ISO/IEC 27000 recommended by other ISO standards such as ISO 9000 and ISO 14000, used to manage information security risks and controls within an organization. Bringing information security deliberately under overt management control is a central principle throughout the ISO/IEC 27000 standards. Information security, like many technical subjects, is evolving a complex web of terminology. Relatively few authors take the trouble to define precisely what they mean, an approach which is unacceptable in the standards arena as it potentially leads to confusion and devalues formal assessment and certification. As with ISO 9000 and ISO 14000, the base '000' standard is intended to
ISO 9000 modified to allow the standard to integrate more easily with other international management systems standards. The new ISO 9001:2015 management system standard helps ensure that consumers get reliable, desired quality goods and services. This further increases benefits for a business. The 2015 version is also less prescriptive than its predecessors and focuses on performance. This was achieved by combining the process approach with risk-based thinking, and employing the Plan-Do-Check-Act cycle at all levels in the organization. Some of the key changes include: Two types of auditing are required to become registered to the standard: auditing by an external certification body