orbit by reconn.Quick answers on ISO 27001 and information security
What is ISO 27001 certification?
Two things share the name: an audit-based certificate for an organization, and PECB credentials for people.
- By Shenoy
- Updated
Every great mission starts with reconn.
ISO 27001 certification means an independent certification body has audited an organization's information security management system and found it meets ISO/IEC 27001:2022. The standard is certifiable, and certification is optional. PECB separately awards personal credentials, such as Lead Implementer and Lead Auditor, to professionals who pass an exam and meet experience requirements.
People use the phrase for two different things, and mixing them up is the most common mistake on this topic.
Certification of an organization
ISO/IEC 27001:2022 is edition 3, published in October 2022, and it sets requirements for an information security management system (ISMS). ISO's committee page says organizations can be certified to it, and that certification is optional: some organizations follow the standard without seeking a certificate.
The audit is done by an independent certification body, accredited by a national accreditation body. According to ISO's SC 27 journal, certification audits are based on sampling and do not include penetration tests or red-team exercises.
Credentials for people
PECB certifies individuals separately, from a Foundation certificate to Lead Implementer and Lead Auditor. A PECB credential shows what a person knows and has done. It does not certify any organization's ISMS. The full path is in ISO 27001 certification for individuals.
Practitioner note: Before you search for certification companies, decide which one you need: a certificate for your company, which comes from an accredited certification body, or a credential for yourself, which comes from a course and an exam.
How reconn helps
reconn covers both sides. Our ISO 27001 implementation services prepare your ISMS for the audit, and our PECB eLearning courses, such as ISO 27001 Lead Implementer, train the people who will run it. The certificate itself comes from the certification body you choose, and nobody can promise an audit result.