It's the leading international standard for managing information security risk through a certifiable management system (ISMS).

Is ISO 27001 certification mandatory?

No, it's voluntary, but many enterprise customers and public-sector tenders require it as a condition of doing business.

How long does ISO 27001 certification take?

Most organisations take three to twelve months, depending on the maturity of existing security controls.

What's the difference between ISO 27001 and SOC 2?

ISO 27001 is a certifiable management system standard; SOC 2 is an attestation report on specific controls, more common in the US SaaS market.

🇪🇺 Europe

ISO/IEC 27001 Certification

Build a certifiable information security management system

ISO/IEC 27001 is the international standard for Information Security Management Systems (ISMS). It defines a risk-based process for identifying, treating, and continually improving how an organisation protects its information, and certification is often required to win enterprise contracts and public tenders.

Global

Standard scope

Annex A controls

3-12m

Typical cert. timeline

Any

Sector or size

2022

Current edition

What is ISO/IEC 27001?

ISO/IEC 27001 is the international standard for Information Security
Management Systems (ISMS). It sets out a risk-based, Plan-Do-
Check-Act methodology for identifying, treating, and continually
improving how an organisation protects its information assets.

Who needs to comply with ISO/IEC 27001?

Any organisation, of any size or sector, that wants to
formally demonstrate strong security governance - often a hard
requirement for winning enterprise contracts, public tenders, or
supplier onboarding.

What are the key requirements
of ISO/IEC 27001?

A risk assessment and risk treatment plan covering all information assets

A Statement of Applicability justifying which Annex A controls are implemented

Implementation of relevant Annex A controls across organisational, people, physical, and technological domains

Internal audits and management reviews on a regular cycle

Continual improvement of the ISMS based on audit findings and incidents

What are the penalties for ISO/
IEC 27001 non-compliance?

There's no regulatory fine for skipping ISO 27001 - the cost shows up commercially, in lost
deals, failed vendor assessments, and slower sales cycles when customers demand proof
of certification.

Kontakt

Lost deals

Enterprise prospects walk away without it

Failed vendor assessments

Security questionnaires you can't pass

Slower sales cycles

Security reviews stall procurement

Supply chain exclusion

Removed from approved supplier lists

How does GDPRLocal help with ISO/IEC 27001?

GDPRLocal supports you with everything ISO/IEC 27001 requires: gap analysis against your current controls, ISMS design and documentation, Annex A control implementation, internal audit support, and certification audit preparation with an accredited body - start to finish.

Kostenloser Einstieg