Oct 21, 2025
John Flack - IBM i Engineer | GRC & Quantitative Risk Specialist has written the
"i on GRC" which has explored ISO / IEC 27001 clause by clause translating one
of the world’s most influential governance frameworks into the language of IBM i
security, audit, and modernization.
John states "Together, these articles form a complete walk-through of the ISO
27001 management system as applied to IBM i."
ISO 27001 is defined as: The leading international standard that formally specifies the requirements for
establishing, implementing, maintaining, and continually improving an Information
Security Management System (ISMS).
In essence, it provides a systematic, structured, and risk-based approach to
managing and protecting an organization's sensitive information assets to ensure
their:
Confidentiality: Ensuring information is accessible only to those authorized to have access.
Integrity: Safeguarding the accuracy and completeness of information and processing methods.
Availability: Ensuring authorized users have access to information and associated assets when required.
The standard is applicable to organizations of all types and sizes across all sectors, helping them manage security risks, reduce vulnerabilities to threats like cyberattacks, and meet contractual and regulatory obligations.
In order, the clauses are: (Right click to open each clause in a new tab).
John goes on to say:
"Each installment follows the same principle: governance only matters when it
lives in the system.
I hope you'll see in this series that a 'legacy platform' running decades-deep
I hope you'll see in this series that a 'legacy platform' running decades-deep
workloads in some cases can meet modern standards of governance, risk, and
compliance when we learn to speak both its technical and organizational dialects.
Together, these articles form a complete walkthrough of the ISO 27001 management system as applied to IBM i from intent to implementation, and from evidence to improvement."
