Published ISO/IEC 27001Information SecurityISMS
In short: ISO/IEC 27001 is the international standard for an Information Security Management System (ISMS). A certified provider assesses risk and protects information systematically, and has been audited by an independent body. Before choosing a provider, check that the certificate is genuine and that its scope covers the services you will use.
What is ISO/IEC 27001?
ISO/IEC 27001 is published jointly by ISO and IEC. It defines how to build a system that protects the confidentiality, integrity and availability of information. The latest edition, ISO/IEC 27001:2022, groups the controls in Annex A into four themes: organizational, people, physical and technological.
The core of the standard is not buying equipment. It is a management system that tells an organization what its risks are, how they are controlled and how to keep improving.
What the certificate tells customers
- Risk is assessed systematically, not by guesswork
- Access to information and systems is controlled according to role
- There are procedures for handling incidents and reviewing them afterwards
- External suppliers that handle information are managed
- An independent certification body has audited the organization and continues to audit it periodically
A certificate does not mean there is no risk. It means risk is managed by a system that can be verified.
Three checks before you rely on a certificate
- Look up the certificate number in the certification body’s own database
- Read the scope to confirm it covers the service you will use; some certificates cover only part of an organization
- Check the expiry date and that the certificate is for the current edition of the standard
GIST’s certification
Global Innovative Solutions Co., Ltd. is certified to ISO/IEC 27001:2022 (Certificate No: IS 828237), verifiable in the BSI directory. The scope covers System Integration, Cloud Service - IaaS, IT Hardware Resellers and Co-location.
Frequently asked questions on this topic
How can I verify that an ISO/IEC 27001 certificate is genuine?
Note the certificate number and the certification body, then search that body's own database. For example, GIST's certificate IS 828237 was issued by BSI and can be verified in the BSI directory.
How is ISO/IEC 27001 different from Thailand's PDPA?
The PDPA is a personal data protection law that must be followed. ISO/IEC 27001 is an international standard that organizations adopt to manage the security of all types of information. An ISO/IEC 27001 system supports the security measures the PDPA requires, but it does not replace legal compliance.
How long is a certificate valid?
Certificates typically run on a three-year cycle, during which the certification body carries out periodic surveillance audits to confirm the organization continues to meet the standard.