What ISO/IEC 27001 is
ISO/IEC 27001:2022 establishes requirements for an information security management system. Its approach considers risks, people, processes and technology. It is not limited to installing cybersecurity tools or protecting a single application. The full reference identifies the edition and distinguishes it from other standards in the family.
Three relevant dimensions
Preventive information needs confidentiality, integrity and availability. Unauthorised access can expose data; an incorrect change can alter a decision; an interruption can prevent necessary documentation from being consulted. Occupational health data protection adds requirements that should be coordinated with security management and the legal framework.
Reading the certificate’s scope
A certificate should be interpreted together with its holder, validity, issuing body and scope. A provider holding a certificate does not automatically mean every product, location or service is included. The contracting organisation needs to check the relationship between its service and the activities covered, resolving questions with the provider and certification body.
Shared responsibilities
Service security does not remove the responsibilities of those configuring users, uploading documents or sharing reports. Access, job changes, devices and internal procedures remain relevant. The contract and operations should clarify who handles incidents, how they are communicated and which controls belong to each party, avoiding areas without an owner.
Provider assessment example
In a hypothetical example, a company requests a preventive management platform’s certificate and reviews whether its scope includes the contracted service. It then checks access, backup and incident communication conditions against its needs. Verification is not limited to seeing a logo in a presentation or assuming certification means an absence of risk.
Limits of certification
Certification provides an assessment of the system within its scope; it does not guarantee that incidents will never occur or replace every privacy obligation. It should be accompanied by monitoring and informed decisions. This entry explains the standard’s general meaning and does not attribute specific certifications to an entity without reviewing its current documentation.
