ISO 27001 can be used by anyone responsible for implementing, maintaining, or auditing an ISMS. Typical users include information security managers and specialists, risk managers, finance and procurement managers, governance, regulatory, and compliance (GRC) managers, and internal auditors. It is also relevant for third-party suppliers, partners, and service providers who may be responsible for handling an organization's assets or providing services related to Information Security Management or IT Asset Management.