What Is ISO 27001?
Also known as: ISO/IEC 27001:2022, ISMS, information security management system
Definition
ISO/IEC 27001 is the international standard for an information security management system (ISMS). It requires a risk-based approach to protecting confidentiality, integrity and availability of information, with 93 reference controls in Annex A of the 2022 edition.
ISO 27001 Explained
ISO/IEC 27001:2022 asks an organization to define the scope of its ISMS, assess information security risks, select controls, document them in a Statement of Applicability and then operate, monitor and improve them. The 2022 revision reorganized Annex A into 93 controls in four themes: organizational, people, physical and technological. Certification is by an accredited body, with annual surveillance audits.
For manufacturers, ISO 27001 is increasingly requested by customers who share design data, BOMs and forecasts. In-scope assets usually include the ERP, PLM, file shares, engineering workstations and, more recently, OT networks and MES. Auditors look for access control, privileged account management, backup and recovery tests, logging, supplier security, change management and incident response.
ERP-specific evidence includes role-based access and segregation of duties, user access reviews, audit trails on master data, patching of the application and database, and encrypted backups. Where AI is added on top of ERP data, the standard's risk approach applies to the new components too: where prompts go, which model sees which data, how access follows ERP roles, and whether data leaves the network. Private or air-gapped deployments reduce the exposure to third-party processors.
ISO 27001 differs from defense-specific regimes such as NIST SP 800-171 or CMMC, which prescribe control sets for CUI. Many companies run both. Netray does not hold ISO 27001 certification and does not claim to; we design deployments so the customer's own ISMS scope and controls can cover them.
Why It Matters
- Large OEMs and enterprise customers add ISO 27001 to supplier questionnaires and contracts.
- A formal risk process prevents ad hoc decisions about where ERP data can be sent, including to AI services.
- Evidence of access reviews and backups shortens security audits and customer assessments.
- Ransomware on shop-floor systems stops production, so availability controls have direct revenue impact.
In Practice
A machined-parts supplier wants to add a chat interface over ERP data. Its ISMS risk assessment records that prompts may include customer part numbers, so the team decides the model must run on its own servers, inherits ERP roles and logs every query. That decision, and the control mapping, goes into the Statement of Applicability review.
Frequently Asked Questions
How many controls are in ISO 27001:2022?
Annex A of the 2022 edition lists 93 controls grouped into organizational, people, physical and technological themes.
Is ISO 27001 the same as CMMC?
No. CMMC is a US Department of Defense program built on NIST SP 800-171 for protecting CUI. ISO 27001 is a general, risk-based international standard.
Does ISO 27001 cover AI systems?
The risk approach covers any information system in scope. AI tools that touch ERP data should be included in asset, risk and supplier assessments.
Related Terms
NIST SP 800-171
NIST SP 800-171 is the National Institute of Standards and Technology publication that defines the security requirements for protecting Controlled Unclassified Information in nonfederal systems, and it is the technical baseline behind DFARS 252.204-7012 and CMMC Level 2.
CMMC (Cybersecurity Maturity Model Certification)
CMMC (Cybersecurity Maturity Model Certification) is the US Department of Defense program that verifies defense contractors implement required cybersecurity controls before contract award, using three levels of assessment tied to the sensitivity of the information they handle.
SOX (Sarbanes-Oxley) Compliance
SOX compliance is a US public company's obligation under the Sarbanes-Oxley Act of 2002 to establish, document, test, and certify internal control over financial reporting, including the IT general controls and segregation of duties in the systems that produce financial data.
Air-Gapped AI
Air-gapped AI is the deployment of AI models on a network that has no physical or logical connection to the internet or to any less-trusted network, so all model files, dependencies, and data must be transferred through a controlled process.
AI Guardrails
AI guardrails are the technical and policy controls placed around an AI system that constrain what it may receive as input, what it may produce as output, and what actions it is permitted to take, independent of what the model itself decides.
Working with ISO 27001 in a live environment? Our engineers do this every day - and our AI agents automate most of it.