ISO/IEC 27001 in plain English
ISO/IEC 27001 comes from two international standards organizations: ISO (the International Organization for Standardization) and IEC (the International Electrotechnical Commission). The current version dates from 2022. The standard describes how an ISMS must be set up – that is, the management system a company uses to plan, implement, review, and improve its information security.
A comparison helps: the standard works much like a car’s periodic safety inspection. There are fixed inspection rules, an independent inspection body, and, at the end, a sticker – with ISO/IEC 27001, that sticker is the certificate. Unlike with a car, however, the company itself decides which safeguards fit its risks. It just has to justify those decisions in a traceable way.
Any company can use the standard as a guide. Companies that want to prove their implementation have it audited by an accredited certification body. Accredited means that the body itself has been assessed and approved – in Germany, by the German Accreditation Body (DAkkS).
What ISO/IEC 27001 covers
The standard consists of two parts:
- Clauses 4 to 10 contain the mandatory requirements for the management system. These include leadership and responsibility, risk assessment, resources and competence, internal audits, management review, and continual improvement.
- Annex A lists 93 security controls in four themes: organizational, people, physical, and technological controls. Examples include access rights, training, physical access control, data backup, encryption, and secure software development.
At the core of the standard is the risk assessment. The company determines which risks exist for its information and decides how to handle them. In the Statement of Applicability, it records which Annex A controls it implements – and justifies why it doesn’t apply certain ones. Implementation guidance for the controls is provided by the companion standard ISO/IEC 27002.
The standard doesn’t explicitly require penetration tests – authorized, simulated attacks by experts. However, Annex A includes, among other things, a control for identifying, evaluating, and addressing technical vulnerabilities (control 8.8). Another covers security testing during development and acceptance (control 8.29). A pentest is a recognized way to demonstrate both in a traceable manner.
Certification takes place in two stages: first, the certification body reviews the documentation and preparation; then it checks whether the ISMS is actually practiced in day-to-day operations. The certificate is valid for three years. In the years in between, the body checks in annual surveillance audits whether the ISMS continues to work; after that, recertification follows. The transition period for certificates based on the previous 2013 version expired at the end of October 2025. One alternative is ISO 27001 certification on the basis of IT-Grundschutz – the baseline protection methodology of the BSI (Germany’s Federal Office for Information Security) – which is issued by the BSI itself.
A practical example
Here’s a typical scenario: A mid-sized software company develops a payroll platform. A major new customer requires ISO/IEC 27001 certification in its tender. The company defines the development and operation of the platform as its scope, appoints a responsible person, and assesses the risks. In the Statement of Applicability, it records that security tests take place before every major release. A penetration test of the platform uncovers a flaw in the authorization checks: logged-in users could retrieve the payroll records of other business customers. The team fixes the flaw before the audit, and a retest confirms the fix. In the audit, the company can demonstrate that its measures don’t just exist on paper.
Why does this matter for businesses?
In business, an ISO/IEC 27001 certificate is widely used as proof of audited information security. Many clients ask for it – especially when service providers work with sensitive data or are given access to their systems. Without a certificate, companies often have to fill out extensive questionnaires or are excluded from some tenders from the outset.
The standard also makes it easier to meet legal obligations. Organizations that fall under NIS2 can use an ISMS based on ISO/IEC 27001 to implement the required risk management measures in a structured way. In Germany, operators of electricity and gas networks even have to demonstrate an ISMS certified to the standard under the IT Security Catalog of the Federal Network Agency (Bundesnetzagentur).
It’s just as important to understand the limits: a certificate proves that a management system is working. It is not proof that your systems are free of vulnerabilities. That’s exactly why technical testing is part of an effective ISMS.
What businesses should do now
- Clarify your goal: Do you want to use the standard as a guide or obtain a certificate – for example, because customers require it?
- Define the scope: Start with the areas that matter most to your customers.
- Identify gaps: Compare your current state with clauses 4 to 10 and the Annex A controls.
- Document decisions: Record your risk assessment and your choice of controls in the Statement of Applicability.
- Demonstrate technical effectiveness: Schedule vulnerability scans and penetration tests as fixed items – before the audit and at regular intervals afterward.
- Involve the certification body early: Clarify the process and timeline with an accredited body in good time.
How Rootsektor can help
Rootsektor provides the technical evidence an ISMS based on ISO/IEC 27001 needs. Our Penetration Testing services cover web applications, networks, cloud environments, and more. We rate every finding using CVSS, a standard for scoring the severity of vulnerabilities, and add an executive summary for senior management and concrete recommendations for action. On completion, you’ll receive a test certificate to present to auditors and customers, and we check remediated vulnerabilities again in a free retest. The certification itself is carried out by an accredited certification body.