ISO 27001 (formally known as ISO/IEC 27001:2005) is a specification for an information security management system (ISMS). An ISMS is a framework of policies and procedures that includes all legal, physical and technical controls involved in an organisation's information risk management processes. ISO 27001 uses a topdown, risk-based approach and is technology-neutral. The specification defines a six-part planning process: 1  Define a security policy.  Define the scope of the ISMS.