ISO/IEC 27001 vs. ICT Minimum Standard
ISO/IEC 27001 and the ICT Minimum Standard pursue the same goal in different ways. ISO/IEC 27001 requires a management system and can be certified. The ICT Minimum Standard describes concrete measures and a self-assessment. What this means in practice – and when each one fits.
The difference in one sentence
ISO/IEC 27001 describes how an organisation manages information security; the ICT Minimum Standard mainly describes what it should actually do.
That sounds like a subtle difference, but it has consequences: for ISO you need a working management system with risk assessment, objectives, documentation, internal audits and management review. With the ICT Minimum Standard you can start straight away with assessing the measures.
The comparison at a glance
| Aspect | ISO/IEC 27001:2022 | ICT Minimum Standard 2023 |
|---|---|---|
| Publisher | ISO and IEC, international | Swiss federal government: developed by FONES, maintained by the BACS since March 2024 |
| Type | Standard with requirements for an ISMS | Recommendation with concrete measures |
| Structure | Clauses 4–10 (management system), Annex A with controls in 4 themes | 5 functions, 23 categories, 108 measures |
| Basis | its own standard, guidance in ISO/IEC 27002 | NIST Cybersecurity Framework (core) |
| Assessment | conformity per requirement; nonconformities in the audit | implementation level 0–4 per measure, leading to a tier level 1–4 |
| External proof | certificate from an accredited body | self-assessment, optionally reviewed by a third party |
| Target group | organisations of any type and size | mainly critical infrastructure, applicable to all |
| Availability | standard text must be purchased | freely available, with an assessment tool (Excel) |
| Scope in Audhive | 94 controls | 108 controls |
ISO/IEC 27001 in detail
The core of ISO/IEC 27001 is clauses 4 to 10. Among other things they require the organisation to determine its context and scope, top management to take responsibility, information security risks to be assessed and treated, objectives to be set, the necessary resources and competence to be provided, internal audits to be carried out and the ISMS to be reviewed by management.
Annex A provides a list of controls organised in four themes: organisational, people, physical and technological. Which of them apply is decided by the organisation based on its risk assessment and recorded in the Statement of Applicability – with a justification for every excluded control.
For certification, an accredited certification body audits the ISMS in a two-stage initial audit. Surveillance audits follow, and after three years a recertification. The certificate is recognised internationally and may be required in tenders and supplier assessments.
The ICT Minimum Standard in detail
The ICT Minimum Standard has three parts: fundamentals, the actual framework with 108 measures, and guidance on assessment. The measures follow the five functions of the NIST Cybersecurity Framework – Identify, Protect, Detect, Respond, Recover – and are organised into 23 categories such as Asset Management (ID.AM) or Access Control (PR.AC).
Each measure is rated with a value from 0 to 4, from “not implemented” to “dynamic, implemented, continuously reviewed and improved”. The ratings add up to an overall picture that the standard places in four tier levels: partial, risk-informed, repeatable and adaptive. The standard stresses that its example charts are not target values: every organisation sets its own protection level per category. The assessment should take place at least once a year.
For several sectors – such as electricity, gas, water or public transport – there are sector standards built on it. More in The ICT Minimum Standard for SMEs.
What they have in common
Despite their different approaches, both frameworks cover largely the same topics: inventory and responsibilities, access rights and authentication, training, data security and backups, vulnerabilities and updates, logging and monitoring, incident handling, business continuity and recovery planning, suppliers.
In its 2023 version the ICT Minimum Standard lists the matching references in other standards for each category, including ISO/IEC 27001:2022. If you already work with ISO, you can use them to check whether the requirements of the ICT Minimum Standard are covered – and vice versa.
Which one fits you?
A simple guide:
- Customers or tenders require a certificate: ISO/IEC 27001. Plan for a management system and a certification body.
- You want a pragmatic start with no need for certification: ICT Minimum Standard. It is concrete, freely available and rooted in Switzerland.
- You operate critical infrastructure: ICT Minimum Standard and – where one exists – the sector standard for your sector.
- You already work with ISO but are asked about the ICT Minimum Standard: check coverage via the references in the ICT Minimum Standard and close the gaps in a targeted way.
- You want both: start with the ICT Minimum Standard for the measures and build the ISO management system around it step by step.
What matters is less the perfect choice than consistent implementation. A properly assessed ICT Minimum Standard achieves more than a half-finished ISMS. Further criteria by type of organisation are in Which framework fits whom?
Frequently asked questions
Can I use the ICT Minimum Standard as a stepping stone to ISO/IEC 27001?
Yes. Many measures correspond in content to the controls in Annex A. What is then mainly missing for certification is the management system: risk assessment, objectives, Statement of Applicability, internal audits and management review.
Does the ICT Minimum Standard apply to companies outside critical infrastructure?
It is aimed mainly at operators of critical infrastructure, but according to its own text it can in principle be applied by any company or organisation.
What does it cost?
The ICT Minimum Standard is freely available. You buy the text of ISO/IEC 27001 from ISO or the Swiss Association for Standardization (SNV); certification adds the fees of the certification body. In both cases the larger effort is your own work.
How Audhive helps
Audhive contains both catalogues: ISO/IEC 27001:2022 with 94 controls (German and English) and the ICT Minimum Standard 2023 with 108 controls (official texts in German, English, French and Italian). You load one of them in the setup and choose in the control set what applies for each tenant. Assessment uses maturity levels, plus design, effectiveness and risk; the report contains the achievement chart and a Statement of Applicability. For SMEs that only need the ICT Minimum Standard there is the SEC Swiss Edition. Audhive does not change either standard: the ICT Minimum Standard comes in its official wording (obvious errors corrected and marked), ISO/IEC 27001 as a short description per control, each with Audhive’s own working aids. You obtain the text of ISO/IEC 27001 from ISO or the SNV, the ICT Minimum Standard freely from the BACS. Details under Catalogues.
Sources
- ISO: ISO/IEC 27001:2022
- Federal Office for Cybersecurity (BACS): ICT minimum standards (page in German) – document “Minimalstandard zur Verbesserung der IKT-Resilienz”, version May 2023
- NIST: Cybersecurity Framework