I've searched through recent versions of ISO 27000, 27001 and 27002 and couldn't find definition of "information". Where can I find it? Is "information" defined anywhere? Or maybe I should look at some other standards?

  • 1
    I'm not sure why you would need the standard to define it for you. Is there a particular application of the term that you are concerned about? – schroeder Feb 17 '19 at 20:41
  • @schroeder, all ISO 2700x are one big application. To protect something you should know what it is. In my country, Poland, in some cases it is required by law to abide to ISO 27001 so it might be very important to precisely define key terms. – Grzegorz Adam Kowalski Feb 17 '19 at 23:55
  • 1
    Yes, I understand that. But I'm not sure that something so basic needs defining when the entire point of the standard is to make sure that you define it. – schroeder Feb 18 '19 at 0:17
  • @schroeder, I get your point. You could propose an answer to my question: eg. "there is no definition, you have to define it yourself so it works best with law in your country" or something like that. – Grzegorz Adam Kowalski Feb 18 '19 at 0:32

To be clear, the ISO 27000 family of standards is not about securing information. It is about defining the standards for an Information Security Management system (ISMS).

"Information" is not a focus, and defining that word is not required. The point of the family of standards is to get the organisation to define what information is and how it needs to be protected.

Quoting ISO 27000:

0.2 Purpose of this document

The ISMS family of standards includes standards that:

a) define requirements for an ISMS and for those certifying such systems;


The definition of the requirements of an ISMS includes making sure that you are clear about what "information" is and if/how it needs to be protected.

So, I would say that you are expecting something from the family of standards that it is not concerned about.


If you look up the definition of Information on google, you will get something like this "what is conveyed or represented by a particular arrangement or sequence of things" and also like this "facts provided or learned about something or someone."

So, when you take this in the context of ISO 27001 which has been defined for your organisation, then this is how it will be like.

For example, let's say that you have described the application development within your organisation, takes a certain path. Lets say that the process started with A, then went to B, and finally it came to C.

In this process, You have described the flow of the process. Here you are conveying to an outsider that this is how the process of application development within your organisation takes place. This is an example of information.

As described above, it will change when we change the context in which it is looked at. A software testing process might provide an entirely different information than the one the application development process did. The recruitment of persons into a department will generate information totally unique.

Hence, you see that as the context changes, the information that you obtain also changes.

And the objective of the ISO 27001 is to build a framework in your organisation in order to secure the Information that is generated.

The information that you have generated in all of your processes is unique to your organisation. If another person, or organisation caught hold of it, then they would easily re-create the model (using your information) in their organisation and obviously obtain the profits (of which you would have been owner of).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.