What is ISO 27001?
ISO/IEC 27001 is an international standard for an information security management system (ISMS), certified by accredited auditors, covering how an organization manages information security risk.
In more detail
The standard sets requirements for establishing, running and improving an ISMS: risk assessment, a statement of applicability, controls drawn from Annex A, internal audits and management review. Accredited certification bodies issue the certificate after an audit, and it is maintained through periodic surveillance audits. Scope matters. A certificate can cover one office or one product, so read the scope statement. ISO 27001 certifies the management system, while SOC 2 reports on controls as tested by a CPA. Many companies hold both, because customers in different regions ask for different ones. Neither guarantees a given project is secure.
Example
A procurement team asks a prospective vendor for its ISO 27001 certificate and scope statement. The scope lists the hosting service but not the vendor's support tools, which leads to a follow-up question.