Organizations use the ISO/IEC 27001 standard to establish an information security management system (ISMS). This standard outlines specific security measures and requirements that organizations can implement to effectively manage their information assets. However, the effectiveness of the standard’s problem-solving capabilities has raised some questions. Consequently, there is a continuous development of new governance methods that demand fresh approaches to validate security operations and measures. In light of this, research is being conducted to examine the application and impact of ISO/IEC 27001, as well as to analyze the challenges and knowledge gaps through theoretical perspectives. By employing stakeholder theory, the focus shifts towards integrating business and social issues and exploring how non-business pressures can influence stakeholder motivations in implementing standards. Additionally, it investigates the impact of these standards on an organization’s reputation, performance, and operations. Therefore, the objective of this study is to investigate the output legitimacy of ISO/IEC 27001 from the perspective of stakeholder expectations. To accomplish this, an interview-based study was conducted, involving relevant stakeholders engaged in information security management within private organizations in Sweden. The findings reveal eight key information security objectives. The results indicate that the level of output legitimacy of the standard varies across these objectives, ranging from high to medium to low. To achieve a high level of output legitimacy for ISO/IEC 27001, stakeholders must understand that the standard is not solely a technical document. Furthermore, stakeholders need to possess the appropriate knowledge and skills in information security to effectively navigate their work while leveraging the support provided by the standard.

组织使用 ISO/IEC 27001 标准建立信息安全管理体系 (ISMS)。该标准概述了组织可以实施以有效管理其信息资产的具体安全措施和要求。然而，该标准解决问题能力的有效性引发了一些问题。因此，新的治理方法不断发展，需要新的方法来验证安全操作和措施。有鉴于此，我们正在研究ISO/IEC 27001的应用和影响，并从理论角度分析挑战和知识差距。通过运用利益相关者理论，重点转向整合商业和社会问题，并探索非商业压力如何影响利益相关者实施标准的动机。此外，它还调查这些标准对组织声誉、绩效和运营的影响。因此，本研究的目的是从利益相关者期望的角度考察ISO/IEC 27001的输出合法性。为了实现这一目标，我们进行了一项基于访谈的研究，涉及瑞典私营组织内从事信息安全管理的相关利益相关者。调查结果揭示了八个关键信息安全目标。结果表明，标准的输出合法性水平因这些目标而异，范围从高到中到低。为了实现 ISO/IEC 27001 的高水平输出合法性，利益相关者必须了解该标准不仅仅是一个技术文件。此外，利益相关者需要拥有适当的信息安全知识和技能，以便在利用标准提供的支持的同时有效地开展工作。