What does ISO 27001 define?

The requirements for an information security management system (ISMS): for establishing, implementing, operating, monitoring, reviewing, maintaining and improving it with respect to the organisation's business risks, including the introduction of security controls tailored to the organisation.

* The life-cycle verbs of the definition form a loop: plan, do, check, act, and round again. *

ISO/IEC 27001 is the best-known and most widely used norm of the large ISO 27000 family. Its point is to ensure that an organisation selects sufficient and appropriate security controls that protect its information and give interested parties confidence. It applies to every kind of organisation: companies, government bodies, non-profits.

The list of verbs in the definition describes a cycle, not a one-off project: the ISMS is set up, run, checked and improved, again and again. The 2005 edition named this Plan-Do-Check-Act loop explicitly; later editions keep the continual improvement. The definition quoted here is the blurb of the German edition DIN EN ISO/IEC 27001:2017-06; the current German edition is DIN EN ISO/IEC 27001:2024-01, which carries ISO/IEC 27001:2022.

Note what it is not: it does not tell you how to build a secure network or system. It defines how security is managed, which is why it matters to the architect mainly as a source of requirements (next card).

Go deeper:

• DIN Media — DIN EN ISO/IEC 27001:2024-01 — the current German edition, which replaced the 2017 edition quoted above.
• Information security management — Wikipedia — what an ISMS consists of: risk assessment, controls, people and policies.
• PDCA — Wikipedia — the plan-do-check-act cycle behind continual improvement in management systems.