What is ISO certified vs. ISO compliant?

What is ISO certified vs. ISO compliant? What kind of report is issued to attest a company is ISO 27002 certified vs. a report that attests the company is ISO 27002 compliant?

    Requires Free Membership to View

    SearchSecurity.com members gain immediate and unlimited access to breaking industry news, virus alerts, new hacker threats, highly focused security newsletters, and more -- all at no cost. Join me on SearchSecurity.com today!

    Michael S. Mimoso, Editorial Director

    By submitting your registration information to SearchSecurity.com you agree to receive email communications from TechTarget and TechTarget partners. We encourage you to read our Privacy Policy which contains important disclosures about how we collect and use your registration and other information. If you reside outside of the United States, by submitting this registration information you consent to having your personal data transferred to and processed in the United States. Your use of SearchSecurity.com is governed by our Terms of Use. You may contact us at webmaster@TechTarget.com.

First and foremost, ISO 27002 began its life as code of practice published by the U.K. government, which then evolved into a BSI standard (BS7799), then into an ISO standard (ISO 17799). ISO/IEC 27001 is the requirement standard to which organizations certify towards, while ISO/IEC 17799, which was renamed to ISO/IEC 27002, is actually "just" the code of practice.

A company that is ISO 27001 "certified" is given a report by a registrar that has gone through the required registration process by an approved body. This is a lengthy, time-consuming process, limited to select companies. As for being ISO 27001 "compliant," that could mean any number of things, such as a CPA firm issuing an Agreed Upon Procedures (AUP) report saying your company is ISO compliant, or an ISO lead auditor coming into your organization to help you become ISO "compliant" with all the relevant ISO requirements.

Lastly, ISO certification from an approved registrar can also mean you are ISO compliant. Certified vs. compliant can mean the same thing, but they can also mean two entirely different things.  It depends on your needs, your customer requirements and other ancillary issues.  With that said, there is much confusion on what ISO certification and ISO compliance really mean. For an ounce of clarity, just remember that true ISO certification can only happen from an approved registrar, while ISO compliance can be interpreted by any number of measures.

This was first published in November 2011

Join the conversationComment

Share
Comments

    Results

    Contribute to the conversation

    All fields are required. Comments will appear at the bottom of the article.