Information security is no longer limited to protecting computers and networks. Organizations must manage cybersecurity risks, privacy, business continuity, cloud security, third-party risks, and emerging technologies such as artificial intelligence.
The ISO standards for information security provide internationally recognized frameworks that help organizations manage these risks systematically. While ISO/IEC 27001 is the best-known information security standard, several related ISO and ISO/IEC standards address specific areas of security, privacy, resilience, risk management, and AI governance.
Below are some of the most important standards organizations should know. 
ISO/IEC 27001 – Information Security Management Systems
ISO/IEC 27001 is the leading international standard for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS). It provides a risk-based framework for protecting the confidentiality, integrity, and availability of information.
ISO/IEC 27002 – Information Security Controls
ISO/IEC 27002 provides guidance on information security controls and supports organizations implementing the controls referenced by ISO/IEC 27001. It covers organizational, people, physical, and technological security measures.
ISO/IEC 27005 – Information Security Risk Management
ISO/IEC 27005 provides guidance for identifying, analyzing, evaluating, treating, monitoring, and communicating information security risks. It complements the risk management requirements of ISO/IEC 27001.
ISO/IEC 27017 – Cloud Security
ISO/IEC 27017 provides information security controls and implementation guidance specifically for cloud services. It is relevant to both cloud service providers and organizations using cloud environments.
ISO/IEC 27018 – Protection of Personal Data in Public Clouds
ISO/IEC 27018 provides guidance for protecting personally identifiable information (PII) processed in public cloud environments. It is particularly relevant to organizations concerned with privacy and cloud data protection.
ISO/IEC 27701 – Privacy Information Management
ISO/IEC 27701 extends information security management into privacy management. It helps organizations establish and maintain a Privacy Information Management System (PIMS) for managing personally identifiable information.
ISO/IEC 27035 – Information Security Incident Management
The ISO/IEC 27035 series provides guidance for preparing for, detecting, reporting, assessing, responding to, and learning from information security incidents. It supports the development of a structured incident management capability.
ISO/IEC 27031 – ICT Readiness for Business Continuity
ISO/IEC 27031 provides guidance for improving ICT readiness to support business continuity. It helps organizations prepare technology environments to withstand disruptions and support recovery.
ISO 22301 – Business Continuity Management
ISO 22301 specifies requirements for establishing and maintaining a Business Continuity Management System (BCMS). It helps organizations prepare for disruptive events and maintain or restore critical business activities.
ISO/IEC 27032 – Cybersecurity
ISO/IEC 27032 provides guidance for addressing cybersecurity, including collaboration between relevant stakeholders. It complements broader information security management practices with cybersecurity-focused guidance.
ISO/IEC 27036 – Supplier Relationship Security
The ISO/IEC 27036 series addresses information security in supplier relationships. It helps organizations manage security risks arising from suppliers, service providers, outsourcing arrangements, and other third-party relationships.
ISO/IEC 27034 – Application Security
The ISO/IEC 27034 series provides guidance for integrating security into application management and development processes. It supports a structured approach to application security throughout the application lifecycle.
ISO/IEC 29100 – Privacy Framework
ISO/IEC 29100 provides a high-level privacy framework for protecting personally identifiable information. It establishes common privacy terminology and principles applicable across different technologies and environments.
ISO/IEC 42001 – Artificial Intelligence Management Systems
ISO/IEC 42001 specifies requirements for establishing an Artificial Intelligence Management System (AIMS). It helps organizations govern the responsible development, provision, deployment, and use of AI systems while managing associated risks and opportunities.
ISO/IEC 23894 – Artificial Intelligence Risk Management
ISO/IEC 23894 provides guidance on managing risks associated with artificial intelligence. It can complement ISO/IEC 42001 and broader organizational risk management practices.
ISO 31000 – Risk Management
ISO 31000 provides internationally recognized principles and guidelines for risk management. Although it is not specific to information security, it can support cybersecurity, operational, technology, privacy, and enterprise risk management programs.
How These ISO Information Security Standards Work Together
Organizations do not necessarily need to implement every standard.
For many organizations, ISO/IEC 27001 provides the foundation for information security management, supported by ISO/IEC 27002 for security controls and ISO/IEC 27005 for information security risk management.
Additional standards can then be considered according to specific requirements:
- Privacy: ISO/IEC 27701
- Cloud security: ISO/IEC 27017 and ISO/IEC 27018
- Incident management: ISO/IEC 27035
- Business continuity and ICT resilience: ISO 22301 and ISO/IEC 27031
- Third-party security: ISO/IEC 27036
- Application security: ISO/IEC 27034
- AI governance: ISO/IEC 42001 and ISO/IEC 23894
The appropriate combination depends on an organization’s industry, regulatory obligations, technology environment, risk profile, and business objectives.
Strengthen Your Information Security Framework
Understanding which ISO standards apply to your organization is an important first step toward developing a structured and effective information security and cybersecurity program.
Organizations can use these standards to strengthen governance, manage information security risks, improve operational resilience, demonstrate good security practices, and support compliance with applicable regulatory and contractual requirements. Whether your organization is starting with ISO/IEC 27001, expanding an existing ISMS, strengthening privacy or business continuity, or introducing AI governance through ISO/IEC 42001, the right combination of standards can provide a strong foundation for managing information and technology risks.
