TodayTools

ISO/IEC 27001:2022 flashcards

The world standard for running an information security system.

Donate
Beginner friendly, starts from zero
Section
How to study
0
ISO/IEC 27001:2022Start from zero · 1 of 12

What is ISO 27001, in one plain sentence?

It is an international rulebook that tells a company how to look after its information safely, and lets an outside checker confirm that it really does.

A rulebook plus a referee.

All topics

ISO/IEC 27001:2022 at a glance

ISO 27001 is an international rulebook for keeping a company's information safe, checked by an outside auditor.

Like a hygiene inspection for a restaurant kitchen: the habits are checked, regularly, not one clean plate.

Words you will meet

ISMS
The whole set of rules, people and habits that keep information safe
Scope
The part of the company the rules cover
Risk
Something bad that could happen to information
Control
A step that lowers a risk, like a lock or a password
Policy
A short written rule everyone must follow
Audit
A careful check that you do what you say
Clause
A numbered section of the standard with must-do rules
Annex A
The list of 93 controls you choose from

The steps

  1. 1. Start from zero (12 cards): What ISO 27001 is, the words you need, and how certification works.
  2. 2. Core basics (14 cards): The ISMS, the clauses and Annex A.
  3. 3. Next steps (15 cards): Risk assessment, treatment, the SoA and the documents.
  4. 4. Go deeper (16 cards): Certification audits, nonconformities and the wider ISO family.
All 12 cards in Start from zero
What is ISO 27001, in one plain sentence?
It is an international rulebook that tells a company how to look after its information safely, and lets an outside checker confirm that it really does.
Before a shared standard, how did customers judge a supplier's security?
Each big customer sent its own long security questionnaire, and every supplier answered in its own way. One shared standard means one check that many customers trust.
Where might you already meet ISO 27001 in daily life?
When your bank, payroll firm or a cloud storage service says it keeps your data safe, an ISO 27001 certificate is often the proof it shows. Tenders and supplier forms ask for it too.
What everyday check is ISO 27001 most like?
A hygiene inspection for a restaurant kitchen. The inspector checks how it runs day to day, not one clean plate, and comes back regularly.
What do 'ISO' and 'standard' mean?
ISO is the International Organization for Standardization, a global group that publishes standards. A standard is an agreed written way of doing something, like the size of a bank card; ISO/IEC 27001 is one, made with the IEC, a partner group.
What do 'information security' and 'information asset' mean?
Information security is protecting information from being seen, changed or lost, by mistake or on purpose. An information asset is anything holding information worth protecting, like a customer list, a laptop or a password.
What are a 'risk' and a 'control'?
A risk is something bad that could happen, like a stolen laptop exposing customer data. A control is a step that lowers that risk, like a strong password and scrambling the disk so a thief cannot read it.
What do 'policy', 'scope' and 'ISMS' mean?
A policy is a short written rule everyone must follow. Scope is the part of the company the rules cover. An ISMS (Information Security Management System) is the whole set of rules, people and habits that keeps information safe.
What do 'audit', 'certification' and 'accredited' mean?
An audit is a careful check by someone else that you do what you say. Certification is when an approved auditing firm issues a certificate after you pass. Accredited means that firm was itself checked and approved by a national body.
What are a 'clause' and 'Annex A'?
A clause is a numbered section of the standard; clauses 4 to 10 hold the must-do rules. Annex A is a list at the end of 93 controls you choose from, based on your risks.
What do you need before starting this topic?
Nothing to install and no coding. It helps to know roughly how a company works: its teams, offices, laptops and the online services it uses. The standard itself is bought from ISO or your national standards body.
What will you be able to do after this topic?
Explain what a certificate covers, name the main clauses and Annex A themes, run a simple risk assessment, and know what an auditor will ask to see.
ISO/IEC 27001:2022 cheatsheet

Clauses

  • 4 Context Issues, parties, scope (4.3)
  • 5 Leadership Commitment, policy (5.2), roles
  • 6 Planning Risk 6.1.2, treatment 6.1.3, objectives 6.2
  • 7 Support Resources, competence, awareness, documents
  • 8 Operation Run risk work 8.2, 8.3
  • 9 Evaluation Monitoring 9.1, audit 9.2, review 9.3
  • 10 Improvement Nonconformity and corrective action 10.2

Annex A themes

  • A.5 Organisational 37 controls
  • A.6 People 8 controls
  • A.7 Physical 14 controls
  • A.8 Technological 34 controls
  • Total 93 (114 in 2013), 11 new

Must keep documents

  • Scope 4.3
  • Policy 5.2
  • Risk process and results 6.1.2, 8.2
  • Treatment plan and SoA 6.1.3
  • Objectives 6.2
  • Competence records 7.2
  • Internal audit results 9.2
  • Management review 9.3
  • Nonconformities 10.2

Risk treatment

  • Modify Add controls
  • Retain Accept, signed by owner
  • Avoid Stop the activity
  • Share Insurance or vendor
  • Residual What is left after controls

Certification cycle

  • Stage 1 Readiness and documents
  • Stage 2 Controls work in practice
  • Year 2, Year 3 Surveillance audits
  • Before expiry Recertification
  • Major NC Close before certificate
  • 31 Oct 2025 2013 certificates ended
Donate