It covers risk assessment, the statement of applicability, access management, incident management and a continual improvement cycle. Certification is an indicator of assurance but does not replace the separate evaluation of IT controls in an audit.
Source: ISO/IEC 27001:2022
Related terms
IT general controlsControls over access management, change management, IT operations and system development that ensure information systems operate reliably.Information systems auditAn audit that evaluates the reliability of an entity's information systems, data integrity, access security and business continuity.Personal Data Protection Law (KVKK)Law No. 6698, which governs the protection of fundamental rights and freedoms in the processing of personal data and the obligations of data controllers.Application controlsAutomated or IT-dependent manual controls embedded in a software application that ensure transactions are processed completely, accurately and with authorisation.Compliance auditAn examination of whether an organisation's activities are carried out in accordance with the relevant laws, regulations, contracts or internal rules.Compliance officerThe authorised person responsible for running the compliance programme for the prevention of money laundering and terrorist financing at an obliged entity.
Last updated: October 31, 2026 · This definition is for general information only.