Standard
ISO 27001 maturity assessment
Information security management systems
- ISO 27001:2022
- 152 questions
- 11 categories
- Maps to: Information security, Risk management, Third-party risk and resilience
What the standard requires
ISO 27001 is the international standard for information security management systems. It requires an organization to establish, implement, maintain, and continually improve a management system that protects the confidentiality, integrity, and availability of information, backed by a risk assessment and a set of controls (Annex A).
How ResiliencyPulse scores it
The ISO 27001 model has 152 questions in 11 categories: the management system clauses and the Annex A control themes (organizational, people, physical, technological). Scores roll up to the information security domain. This is a maturity assessment of the management system, not a certification audit, and it does not replace one.
Who assesses against it
Security and resilience leaders who want to see information security maturity alongside continuity, crisis, and recovery in one picture, and organizations preparing for or maintaining certification who want a maturity view the audit does not give them.
Questions
Do I need to be certified or regulated to use this model?
No. The model measures maturity against the standard’s structure. Certification and examination are separate processes this assessment does not replace.
Can I run this model alongside others?
Yes. Pro includes three models and Scale is unlimited. Results from every model roll up to the same eight resilience domains.