Glossary · ISO and management systems
ISO/IEC 27001 is the security standard a buyer can verify without visiting you.
The international standard that sets requirements for an information security management system, against which an accredited certification body can audit and certify an organization.
Back to the glossary01 · In plain words
In plain words
The international standard that sets requirements for an information security management system, against which an accredited certification body can audit and certify an organization.
ISO/IEC 27001 describes how an organization should run information security as a managed system: decide what is in scope, assess risks, choose controls, check they work and keep improving. Its current edition is from 2022. A company that meets it can be audited and certified by an independent body.
Spelled out: ISO/IEC 27001, Information security, cybersecurity and privacy protection: Information security management systems: Requirements.
02 · Why it matters
Why it matters
Who cares about this, and what depends on it.
For a company selling to enterprises, especially outside the United States, an ISO/IEC 27001 certificate is often the shortest answer to a long security questionnaire. It tells a buyer that an accredited auditor has checked the whole system, not just a few controls, and that the check is repeated every year. Several Indian regulators and many public tenders name it or accept it as evidence of good security practice. The standard is risk based, so a small SaaS company and a large bank can both meet it with very different control sets.
03 · Where you meet it
Where you will meet it
The documents, meetings and reports where it appears.
- Tender and procurement forms
- Ask for a valid certificate, its scope and the issuing certification body.
- Vendor security questionnaires
- A certificate often lets a buyer skip or shorten whole sections.
- Clauses 4 to 10
- The management system requirements: context, leadership, planning, support, operation, evaluation and improvement.
- Annex A
- The reference list of 93 controls compared against your own choices.
04 · An example
A worked example
An illustration, not a real client.
Illustrative: an EdTech platform entering a university contract
A Hyderabad EdTech company bids for a contract with a European university. The procurement form asks for an information security certification covering the hosted platform. The team scopes its ISMS to the platform, its cloud hosting and the support team, leaving the in-person tutoring arm out. After risk assessment, control work, an internal audit and a management review, an accredited certification body runs Stage 1 and Stage 2. The certificate names the platform scope, which is exactly what the university needs to see.
05 · Easy to mix up
Easy to mix up with
Neighbouring terms that mean something different.
- ISO/IEC 27002
- A guidance standard on how to implement controls. You cannot be certified to it.
- SOC 2
- An attestation report by a licensed CPA firm on controls against the Trust Services Criteria. ISO/IEC 27001 produces a certificate, not a report.
06 · What to do
What to do with it
Practical steps, and the guides that go deeper.
- Decide the scope with your buyers in mind, then write it down.
- Run a gap assessment against Clauses 4 to 10 and Annex A.
- Build the risk process and Statement of Applicability before writing many policies.
- Shortlist accredited certification bodies early to plan audit dates.
- GuideWhat ISO 27001 requires, in one placeEvery requirement at a glance, with the page that explains each.
- GuideISO 27001 certification guideThe roadmap, Stage 1 and Stage 2, and the three-year cycle.
- GuideWho needs ISO 27001?The buyers, laws and situations that make it worth doing.
Sources: public ISO summary of ISO/IEC 27001:2022, ISO/IEC 17021-1 and IAF material on accredited certification.
Questions about ISO/IEC 27001
How long is an ISO/IEC 27001 certificate valid?
Commonly three years, with yearly surveillance.
Accredited certification commonly runs on a three-year cycle: an initial audit, surveillance audits in the following years, then recertification. The certificate stays valid only while surveillance audits are passed.
Is ISO/IEC 27001 a legal requirement in India?
Not generally, though some regulators reference it.
No law requires it across the board. Some sector regulators and many contracts refer to it or accept it as evidence. Check the instrument that applies to you, and ask counsel how it reads for your contracts.
Want this applied to your own systems?
Our team can walk through where this term touches your scope, your contracts and your evidence.