ISO 27001:2013

What is ISO 27001-2013?

ISO 27001:2013 is the 2013 version of the international standard for an Information Security Management System (ISMS). It provides a globally recognised framework for organisations to manage and protect their sensitive information assets systematically. This version was a significant update from its 2005 predecessor, adopting a new high-level structure (Annex SL) to make it easier to integrate with other management system standards like ISO 9001 (Quality) and ISO 14001 (Environment).

While the standard has since been updated to ISO 27001:2022, the 2013 version remains widely used and understood. Organisations that were certified under the 2013 version are currently in a transition period to the 2022 version.

ISO 27001 Context

The standard itself is a set of requirements that organisations must meet to protect the confidentiality, integrity, and availability of their information. It is designed to be applicable to organisations of all types and sizes, and its core principle is a risk-based approach to information security.

About the author

🎓 MSc Security 🛡️ Lead Auditor ⚡ 30+ Years Exp 🏢 Ex-GE Leader

Stuart Barker

ISO 27001 Ninja

Stuart Barker is a veteran practitioner with over 30 years of experience in systems security and risk management. Holding an MSc in Software and Systems Security, he combines academic rigor with extensive operational experience, including a decade leading Data Governance for General Electric (GE).

As a qualified ISO 27001 Lead Auditor, Stuart possesses distinct insight into the specific evidence standards required by certification bodies. His toolkits represent an auditor-verified methodology designed to minimise operational friction while guaranteeing compliance.