Information Security Management System is a management system aimed at protecting information assets and providing confidence to interested parties, especially customers. This standard adopts a process approach to establish, implement, operate, monitor, review, maintain and improve the Information Security Management System. It can be applied to all organizations, large and small, regardless of where they are in the world.

ISO/IEC 27001 is the only international auditable standard that defines the requirements for an Information Security Management System. It is designed to ensure that adequate and proportionate security controls are selected. This standard is particularly necessary in areas where the protection of information is of great importance, such as the finance, healthcare, government and IT sectors. It is a management standard that can provide assurance to customers that their information is protected.

For ISO 27001 certificate, institutions and organizations must first establish and implement systems according to the ISO 27001 Information Security Management System standard. ISO 27001 Information Security Management System requires institutions to prepare risk management and risk processing plans, duties and responsibilities, business continuity plans, emergency incident management procedures and keep records of these in practice.

Companies that establish a system in accordance with the ISO 27001 Information Security Management System standard must have audits carried out by internationally recognized organizations accredited for the ISO 27001 Information Security Management System and successfully pass these audits.

Institutions and organizations that value information security do not necessarily need to be certified. It is also sufficient to establish an ISO 27001 Information Security Management System according to the ISO 27001 standard. However, it is not possible to talk about the effectiveness of any system and application unless it is checked and audited by a third party.