Who needs ISO 27001?
Any organization that handles sensitive information can benefit, and many are asked for it directly: banks, insurers, healthcare and payments companies, technology vendors selling into Europe or Asia, and suppliers to large enterprises.
Where SOC 2 is the common request from US buyers, ISO 27001 is the one recognized internationally. Many companies end up with both, and much of the work overlaps.
What does the standard require?
The core of ISO 27001 is a management system: defined scope, leadership commitment, a documented risk assessment and treatment process, internal audits, management reviews and continual improvement. These requirements sit in clauses 4 through 10.
Annex A of the 2022 version lists 93 controls grouped into organizational, people, physical and technological themes. You select the controls that address your risks and record your choices, with justification, in a Statement of Applicability.
How does certification work?
Certification is a two-stage audit by an accredited certification body. Stage 1 reviews your ISMS documentation and readiness. Stage 2 checks that the ISMS and controls are operating in practice.
Once certified, the certificate is valid for three years, with surveillance audits in the intervening years and a recertification audit at the end of the cycle. Certificates issued against the older 2013 version have had to transition to the 2022 version.
What we do
We prepare the documentation the auditor will rely on, run the risk assessment and gap analysis, and help remediate gaps before the auditor finds them. Where useful, we use vulnerability assessments and penetration testing to surface technical risks early.
We also prepare your people. Staff who handle sensitive information need to understand the policies that apply to them, and we provide training, including social engineering exercises, so your team is ready for auditor interviews.
