## ISO 27001 & 27002

The International Standard.

### ISMS (Information Security Management System)
ISO 27001 focuses on the **Management System**, not just the tech.
*   "Do you have a process to identify risks?"
*   "Do you have management support?"
*   "Do you continuously improve?"

### Annex A (Controls)
List of 114 specific controls (Access Control, Cryptography, Physical Security).
*   You don't have to implement all 114, but you must explain why if you exclude one (Statement of Applicability - SOA).

### Usage
*   Common in Europe and Asia.
*   Rigorous certification process.