# ISO 27001

> Source: https://netray.co/glossary/iso-27001
> Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems.
> Section: Glossary

## Short answer

ISO/IEC 27001 is the international standard for an information security management system (ISMS). It requires a risk-based approach to protecting confidentiality, integrity and availability of information, with 93 reference controls in Annex A of the 2022 edition.

## Aliases

- ISO/IEC 27001:2022
- ISMS
- information security management system

## Category

compliance

## Full Definition

ISO/IEC 27001:2022 asks an organization to define the scope of its ISMS, assess information security risks, select controls, document them in a Statement of Applicability and then operate, monitor and improve them. The 2022 revision reorganized Annex A into 93 controls in four themes: organizational, people, physical and technological. Certification is by an accredited body, with annual surveillance audits.

For manufacturers, ISO 27001 is increasingly requested by customers who share design data, BOMs and forecasts. In-scope assets usually include the ERP, PLM, file shares, engineering workstations and, more recently, OT networks and MES. Auditors look for access control, privileged account management, backup and recovery tests, logging, supplier security, change management and incident response.

ERP-specific evidence includes role-based access and segregation of duties, user access reviews, audit trails on master data, patching of the application and database, and encrypted backups. Where AI is added on top of ERP data, the standard's risk approach applies to the new components too: where prompts go, which model sees which data, how access follows ERP roles, and whether data leaves the network. Private or air-gapped deployments reduce the exposure to third-party processors.

ISO 27001 differs from defense-specific regimes such as NIST SP 800-171 or CMMC, which prescribe control sets for CUI. Many companies run both. Netray does not hold ISO 27001 certification and does not claim to; we design deployments so the customer's own ISMS scope and controls can cover them.

## Why It Matters

- Large OEMs and enterprise customers add ISO 27001 to supplier questionnaires and contracts.
- A formal risk process prevents ad hoc decisions about where ERP data can be sent, including to AI services.
- Evidence of access reviews and backups shortens security audits and customer assessments.
- Ransomware on shop-floor systems stops production, so availability controls have direct revenue impact.

## In Practice

A machined-parts supplier wants to add a chat interface over ERP data. Its ISMS risk assessment records that prompts may include customer part numbers, so the team decides the model must run on its own servers, inherits ERP roles and logs every query. That decision, and the control mapping, goes into the Statement of Applicability review.

## Faq

### How many controls are in ISO 27001:2022?

**Answer:** Annex A of the 2022 edition lists 93 controls grouped into organizational, people, physical and technological themes.

### Is ISO 27001 the same as CMMC?

**Answer:** No. CMMC is a US Department of Defense program built on NIST SP 800-171 for protecting CUI. ISO 27001 is a general, risk-based international standard.

### Does ISO 27001 cover AI systems?

**Answer:** The risk approach covers any information system in scope. AI tools that touch ERP data should be included in asset, risk and supplier assessments.

## Search terms

ISO 27001, ISO 27001 2022 controls, ISMS manufacturing, ISO 27001 vs NIST 800-171, ISO 27001 certification, Statement of Applicability, ISO 27001 ERP, ISO 27001 AI risk

---
Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json