What is ISO/IEC 27001

ISO/IEC 27001 is an information security standard, part of the ISO/IEC 27000 family of standards, It is published by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC).

ISO/IEC 27001 specifies a management system that is intended to bring information security under management control and gives specific requirements. Organizations that meet the requirements may be certified by an accredited certification body following successful completion of an audit.

Stages in an audit process

The ISO/IEC 27001 certification usually involves a
three-stage external audit process:

Stage 1

A preliminary, informal review of the ISMS, for example checking the existence and completeness of key documentation such as the organization’s information security policy, Statement of Applicability (SoA) and Risk Treatment Plan (RTP). This stage serves to familiarize the auditors with the organization and vice versa.

Stage 2

This is a more detailed and formal compliance audit, independently testing the ISMS against the requirements specified in ISO/IEC 27001. The auditors will seek evidence to confirm that the management system has been properly designed and implemented, and is in fact in operation.


This part involves follow-up reviews or audits to confirm that the organization remains in compliance with the standard. Certification maintenance requires periodic re-assessment audits to confirm that the ISMS continues to operate as specified and intended. These should happen at least annually.

How does AIAST® fit into my ISO 27001 project?

There are specific points in your ISMS project at which Application Security Testing has a significant contribution to make:

As part of the risk assessment process, uncovering vulnerabilities in any web applications, or internal applications, and linking them to identifiable threats. Using AIAST enables you to conduct External tests, focusing on web applications and other such services and on On-site tests, focusing on the various applications and operating systems that run on your internal devices. Once you completed your scans, you can produce a detailed and documented report that clearly sets out what you have found together with an assessment of its severity, and our recommendations for appropriate remediation, you can link integrate your AIAST solution directly with your SDLC tools with full automation and scale up the process.