ISO 27001 is a specification for an information security management system (ISMS). An ISMS is a framework of policies and procedures that includes all legal, physical, and technical controls involved in an organization’s information risk management processes. Information may be printed or written on paper, stored electronically, transmitted by post or email, shown on films, or spoken in conversation.