What Is ISO 27001?

ISO 27001 requires the establishment of an ISO 27001 ISMS framework to encapsulate policies and procedures that protect an organization’s sensitive data, including intellectual property. This framework is based on the processes, people, technology, and procedures needed for information security controls, to secure systems and devices, and protect sensitive information from unauthorized access that can lead to data misuse, exposure, disruption, modification, or destruction. In addition, the ISMS policies and procedures help reduce the data risk from cyberattacks and insider threats through risk assessment. An ISMS also helps in meeting compliance with data protection and privacy regulations, such as the General Data Protection Regulation (GDPR), by helping enforce integrity, confidentiality, and data availability. An organization’s ISMS requires documents such as a Statement of Applicability (SOA) and Risk Treatment Plan (RTP) to complete the certification process.

To meet the ISO 27001 requirements, an organization needs to engage in activities such as management reviews, performance evaluations, and a risk-based review of the context of the organization. Once this is complete, they must take corrective actions to implement controls and a risk management process, including defining an ISMS scope and asset management process.

Akamai security solutions protect against vulnerabilities, malware threats (including ransomware), data breaches, and DDoS attacks. Akamai protects your customer experience, workforce, systems, and personal data and sensitive data by embedding security into everything, everywhere. The Akamai global platform ensures that an organization can detect and prevent existing and emerging threats and adapt to the changing security landscape. This is essential in maintaining ISO 27001 compliance and demonstrating continual improvement in security. The Zero Trust element of Akamai’s platform helps to create an ISO 27001 compliant environment providing deep visibility into assets, access controls, and network flows, with granular enforcement of security policy.

ISO 27001 comprises controls covering organizational, people, physical, and technological areas. All sectors are at risk of human-centered cyberthreats that exploit access to critical systems and services.

A fundamental approach within the ISO 27001 standard control objectives is that of Zero Trust security. Controls include:

• Access control, to establish physical and logical access controls to information and other associated assets
• Privileged access rights, to ensure “least privilege” access
• Segregation of networks, as part of a Zero Trust security approach

These controls help an organization establish a Zero Trust environment.

Here are three examples of sectors that benefit from implementing Zero Trust under ISO 27001:

ISO 27001 for critical infrastructures 

Attacks on critical infrastructures have devastating effects. A relevant example is a security incident at the U.S. oil supplier Colonial Pipeline . The entire Southwest of the United States was affected; all it took to circumvent operations security and infect the company with ransomware was a single compromised password. Critical infrastructures cover many vital services, including utilities, chemical manufacturers, and transport. The critical nature of these services makes them an attractive target for hackers. Unauthorized access and credential exposure that includes the wider supply chain is a central area of focus. The increased connectivity to the broader internet and an expanded attack surface of modern connected industrial units have allowed malicious actors to open once firmly closed doors into critical systems. Implementing ISO 27001 and associated information security policies and procedures mitigates the risk of cyberattacks on critical infrastructures.

ISO 27001 for healthcare 

The wider healthcare sector is an ideal target for cybercriminals. The sector is data rich, a critical infrastructure, and highly dependent on technology and supplier relationships. As a result, healthcare institutions are at risk from many forms of cyberattack, including data breaches and ransomware. In 2024, the FBI issued an advisory for critical infrastructure entities, namely within the healthcare industry, regarding ongoing ransomware threats. The FBI’s Internet Crime Complaint Center reported more reports of ransomware attacks targeting healthcare in 2022 than any other critical infrastructure sector. As a complex service, healthcare can benefit from the rigor required to implement an ISMS as part of ISO 27001 certification. A Zero Trust approach to information security risks will ensure that healthcare organizations can control access to sensitive data and maintain control over critical systems and services.

ISO 27001 for financial services 

A 2023 International Monetary Fund (IMF) survey across 51 countries found that cyberthreats against financial instructions are “proliferating,” indicating a proper response by the sector is urgently needed. The financial industry suffers a variety of cyberattacks, including ransomware, data breaches, and DDoS attacks. The 2022 Verizon Data Breach Investigation Report broke the type of attacks against the financial sector into “Ransomware, Use of Stolen Creds, and Phishing,” covering 80% of breaches. With stolen credentials playing an integral role in most attacks in the sector, ISO/IEC 27001 provides critical mechanisms for the financial sector to enforce a Zero Trust approach to unauthorized access.