When and where did ISO 27001 come from?
To understand the purpose of ISO 27001 we need to go back to how it started and how we got to where we are today.
What is ISO/IEC 27001?
ISO 27001 is the world’s best-known standard for information security management systems (ISMS). It defines the requirements an ISMS must meet.
It is formally called ISO/IEC 27001:2022 Information security, cybersecurity and privacy protection — Information security management systems — Requirements
It is published by the International Organization for Standardization in partnership with the International Electrotechnical Commission.
ISO 27001 Timeline
1995
The first version of BS 7799-2 was released
1998
The first version of BS 7799-1 was released
2000
The International Organization for Standardization (ISO) adopted BS7799-1 as the basis for creating its ISO/IEC 17799 standard
2005
ISO/IEC 17799 becomes ISO 27001:2005 Information technology — Security techniques — Information security management systems — Requirements
2007
BS7799-1 becomes ISO 27002
2013
ISO 27001:2005 becomes ISO 27001:2013 Information technology — Security techniques — Information security management systems — Requirements
2017
ISO 27001:2013 is reissued as ISO 27001:2017
2022
The latest version of the standard is released ISO 27001:2022 Information security, cybersecurity and privacy protection — Information security management systems — Requirements
2024
The standard is amended to include climate change with ISO/IEC 27001:2022/Amd 1:2024 Information security, cybersecurity and privacy protection — Information security management systems — Requirements Amendment 1: Climate action changes
ISO 27001:2022 – the latest version of the standard
The ISO/IEC 27001:2022 standard provides companies of any size and from all sectors of activity with guidance for establishing, implementing, maintaining and continually improving an information security management system.
Conformity with ISO/IEC 27001 means that an organization or business has put in place a system to manage risks related to the security of data owned or handled by the company, and that this system respects all the best practices and principles enshrined in this International Standard. – ISO/IEC 27001:2022
History of ISO 27001
In the early 1990s, the Commercial Computer Security Centre (CCSC) was tasked with creating a set of criteria for evaluating the security of IT products and creating a code of best practice for information security. This code of best practice became DISC PD003.
By the mid 1990s DISC PD003 evolved and was split into two emerging standards: BS7799-1 and BS7799-2.
In the late 1990’s BS7799-1 was revised into 10 sections outlining information security controls and control objectives. This document would go on to become the ISO 27002 standard.
BS7799-2, meanwhile, created a standard for developing an Information Security Management System (ISMS) and was first released in 1998. This would later go on to become the ISO 27001 standard.
Fast forward 2 years to December 2000 and the International Organization for Standardization took BS7799-1 as the starting point for revising the ISO/IEC 17799 standard. In October 2005, BS7799-2 was formally adopted as ISO 27001:2005.
The standard would then undergo 2 minor reviews that did not introduced any material changes being ISO 27001:2013 and ISO 27001:2017.
To bring us up to date, in October 2022 both ISO 27001 and ISO 27002 received a significant update and overhaul and were released as ISO 27001:2022 and ISO 27002:2022 respectively.
Information Security Management System (ISMS) Origins
The move of business to the digital age in the 1990’s led to information security becoming more important. It is true that most organisations at the time had tactical security controls in place, however these controls were often adhoc in nature. Add into that the moves from centralisation to de-centralisation and growth through acquisition and it is clear to see that the approach to information security was inconsistent at best and chaotic at worst.
Against this backdrop the concept of a management system for information security emerged to help organisation with a standard, holistic approach to information security across the organisation. Basing the management system on risk allows for flexibility in implementation based on business need whilst maintaining a consistent approach based on international best practices.
