Glossary
Definition
ISO 27001 is the international standard for an information security management system, certifying that an organization systematically manages security risks.
ISO/IEC 27001 specifies requirements for establishing, operating, and improving an information security management system (ISMS). Certification is granted by an accredited body after audit and requires surveillance audits to maintain. The standard is risk-based: the organization identifies risks, selects controls from Annex A and elsewhere, and demonstrates that the system works.
ISO 27001 and SOC 2 overlap but differ in form. ISO 27001 certifies a management system against a fixed standard; SOC 2 reports on controls against criteria the vendor selects. Global buyers, particularly in Europe, often expect ISO 27001; US buyers often expect SOC 2. Many vendors hold both.
Meridian holds ISO 27001 certification alongside its SOC 2 Type II report.
Read next
Long-form explainers and frameworks that use this term, dated and signed.
Explainers
MCP explained without jargon: how agents discover and call tools, where tool permissions must be enforced, why the gateway pattern matters, and how OpenTelemetry makes agent runs observable.
Owen Gallagher6 min read
Finance operations
How the Close, Controls, Audit, and Planning Agents remove three business days from the month-end close: orchestration, reconciliations, evidence, controls, and a before-and-after close calendar.
Priya Raman6 min read
Get started
Start with one workflow, one approver, and one number to move. Most design partners were live in five weeks.