The ISO 27001 standard works by requiring management of the information security management system to examine security risks, implement a comprehensive suite of security controls to manage the identified risks, and operate ongoing processes to measure control effectiveness and risk levels.