ISO/IEC 27001 Information Security Management Systems
ISO/IEC 27001 defines requirements for an information security management system: risk assessment, Annex A controls, internal audit, and management review. Certification comes through an accredited body via a two-stage audit, with annual surveillance on a three-year cycle. The 2022 revision replaced the 2013 edition, with transition required by October 2025.
Updated 2026-11-01 · 173 tracked updates
ISO 27001 is the international standard for information security management systems (ISMS). It provides a systematic approach to managing sensitive information through risk assessment, security controls, and continuous improvement.
Who Needs to Comply?
Any organization of any size, in any sector, that wants to establish, implement, maintain, and continually improve an information security management system. Widely adopted across technology, finance, healthcare, and government.
Key Dates & Timeline
Latest version ISO/IEC 27001:2022 published October 2022. Transition from 2013 version required by October 2025. Annex A controls aligned with ISO 27002:2022.
Upcoming Milestones
Article 5 prohibitions on realistic intimate synthetic content and CSAM-related AI practices apply
Digital Omnibus on AI amends the EU AI ActProviders of AI systems generating synthetic audio, image, video or text must comply with Article 50(2) marking steps if placed on market before 2 Aug 2026
Digital Omnibus on AI amends the EU AI ActPlanned Swiss AI bill target year-end 2026
Swiss FDPIC guidance on AI and data protection, plus legislative roadmapBAIT continues for some firms during transition period before DORA replacement
BaFin DORA implementation guidance and filing proceduresRemaining FinmadiG transition ends for certain German institutions
BaFin DORA implementation guidance and filing proceduresLatest ISO 27001 Updates
Guidance by Topic
The PDPC guidance-by-topic page is a directory that groups Singapore privacy resources by topic and resource type.
FCA review of the long-term impact of AI on retail financial services
The FCA is reviewing how AI may reshape retail financial services by 2030 and beyond and is seeking views on future technology, market, consumer, and regulatory implications rather than proposing new rules now.
FDA draft guidance on lifecycle management and marketing submissions for AI-enabled devices
The FDA’s draft guidance recommends documentation and lifecycle-management practices for marketing submissions covering AI-enabled device software functions.
ISO/IEC 27090 explained guide on AI security threats
ISO's guide explains that ISO/IEC 27090 provides security guidance for AI systems, focusing on AI-specific threats, detection, and mitigation across the AI life cycle.
AEPD innovation and technology resources page updated with AI/privacy materials
The AEPD’s innovation-and-technology portal lists updated resources on AI, risk management, privacy by design, and age assurance, signaling where the agency is directing compliance attention.
Basic Online Safety Expectations and reporting guidance
The Basic Online Safety Expectations outline the Australian Government’s expectations that certain online service providers take reasonable steps to keep Australians safe, and eSafety can require reporting on how they are meeting them.
Colorado became the first state to pass cross-sectoral private-sector rules for certain high-risk AI systems
Colorado is identified as the first state to pass cross-sectoral private-sector rules for certain high-risk AI systems, establishing a state-level baseline for AI governance.
U.S. state AI governance legislation tracker resource
The IAPP tracker is a reference resource on U.S. state AI governance legislation for private-sector organizations, not itself a new law or rule.
FTC reopens and sets aside Rytr AI testimonial order
The FTC reopened and set aside its 2024 final order against Rytr after concluding the complaint did not satisfy the FTC Act and the order unduly burdened AI innovation.
FTC final orders against Cox Media Group and two marketing firms over deceptive AI-powered advertising claims
The FTC finalized orders requiring Cox Media Group and two other firms to pay redress and stop misrepresenting their advertising services, voice-data use, consent, and geographic targeting capabilities.
Jurisdiction Coverage
Related Frameworks
Key Topics
Frequently Asked Questions
What is ISO 27001 and how do you get certified?
ISO/IEC 27001 defines requirements for an information security management system: risk assessment, Annex A controls, internal audit, and management review. Certification comes through an accredited body via a two-stage audit, with annual surveillance on a three-year cycle. The 2022 revision replaced the 2013 edition, with transition required by October 2025.
What is ISO 27001?
ISO 27001 is the internationally recognized standard for information security management. It defines requirements for establishing, implementing, maintaining, and improving an ISMS, covering risk assessment, security controls, and continuous improvement processes.
How does ISO 27001 relate to AI compliance?
ISO 27001 provides the foundational information security framework that AI systems should operate within. It addresses data protection, access controls, and risk management — all critical for AI governance. Many organizations pursue ISO 27001 alongside ISO 42001 for comprehensive AI + security coverage.
What is the difference between ISO 27001 and ISO 42001?
ISO 27001 focuses on information security management broadly, while ISO 42001 specifically addresses AI management systems. ISO 42001 builds on ISO 27001's risk-based approach but adds AI-specific requirements for responsible AI development, deployment, and use.
Keep exploring
This hub tracks published actions that reference ISO 27001; it is not certification guidance from an accredited body and cannot substitute for a gap assessment.