarden til at fastlægge omfanget, lave risikoanalysen, vælge kontroller fra anneks A og indberette modenhed hvert år - uden at søge om certifikat."},"whyItMatters":{"en":"Without a common measure every customer, auditor and authority would ask for security to be shown in a different way; ISO 27001 gives one structure that can be recognised, audited and mapped to laws such as NIS2.","da":"Uden en fælles målestok ville hver kunde, revisor og myndighed kræve sikkerheden dokumenteret på sin egen måde; ISO 27001 giver én struktur, der kan genkendes, auditeres og kobles til love som NIS2."}},"deepDive":{"en":"The normative core is clauses 4-10, written in the harmonized structure used by all ISO management system standards; clauses 0-3 are introduction, scope, normative reference (ISO/IEC 27000) and terms. Annex A is also normative, but its 93 controls only become obligations through clause 6.1.3: the organisation determines the controls needed to treat its assessed risks, compares them with Annex A to verify that nothing necessary has been omitted, and records the result in the Statement of Applicability. Annex A is explicitly not exhaustive, so controls from other sources (CIS Controls, sector rules, customer contracts) can and often should be added.\n\nThe 2022 revision changed more than the annex. Clause 4.2 now asks which interested-party requirements will be addressed through the ISMS, 4.4 refers to the processes and their interactions, 6.3 requires changes to the ISMS to be planned, 8.1 requires criteria for processes, and management review (9.3.2) must consider changes in the needs and expectations of interested parties. Amendment 1:2024 added to clause 4.1 that the organisation must determine whether climate change is a relevant issue, and a note to 4.2 that interested parties can have climate-related requirements. Under IAF MD 26, certificates against the 2013 edition had to be transitioned by 31 October 2025.\n\nThe standard demands specific documented information rather than a fixed document set: the scope, the policy, the risk assessment and treatment processes, the SoA, objectives, evidence of competence, operational planning records, risk assessment and treatment results, monitoring results, the audit programme and audit results, management review results, and records of nonconformities and corrective actions. Certification is carried out by bodies accredited under ISO/IEC 17021-1 and ISO/IEC 27006 (in Denmark by DANAK); the initial audit runs in two stages, and nonconformities are graded major or minor, with a major one blocking certification until it is corrected.\n\nFrequent failure modes are over-narrow scopes, a risk method whose results cannot be reproduced, SoA exclusions justified with \"not relevant\" but no risk rationale, and internal audits performed by the people who run the controls, which undermines the objectivity required by 9.2. Compared with NIS2 the standard is voluntary and silent on legal deadlines such as the 24-hour early warning; compared with the NIST CSF it prescribes a management system rather than a catalogue of outcomes; and compared with ISO/IEC 27002 it states what must be done, while 27002 explains how each control can be implemented.","da":"Den normative kerne er afsnit 4-10, skrevet i den harmoniserede struktur, som alle ISO's ledelsessystemstandarder bruger; afsnit 0-3 er indledning, anvendelsesområde, normativ reference (ISO/IEC 27000) og definitioner. Anneks A er også normativt, men de 93 kontroller bliver først til forpligtelser gennem afsnit 6.1.3: organisationen fastlægger de kontroller, der skal til for at håndtere de vurderede risici, sammenholder dem med anneks A for at sikre, at intet nødvendigt er udeladt, og dokumenterer resultatet i Statement of Applicability. Anneks A er udtrykkeligt ikke udtømmende, så kontroller fra andre kilder (CIS Controls, sektorregler, kundekontrakter) kan og bør ofte tilføjes.\n\nRevisionen i 2022 ændrede mere end annekset. Afsnit 4.2 spørger nu, hvilke interessentkrav der skal håndteres gennem ISMS'et, 4.4 henviser til processerne og deres samspil, 6.3 kræver, at ændringer af ISMS'et planlægges, 8.1 kræver kriterier for processerne, og ledelsens evaluering (9.3.2) skal tage højde for ændringer i interessenternes behov og forventninger. Tillæg 1 fra 2024 føjede til afsnit 4.1, at organisationen skal afgøre, om klimaforandringer er et relevant forhold, og en note til 4.2 om, at interessenter kan have klimarelaterede krav. Efter IAF MD 26 skulle certifikater efter 2013-udgaven være overført til den nye udgave senest 31. oktober 2025.\n\nStandarden kræver bestemt dokumenteret information frem for et fast dokumentsæt: omfanget, politikken, processerne for risikovurdering og risikohåndtering, SoA'en, målene, dokumentation for kompetencer, planlægning af driften, resultaterne af risikovurdering og -håndtering, overvågningsresultater, auditprogrammet og auditresultaterne, resultaterne af ledelsens evaluering samt registrering af afvigelser og korrigerende handlinger. Certificering udføres af organer, der er akkrediteret efter ISO/IEC 17021-1 og ISO/IEC 27006 (i Danmark af DANAK); den første audit forløber i to trin, og afvigelser klassificeres som større eller mindre, hvor en større afvigelse blokerer certificeringen, indtil den er rettet.\n\nHyppige fejl er for snævre omfang, en risikometode, hvis resultater ikke kan genskabes, fravalg i SoA'en begrundet med \"ikke relevant\" uden risikomæssig begrundelse, og interne audits udført af dem, der selv driver kontrollerne, hvilket undergraver den objektivitet, 9.2 kræver. I forhold til NIS2 er standarden frivillig og tavs om lovbestemte frister som den tidlige varsling inden for 24 timer; i forhold til NIST CSF foreskriver den et ledelsessystem frem for et katalog af ønskede resultater; og i forhold til ISO/IEC 27002 siger den, hvad der skal gøres, mens 27002 forklarer, hvordan hver kontrol kan gennemføres."},"edges":[{"type":"kind-of","to":"security/security-framework","confidence":"high","strength":"normal"},{"type":"part-of","to":"security/iso-27000-series","confidence":"high","strength":"normal"},{"type":"contrasts-with","to":"security/nis2","why":{"en":"NIS2 is a law you must obey; ISO 27001 is a voluntary standard you can use to meet it.","da":"NIS2 er en lov, man skal overholde; ISO 27001 er en frivillig standard, man kan bruge til at opfylde den."},"confidence":"high","strength":"normal"},{"type":"contrasts-with","to":"security/nist-csf","why":{"en":"ISO 27001 is a management system a firm can be certified against; the NIST CSF is a free, voluntary framework of outcomes with no certificate.","da":"ISO 27001 er et ledelsessystem, man kan opnå certificering efter; NIST CSF er et gratis, frivilligt rammeværk af mål uden certifikat."},"confidence":"high","strength":"normal"},{"type":"used-with","to":"security/iso-27002","why":{"en":"ISO 27002 explains how to carry out the controls listed in ISO 27001's annex.","da":"ISO 27002 forklarer, hvordan kontrollerne i ISO 27001's anneks udføres."},"confidence":"high","strength":"primary"},{"type":"mandates","to":"security/risk-management","why":{"en":"Controls must be chosen from a documented risk assessment and treatment plan.","da":"Kontroller skal vælges ud fra en dokumenteret risikovurdering og plan for risikohåndtering."},"confidence":"high","strength":"primary"},{"type":"mandates","to":"security/pdca","why":{"en":"The system must be reviewed and improved in a repeating cycle.","da":"Systemet skal evalueres og forbedres i en tilbagevendende cyklus."},"confidence":"high","strength":"primary"},{"type":"mandates","to":"security/audit","why":{"en":"Clause 9.2 requires planned internal audits of the management system.","da":"Afsnit 9.2 kræver planlagte interne audits af ledelsessystemet."},"confidence":"high","strength":"normal"},{"type":"mandates","to":"security/management-responsibility","confidence":"high","strength":"normal"},{"type":"mandates","to":"security/security-policy","confidence":"high","strength":"normal"},{"type":"mandates","to":"security/isms","confidence":"high","strength":"normal"},{"type":"mandates","to":"security/statement-of-applicability","confidence":"high","strength":"normal"}],"depth":0,"sources":[{"title":"Cyber Security Fast Track - Ordliste","tier":"course-material"},{"title":"ISO/IEC 27001:2022","tier":"standard","publisher":"ISO/IEC"}],"draft":true}