A federation of national bodies, not one organization
ISO (International Organization for Standardization) and IEC (International Electrotechnical Commission) are separate bodies that jointly run the technical committee responsible for cryptography and IT security: ISO/IEC JTC 1/SC 27. Unlike NIST (one US government agency) or the IETF (open individual participation), ISO/IEC's members are national standards bodies — ANSI for the US, BSI for the UK, DIN for Germany, and so on — each representing their own country's position, with published standards adopted by formal international consensus across those delegations.
The practical difference you'll actually notice: NIST's FIPS and SP 800 documents, and every IETF RFC, are free to read. ISO/IEC standards are sold, typically for real money per document — a genuine friction point for smaller teams trying to reference the exact spec their compliance program requires.
What ISO/IEC has actually standardized
ISO/IEC JTC 1/SC 27 covers both algorithm-level specifications and organizational/process standards — a broader scope than NIST's mostly-algorithmic FIPS series.
The ISO/IEC 27000 and cryptography series
ISO/IEC 18033 (parts 1–4)
Encryption algorithms — general model, asymmetric ciphers, block ciphers (including AES), and stream ciphers.
ISO/IEC 9797 (parts 1–3)
Message Authentication Code (MAC) algorithms.
ISO/IEC 10118 (parts 1–4)
Hash functions, including the SHA family and others.
ISO/IEC 11770 (parts 1–6)
Key management — establishment, agreement, and related mechanisms.
ISO/IEC 14888
Digital signatures with appendix.
The Common Criteria for Information Technology Security Evaluation — the framework behind "Common Criteria certified" hardware and software.
ISO/IEC 19790 & 24759
Security requirements for cryptographic modules, and how to test them — the international counterpart to NIST's FIPS 140-3 module-validation program.
Information Security Management Systems (ISMS) — the standard behind the certification most enterprise security questionnaires actually ask for.
Practice
A vendor's compliance page says they're "ISO/IEC 27001 certified." Is that a claim about a specific cryptographic algorithm, or about something else?
Where you've encountered it without buying a copy
A vendor's "ISO/IEC 27001 certified" badge on a trust-center page, a hardware token or HSM listed as "Common Criteria EAL4+ certified," a cryptographic module validated against ISO/IEC 19790 for a market where FIPS 140-3 isn't the relevant regime — all of this is ISO/IEC's standards infrastructure operating in the background of ordinary vendor due diligence, GRC questionnaires, and procurement requirements, whether or not anyone in the room has read the underlying paid document.
Go deeperWhy the same algorithm can have two standard numbers⌄
AES is both FIPS 197 (NIST) and ISO/IEC 18033-3 — the same algorithm, standardized twice, by two different bodies, for two different regulatory audiences. This isn't duplication for its own sake: a US federal contractor's compliance requirement typically cites FIPS 197 by name, while a company operating primarily under EU or international frameworks may need to cite the ISO/IEC number instead — same math, same security guarantees, different paperwork trail. ISO/IEC frequently adopts NIST's already-public, already-reviewed algorithm work directly rather than re-running the cryptanalysis from scratch, which is also why AES's ISO/IEC standardization came years after its FIPS 197 publication rather than the two processes racing each other.