What is ISO/IEC 27001:2013?

ISO/IEC 27001:2013 is an international standard that specifies the requirements for establishing, implementing, maintaining and continually improving an information security management system (ISMS). An ISMS is a systematic approach to managing sensitive company information so that it remains secure. It includes people, processes and IT systems by applying a risk management process. It is commonly used by organizations of any size, in any industry, to manage information security risks, protect assets, and ensure compliance with legal and regulatory requirements.