ISO/IEC 27001:2022

What it is

ISO/IEC 27001:2022 — the international standard specifying requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS). Certification is by accredited third-party auditors.

Why it matters

European and APAC enterprise buyers often prefer ISO 27001 to SOC 2; many regulated industries (finance, healthcare) require it. Achieving it once and maintaining surveillance audits is cheaper than answering bespoke questionnaires forever.

Who it applies to

Organizations selling to European or international enterprise buyers, or operating in regulated industries.

How WQI scores it

Web Quality Index considers this standard satisfied when all of the 3 supporting factors pass.

Related standards

See also

SOC 2 , NIST CSF , PCI DSS

Standards that share factors with this one

Auto-computed from overlapping factor tickets in satisfiedBy, excluding standards already listed under "See also" above. Strong overlap suggests these standards rise and fall together when sites are scored.

• OWASP Top 10 (2025) 3 shared factors Security Industry consensus on the ten most critical web application security risks. The 2025 edition is current; 2021 is superseded but still widely referenced.
• Content Security Policy Level 3 1 shared factor Security The deployable CSP today. script-src, object-src, and base-uri are the three controls that actually stop XSS — the rest is optional.
• Cross-Origin isolation (COOP / COEP / CORP) 1 shared factor Security Three response headers that together unlock SharedArrayBuffer and high-resolution timers — and incidentally close a class of cross-origin side-channel leaks.
• HTTP Strict Transport Security 1 shared factor Security One header tells every future visitor 'always HTTPS, never HTTP, no exceptions'. Should ship everywhere; preload only after you're sure.
• Modern HTTP security headers 1 shared factor Security HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy. The six headers every modern site should ship.

Other references

• spec ISO/IEC 27002:2022 — Code of practice for controls