orbit by reconn.
Insights around Applied AI, AI Governance, AI Security and everything around it
ISO 27001 guides, courses and answers
How an information security management system works, how to implement it, what regulators in the EU and the Middle East expect, and which PECB course fits your role. Written by PECB Certified Trainer Shenoy and checked against ISO, regulators and other official sources. New articles appear here as they are published.
Every great mission starts with reconn.
Start here
New to the standard? Begin with the main guide, then pick the articles that match your country or your role.
ISO 27001: what it is, how an ISMS works and how certification fits
The clauses, the Annex A controls, the certification audit and the personal credentials, in one guide.
Read the guide
All ISO 27001 articles
Guides on implementation, regional regulations and courses. The newest article is listed first.
ISO 27001 answers
Short, sourced answers to the questions people ask most about certification, costs, exams and prerequisites. For other standards, see all ISO and PECB certification answers.
ISO 27001 certification basics
What certification means, what it requires and how it compares with related standards.
- What is ISO 27001 certification?
- What are the requirements for ISO 27001 certification?
- Is ISO 27001 certification mandatory, and who needs it?
- How long does ISO 27001 certification last?
- Is ISO 27001 certification worth it?
- What is the difference between ISO 27001 and ISO 27002?
- ISO 27001 vs SOC 2: which one do you need?
- What is the CIA triad in ISO 27001?
- What is the version history of ISO 27001?
Cost and getting certified
What it costs and how the path to certification works.
ISO 27001 Lead Implementer
The PECB course and exam for people who build and run an ISMS.
ISO 27001 Lead Auditor
The PECB course and exam for people who audit an ISMS.
- What is ISO 27001 Lead Auditor certification?
- What does the ISO 27001 Lead Auditor course cover?
- How long is the ISO 27001 Lead Auditor exam, and what is the format?
- How much does the ISO 27001 Lead Auditor exam cost?
- What are the prerequisites and experience requirements for ISO 27001 Lead Auditor?
- How long is an ISO 27001 Lead Auditor certification valid, and how do you renew it?
Compare and choose
Which course or credential fits your role.
PECB ISO 27001 courses with reconn
Every self-paced, self-study and eLearning enrollment includes a 1-hour 1-on-1 live online session with a PECB Certified Trainer and unlimited email and WhatsApp support, directly with a trainer, until you pass.
ISO 27001 Lead Implementer and Lead Auditor bundle
Our most requested option. Learn to build an ISMS and to audit one, and earn both PECB credentials in one enrollment.
ISO 27001 Lead Implementer
For people who plan, build and run an ISMS. The best fit for most learners, since most work on implementation teams.
ISO 27001 Lead Auditor
For internal auditors, consultants and anyone who wants to audit an ISMS against ISO 27001.
PECB Certified Chief Information Security Officer
For security managers moving into leadership: governance, risk, program management and reporting to the board.
Security and AI leadership package
PECB CISO, ISO 27001 Lead Implementer and ISO 42001 Lead Implementer together, for leaders who own both security and AI governance. Contact us for the package price.
Certifying your organization? See our ISO 27001 implementation services.
Frequently asked questions
What is ISO 27001?
ISO/IEC 27001 is the international standard that sets the requirements for an information security management system (ISMS). An ISMS is the set of policies, processes and controls an organization uses to manage risks to its information. The current edition is ISO/IEC 27001:2022, and its Annex A lists 93 controls in four themes: organizational, people, physical and technological.
Is ISO 27001 mandatory?
ISO 27001 is a voluntary standard. Laws, regulators, customers and tenders can still make it a requirement, or accept it as evidence of good security practice. Check what your buyers and regulators ask for before you invest.
What is the difference between ISO 27001 certification for a company and for a person?
An organization earns an ISO 27001 certificate when an accredited certification body audits its ISMS. A person earns a PECB credential, such as ISO 27001 Lead Implementer or Lead Auditor, by completing a course, passing the exam and meeting the experience requirements for the credential level. A personal credential shows competence. It does not mean a company is certified.
Should I take ISO 27001 Lead Implementer or Lead Auditor first?
Take Lead Implementer if your work is building and running an ISMS, and Lead Auditor if your work is auditing one. In our experience Lead Implementer fits most people, because most end up on implementation teams. Many learners take both through the Lead Implementer and Lead Auditor bundle.
How long does ISO 27001 certification last?
For an organization, it depends on the certification body. Some issue three-year certificates with an expiry date and others issue certificates that stay valid unless withdrawn. Either way, annual surveillance audits follow, and a re-assessment audit normally comes in the third year. PECB personal certifications are valid for three years and are renewed through continuing professional development hours and maintenance fees.
What does reconn include with its ISO 27001 courses?
Every self-paced, self-study and eLearning enrollment includes a 1-hour 1-on-1 live online session with a PECB Certified Trainer and unlimited email and WhatsApp support, directly with a trainer, until you pass. The PECB application fee and the first-year annual maintenance fee are included too.
Who writes these ISO 27001 articles?
Shenoy, founder of reconn, writes them. He is a PECB Certified Trainer with more than 20 years in cybersecurity. Each article cites ISO, regulators, governments and other official sources.