What is ISO27001 Security (iso27001security.com)?

iso27001security.com is a free, non-profit information site for information risk and security professionals who need to understand or implement ISO/IEC 27001 and the wider ISO27k family of standards. It is not a certification body, consultancy, or vendor — it is an independent guidance and community resource. It is worth bookmarking if you want plain-language explanations of the standards, downloadable implementation tools, and a peer forum, rather than marketing material.

What the site offers

The site describes itself as offering "extensive, pragmatic guidance" on the ISO/IEC 27000-series standards, with up-to-date information on all 100 "ISO27k" standards. Its main entry points are:

The site states that all of this is available for free. It also accepts donations toward its running costs.

Who runs it and how it is funded

The site describes itself as a not-for-profit initiative that "has run on a shoestring for decades," supported by donors and advertisers. That matters for how you read it: the content is independent and community-oriented rather than tied to a certification scheme owner or a software vendor. It also means the site is not a substitute for the official standards text, which is copyrighted by ISO/IEC and must be obtained through the official channels.

What the blog covers

The blog is where the site posts standards news and the author's own commentary. Three examples visible on the page:

• ISO/IEC 27033 network security revision — A Preliminary Work Item within ISO/IEC JTC 1/SC 27/WG4 has produced a detailed revision plan for the multi-part network security standard. The author notes the plan is impressive given the complexity involved, and that the plan itself cannot be shared because the copyright belongs to ISO/IEC.
• A possible SME controls standard — The author is working on a proposed new ISO27k information security standard aimed at small to mid-sized enterprises of up to about 250 people, on the argument that ISO/IEC 27001 makes business sense for larger organisations but leaves smaller ones less well served.
• ISO/IEC 27007 audit standard — The fourth edition is described as on-track for publication by mid-2027, with a revised title covering information security, cybersecurity and privacy protection, and guidelines for information security management systems auditing.

These posts are useful for tracking where the standards are heading, but note that they are one practitioner's reading of draft or in-progress work, not official ISO announcements.

When this site is useful to you

• You are starting an ISO/IEC 27001 implementation and want orientation before buying the standards.
• You need a free toolkit to structure the work rather than building templates from scratch.
• You want peer answers to practical questions — the forum's 5,000-plus members are the main draw for that.
• You want to follow changes to the ISO27k standards without monitoring ISO committees directly.

When it is not the right source

• You need the authoritative text of a standard — that comes from ISO/IEC, not from this site.
• You need a certification audit or formal legal or compliance advice.
• You need vendor-specific product guidance; the site is standards-focused.

Practical next step

Start with the FAQ if you are new to the standards, download the ISO27k Toolkit if you are mid-implementation, and join the forum if you have a specific problem to solve. Treat the blog as a news feed on standards development rather than as a definitive reference.