ISO/IEC 27001 is the international standard for an information security management system (ISMS) — a risk-based, auditable framework of policies, controls, and continual-improvement processes for protecting information. Organizations are certified to it by accredited third parties, making it one of the two most widely-requested security assurances worldwide (alongside SOC 2). Its companion, ISO/IEC 27002, provides the detailed control catalog. The current edition is ISO/IEC 27001:2022.
ISO/IEC 27001
ISO/IEC 27001 is the international benchmark for running an information security program as a system rather than a checklist — a certifiable management framework of risk assessment, controls, and continual improvement. Where SOC 2 produces an auditor’s report, ISO 27001 produces a certificate from an accredited body, and between them they cover most of what a security-conscious buyer asks for.
- A management system, not a control list - It certifies that an organization runs security as a governed process; ISO 27002 supplies the control catalog it draws from.
- Third-party certified - An accredited registrar audits and issues the certificate, refreshed on a surveillance cycle.
- The global counterpart to SOC 2 - Non-US buyers tend to ask for ISO 27001; US buyers ask for SOC 2; serious vendors hold both.
ISO 27001 shows up throughout the trust-center posture of the payments and healthcare providers I score, and I catalogue it for the same reason I catalogue SOC 2 and HITRUST: it is real, and it is not the same thing as an agent-legible API. A certificate reassures a procurement team; it does not publish scopes, examples, idempotency, or consent. Keeping that distinction sharp is most of the point of the Kin Score.
Related standards
Standards this one builds on, supersedes, profiles or is commonly deployed beside.
SOC 2
ISO 27001 (a certifiable standard) and SOC 2 (an attestation report) are the two most-requested security assurances.
NIST
ISO 27001 controls map closely to NIST frameworks widely used in the US.
