ISO 27001, a partner for CIOs for twenty years
Regulating the cyber world is no mean feat! And above all, it’s not just a matter of regulation! Alongside the European NIS and NIS 2 directives (NIS stands for Network Information Security),
the DMA (Digital Markets Act)
and the DSA (Digital Services Act),
there are also voluntary standards. The word “standards” is also used to refer to laws, decrees and other regulations, but these are voluntary, made by market players. The more Anglophile among us will speak of “standards”.
When it comes to information security, it’s an international standard that sets the pace: ISO 27001. The “001” wording means that the standard addresses the subject as a management system: for information systems departments (ISDs), and more broadly for the teams involved in this issue throughout the company (for example, the quality manager), it provides instructions on how to organize oneself to prevent cyber-attacks, know what to do and how to respond on the day they occur. It therefore includes an important section on risk identification and analysis. All in a spirit of continuous improvement: each failure provides feedback that enables us to be better prepared the next time. Compared with its ISO 9001 and ISO 14001 sisters, ISO 27001 is unique in that it also provides technical recommendations.
The fact that ISO 27001 is a management standard makes it certifiable: as with ISO 9001 for a quality approach or ISO 14001 for an environmental policy, you can ask to be audited to show that you are applying it correctly, and thus signal that you are virtuous. This signal is highly sought-after in calls for tender, sometimes to the point of becoming a prerequisite! On this point, the evidence is clear: the number of certified organizations, both public and private, is steadily increasing worldwide. Even if we’re a long way from the figures for quality or environmental management, by the end of 2023 France had just over a thousand ISO 27001-certified organizations, three times more than in 2019, according to the ISO Survey. It should be noted that one certificate very often covers several sites, on average two to three.
In October 2025, ISO 27001 celebrates its twentieth anniversary! In the video above, listen in as three key figures tell the story: Emmanuel Garnier, President of Club 27001 and CIO of Orano, Marie-Christine Moretti, auditor and trainer, and Matthieu Grall, information security consultant. For twenty years, ISO 27001 has been known by a name that is in fact a diminutive: as it was developed jointly with the International Commission on Electrotechnologies (IEC), its real name is ISO/IEC 27001. It’s even NF EN ISO/IEC 27001, to reflect the fact that the international standard has been adopted as a European and French standard, available here in the AFNOR collection . You may object that in twenty years, cyber risk has evolved enormously: new threats, new players and new tools have emerged. You’d be right: 2005 is prehistory on the scale of information security! Not to mention that, like all voluntary standards, the text has been regularly updated. A 2013 version and then a 2022 version have appeared, ensuring that the recommendations set out remain relevant. In 2024, an amendment concerning climate change was even included.
ISO/IEC 27001:2005
The first version to be published, it sets out the requirements for an ISMS and introduced the concept of risk management.
It is based on the British work on BS 7799.
ISO/IEC 27001:2013
A major revision, this version has made significant changes, including:
the integration of the High Level Structure (HLS) to facilitate integration with other management system standards, an update on security measures, a strengthening of the consideration of context and interested parties.
ISO/IEC 27001:2022
A major revision, this version has introduced significant changes, including:
updated security measures to reflect new threats and technologies
clarified requirements for risk management and ISMS performance assessment.
ISO/IEC 27001:2024/Amd 1
Added requirements for organizations to consider the impacts of climate change on their ISMS.
The best proof that the ISO 27001 standard is perfectly in tune with the times is the fact that it has been invited into the debates on the transposition of the European NIS 2 directive in the French Parliament, in the second half of 2025. During its examination by the French Senate, in particular, the Resilience bill made it a reference element, positioning the standard as a first level of requirement to enable the players concerned to comply with regulatory provisions.
In October 2025, an AFNOR – Club 27001 study compiling over 600 certification audit reports, which can be downloaded free of charge here , shows that more and more business sectors are adopting the ISO 27001 standard. It is no longer confined to information systems and cybersecurity companies: the bancassurance sector accounts for 6.6% of AFNOR Certification 2022 certifications, and the manufacturing industry for 4.7%. Below, you’ll find the top 3 themes that generated the most non-conformities (NC) and sensitive points (PS), excluding appendix A, as well as the top 3 themes that generated the most strong points (PF).
