What Is ISO 27001 and Does Your Company Need Certification
Basics4 minInnovialabs editorial team
In short
ISO 27001 is the international standard for an information security management system (ISMS); certification is worth it when clients, tenders or partners explicitly require it, and otherwise a lighter policy set modeled on it is often enough.
The short answer
ISO/IEC 27001 is an international standard describing how to build and maintain an information security management system (ISMS). It does not prescribe specific software or settings. It requires a company to understand its risks, choose protective measures deliberately, document them and regularly check that they work.
A certificate confirms that an independent auditor has checked that system. You mainly need one when clients, tenders or regulators require it. Without such requirements, it is usually smarter to start with a lighter set of policies and practices and return to certification when the demand appears.
What an ISMS is
An ISMS is not a product or a department but a set of processes and rules:
- which information assets the company has and who is responsible for them;
- which risks threaten them and how those risks are assessed;
- which measures were chosen to reduce the risks and why;
- how staff are trained and how incidents are handled;
- how management checks that all of this works and improves.
The core idea is the Plan-Do-Check-Act cycle: plan, implement, check, improve. Security becomes a routine process rather than a one-off project.
How the standard is structured
The standard has two parts.
Main clauses (4-10) are mandatory requirements for the management system itself:
| Clause | About |
|---|---|
| Context | ISMS scope, interested parties |
| Leadership | management role, security policy |
| Planning | risk assessment and treatment |
| Support | resources, competence, documentation |
| Operation | carrying out the risk treatment plan |
| Performance evaluation | monitoring, internal audit, management review |
| Improvement | nonconformities and corrective actions |
Annex A is a catalog of controls. In the current edition they are grouped into four themes: organizational, people, physical and technological. They cover access control, backups, secure development, supplier management and much more.
A key document is the Statement of Applicability (SoA): the company lists every Annex A control and explains which it applies and why it excluded the rest. That keeps the standard flexible: a small company without its own server room does not have to implement data center controls.
How certification works
- Define the scope. What the ISMS covers: the whole company, one product or one site.
- Assess risks and select controls. Build a risk register and the SoA.
- Implement and document. Policies, procedures, technical measures.
- Run the system. Before the audit the ISMS must actually operate for a while: records accumulate, an internal audit and management review take place.
- Stage 1 audit. An accredited certification body reviews documentation and readiness.
- Stage 2 audit. A check that processes are really followed: interviews, records, sampling of controls.
- Certificate and surveillance. A certificate is typically valid for three years, with annual surveillance audits, followed by recertification.
Timelines: what drives them
There is no fixed duration, but it is a project measured in months, not weeks. The length depends on:
- scope size: one product is simpler than the whole company;
- maturity of current practices: access control, backups and logging already in place or not;
- resources: a dedicated owner and management support;
- how long the system runs before the audit so evidence builds up;
- the certification body's availability.
When certification is really needed
- Enterprise or international clients put it in contracts or supplier questionnaires.
- Tenders that explicitly require a certificate.
- You process sensitive client data as a vendor: SaaS, hosting, fintech, outsourced development.
- An industry regulator or partner expects formal proof.
When a lighter policy set is enough
If nobody requires a certificate, use the standard as a guide and put the basics in place:
- an access and password policy with mandatory 2FA;
- an asset and risk register in a simple spreadsheet;
- a backup procedure with restore tests;
- onboarding and offboarding procedures;
- an incident response plan;
- security requirements for contractors.
This answers most questions in client security questionnaires and makes future certification easier.
Common mistakes
- Buying document templates nobody follows: auditors check practice, not just paperwork.
- Choosing too broad a scope the first time.
- Leaving everything to one specialist without management involvement.