ISO/IEC 27001 is the international standard that specifies requirements for establishing, implementing, maintaining and continually improving an information security management system (ISMS). It is published jointly by ISO and the IEC and can be used by organizations of any type and size. Organizations can be certified against it by accredited auditors.

How it works

• Context and scope: the organization defines which parts of the business the ISMS covers and what its stakeholders require.
• Risk assessment and treatment: information security risks are identified and assessed, and controls are chosen to treat them.
• Controls: an annex lists reference controls, described in more detail in ISO/IEC 27002. A Statement of Applicability records which ones apply and why.
• Leadership, audit and improvement: management sets policy and objectives, internal audits and management reviews check performance, and nonconformities are corrected.

Why it matters for dark web monitoring

ISO/IEC 27001 is risk based: an organization must understand the threats it faces and monitor whether its controls work. Threat intelligence is one of the reference controls in the current edition. Findings such as leaked credentials, exposed data or impersonating domains are concrete evidence for the risk assessment and for incident management, and they show auditors that external threats are being watched.

Sources: ENISA: Risk Management Standards