ISO 27100: understand the standard and its impact on information security

In an increasingly digital world, information security has become a priority for organisations, whatever their size or business sector. The ISO 27100 standard is part of this global effort to protect data and ensure the security of information systems. But what does this document really cover, and what is it for in your company? This article offers you a complete guide to understanding ISO 27100, its content, its concepts and how to make use of it in your organisation.

What is the ISO 27100 standard?

Definition and context of ISO 27100

ISO/IEC TS 27100 is a technical specification published by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). Entitled “Cybersecurity: overview and concepts”, published in December 2020 and confirmed in 2024, it describes cybersecurity and its concepts, including how it relates to information security and how it differs from it, and establishes its context. It is neither a risk management framework (that is the role of ISO/IEC 27005) nor a compliance or certification standard: it is used as a reference for vocabulary and concepts.

• Main objective: to provide a common foundation of notions (cybersecurity, cyber risks, threats) so that organisations speak the same language and link their cyber approach with their ISMS.
• Applicable to: all organisations, whatever their type or size: companies, public bodies, non-profit organisations.

What the document covers

The abstract published by ISO sets out its scope:

• Cybersecurity and its concepts: what it covers, how it relates to information security and how it differs from it.
• The context of cybersecurity: the setting in which these notions apply.
• Deliberate limits: the document does not cover every term in the field and leaves other standards free to define new ones.

Requirements, security controls and compliance belong to other documents: ISO/IEC 27001, ISO/IEC 27002 and the regulatory texts.

What is ISO 27100 for in your organisation?

What is at stake in cybersecurity and information management

Cyberattacks and security incidents are constantly increasing, with potentially disastrous impacts for companies. Data loss, damage to reputation and high financial costs are among the risks you could face. In the face of these risks, ISO/IEC TS 27100 does not provide protection measures. It gives the teams who choose them shared definitions.

What a shared vocabulary brings

Relying on ISO/IEC TS 27100 mainly brings consistency:

• The same words for everyone: the CISO, senior management, business teams and suppliers give the same meaning to cybersecurity, cyber risk or threat.
• A clearer scope: telling cybersecurity apart from information security helps to allocate roles and to frame the ISMS.
• A basis for the requirements standards: the concepts set out here make ISO/IEC 27001 (ISMS requirements) and ISO/IEC 27005 (risk management) easier to read.

The key principles of ISO 27100

Principles of information risk management

ISO/IEC TS 27100 describes the notions of cyber risk on which risk management is based, the method for which is set out in detail in ISO/IEC 27005:

• Risk identification: analysis of the threats, vulnerabilities and potential impacts on the organisation’s information.
• Risk assessment and treatment: prioritisation of risks according to their criticality and implementation of measures to mitigate or eliminate them.
• Monitoring and review: continuous monitoring of security measures to make sure they remain effective against new threats.

Implementing an information security management system (ISMS)

The specification does not create any requirements of its own: to organise cybersecurity, it refers to the information security management system (ISMS) defined by ISO/IEC 27001, which is a set of policies, processes and controls designed to manage information security systematically.

• Process documentation: create clear, documented procedures for all security actions.
• Security measures: deploy technical, physical and organisational controls to protect information.
• Continuous improvement: update the ISMS regularly according to audit results and technological developments.

The steps to structure your cybersecurity approach

Step 1: Analysis of needs and risks

The first step is to carry out an in-depth analysis of the company’s needs and of the risks it faces. This includes:

• Assessment of information assets: identify critical information and assess how sensitive it is.
• Risk mapping: determine the threats and vulnerabilities specific to your organisation.

Step 2: Development and documentation of processes

It is essential to develop well-defined processes and to document them in order to ensure consistent management of information security.

• Drafting of security policies: put in place policies suited to the risks identified.
• Incident management process: define how the organisation responds to security incidents.

Step 3: Training and awareness

The training and awareness of employees are key elements of any cybersecurity approach. A well-informed workforce is your first line of defence.

• Training programmes: put regular training sessions in place for all employees on good security practices.
• Ongoing awareness: keep everyone informed about the threats and about updates relating to security.

Step 4: Monitoring, audit and continuous improvement

To guarantee the effectiveness of the ISMS, it is crucial to carry out regular monitoring, internal audits and continuous improvements.

• Internal audits: carry out regular checks to assess the effectiveness of the measures in place.
• Improvement plan: adjust policies and procedures according to the audit results.

Common challenges of a structured cybersecurity approach

Frequent difficulties encountered by companies

Putting a structured cybersecurity approach in place (an ISMS under ISO/IEC 27001, risk management under ISO/IEC 27005) can be complex and run into obstacles:

• Resistance to change: employees may resist the adoption of new security practices.
• Complexity of implementation: ISO/IEC 27001 can seem difficult to understand and apply without the appropriate expertise.
• Initial costs: the resources needed to set up a compliant ISMS can be high.

Solutions to overcome these challenges

To overcome these challenges, it is essential to:

• Involve senior management: obtain strong support from senior management to facilitate change.
• Form a dedicated working group: have a specialised team to steer the implementation.
• Use suitable tools: invest in software solutions that automate and simplify the management of security processes.

ISO/IEC TS 27100 cannot be certified and sets no requirements: it provides the definitions and concepts on which a cybersecurity approach, its ISMS and its risk management rely. By starting from this shared vocabulary and following the steps described above, your company aligns its approach with international standards and strengthens its resilience against cyber threats. To go further, consider commissioning a security audit or using specialised solutions to support you in your compliance approach.

FAQ