Curriculum
- 2 Sections
- 35 Lessons
- 26 Weeks
- ISO/IEC 2700110
- 1.1Introduction to ISO/IEC 27001
- 1.2Overview of Information Security Management System (ISMS)
- 1.3Structure of ISO/IEC 27001
- 1.4Context of the Organization (Clause 4)
- 1.5Leadership (Clause 5)
- 1.6Planning (Clause 6)
- 1.7Support (Clause 7)
- 1.8Operation (Clause 8)
- 1.9Performance Evaluation (Clause 9)
- 1.10Improvement (Clause 10)
- ISO 19011: Guidelines for auditing management systems26
- 2.1Introduction to ISO19011
- 2.2Principles of Auditing
- 2.3Managing an Audit Program
- 2.4Establishing Audit Program Objectives
- 2.5Determining Audit Program Risks and Opportunities
- 2.6Establishing the Audit Program
- 2.7Implementing the Audit Program
- 2.8Monitoring the Audit Program
- 2.9Reviewing and Improving the Audit Program
- 2.10Initiating the Audit
- 2.11Determining Audit Feasibility
- 2.12Preparing Audit Activities
- 2.13Reviewing Documented Information
- 2.14Preparing the Audit Plan
- 2.15Assigning Work to the Audit Team
- 2.16Preparing Working Documents
- 2.17Opening Meeting
- 2.18Communication During the Audit
- 2.19Collecting and Verifying Information
- 2.20Generating Audit Findings
- 2.21Preparing Audit Conclusions
- 2.22Closing Meeting
- 2.23Preparing the Audit Report
- 2.24Completing the Audit
- 2.25Follow-Up Activities
- 2.26ISO/IEC 27001120 Minutes40 Questions
Structure of ISO/IEC 27001
Structure of ISO/IEC 27001
To effectively understand ISO/IEC 27001, it is essential to become familiar with how the standard is structured. The structure provides a logical and systematic framework that organizations follow when establishing, implementing, maintaining, and improving their Information Security Management System (ISMS).
ISO/IEC 27001 follows what is known as the High-Level Structure (HLS). This structure is used across many ISO management system standards, enabling consistency, alignment, and easier integration with other frameworks. By adopting this unified structure, organizations can combine multiple management systems—such as quality, environmental, or business continuity—into a single, cohesive system.
The High-Level Structure is composed of a standardized set of clauses, core text, and common terminology. This consistency ensures that all ISO management system standards share a similar layout, making them easier to understand and implement together.
In ISO/IEC 27001, the requirements that organizations must follow are contained within Clauses 4 through 10. These clauses represent the operational core of the standard and define what an organization must do to establish and maintain an effective ISMS.
Clauses 1 to 3, on the other hand, provide introductory information:
- Clause 1: Scope – Defines the applicability of the standard
- Clause 2: Normative References – Lists referenced documents
- Clause 3: Terms and Definitions – Provides key terminology
While these clauses are important for context, they do not contain mandatory requirements. The actionable requirements begin from Clause 4 onward.
Clause 4: Context of the Organization
Clause 5: Leadership
Clause 6: Planning
Clause 7: Support
Clause 8: Operation
Clause 9: Performance Evaluation
Clause 10: Improvement
The clauses in ISO/IEC 27001 are not isolated—they are interconnected and designed to function as a cohesive system. For example:
- The context (Clause 4) influences how risks are identified in planning (Clause 6)
- Leadership (Clause 5) drives the direction and commitment needed for implementation
- Support (Clause 7) enables effective operation (Clause 8)
- Performance evaluation (Clause 9) feeds into improvement (Clause 10)
This interconnected approach ensures that information security is managed systematically rather than in isolated silos.
Annex A – A Supporting Component
In addition to Clauses 4–10, ISO/IEC 27001 includes Annex A, which provides a list of reference controls. These controls are not mandatory by default; instead, organizations select relevant controls based on their risk assessment.
Annex A acts as a toolbox that supports the requirements defined in the main clauses. It helps organizations identify appropriate measures to mitigate risks and protect information assets.
Alignment with Other Standards
Because ISO/IEC 27001 follows the High-Level Structure, it aligns closely with other ISO standards such as quality management and business continuity. This alignment allows organizations to integrate multiple management systems, reducing duplication and improving efficiency.
For example, processes for document control, internal audits, and management reviews can often be shared across different standards, saving time and resources.
The structure of ISO/IEC 27001 provides a clear and logical framework for managing information security. By understanding how the clauses are organized and how they interact, organizations can implement an ISMS that is both effective and aligned with their business objectives.