ISO 27001
Who ISO 27001 is worth it for, and who can wait.
No general law makes ISO 27001 compulsory for every business. It becomes necessary when someone you depend on asks for it: a buyer, a tender, a regulator's expectations, or an investor. This page helps you tell whether that is you yet, and what to do instead if it is not.
Back to ISO 27001 services01 · The signals
Five signals that it is time
One strong signal is usually enough. None means wait.
- A buyer names itA contract, security questionnaire or procurement policy asks for an ISO 27001 certificate, not just good practice.
- Tenders require itPublic or large private tenders list it as a qualifying condition.
- Customers abroadBuyers in Europe, the Middle East and much of Asia commonly treat it as the recognised security baseline.
- A regulated sectorYour regulator expects a structured security programme, and a certificate is accepted evidence of one.
- Diligence is comingInvestors or acquirers will ask how security is governed, and a working ISMS answers in one document set.
02 · Situations
Common situations, read honestly
Each row gives the reason and the alternative if ISO 27001 is not the right step yet.
| Situation | Why ISO 27001 helps | Alternative if not ISO 27001 yet |
|---|---|---|
| B2B SaaS selling to European enterprises | Widely recognised by procurement teams there | A completed questionnaire with policies and a pen test summary, as a stopgap |
| IT services or BPO vendor to global clients | Clients often require it in master agreements | Little; it is often a condition of the contract |
| Indian bank, NBFC, insurer or market intermediary | Supports the structured programme regulators expect; some instruments reference it | Meet the regulator's own framework directly, and map later |
| Bidding for government or PSU tenders | Often listed as a qualifying criterion | None, if the tender requires it |
| Seed-stage startup selling to small businesses | Rarely asked for yet | Basic controls, a security page, and a plan to certify when buyers ask |
| US-focused SaaS | Recognised, but buyers more often ask for SOC 2 | A SOC 2 report first, then ISO 27001 if overseas demand grows |
| Company preparing for fundraising or sale | Shows governance in a form diligence teams know | A gap analysis and remediation plan you can share |
Sector rules change and differ by entity type. Check the current instrument for your licence before treating a certificate as required or sufficient. Our India guides map the main ones.
03 · When to wait
When it is honestly not worth doing yet
A certificate has a running cost. Do not take it on without a reason.
- No buyer, tender, regulator or investor has asked, and none is likely within your planning horizon.
- The company has no one who can own an ISMS for the three-year cycle after certification.
- The product or business model is about to change so much that the scope would be rewritten.
- Your main market asks for something else, and you cannot fund two programmes.
Doing the work without the certificate
You can build an ISMS to the standard and not certify. That gives you the discipline and much of the evidence, and you can certify later. It does not let you claim to be certified.
04 · Against SOC 2
A decision path when SOC 2 is also on the table
Let where your buyers are decide the order.
- List the deals in your pipeline that ask for a specific assurance, and which one each asks for.
- If most ask for SOC 2 (common with US buyers), start there.
- If most ask for ISO 27001 (common outside the US and in tenders), start there.
- If it is mixed, build one control set that serves both and sequence the audits; see the guide on running them together.
- If nobody asks yet, build the core controls and decide when the first request arrives.
ISO 27001
A certificate from an accredited certification body that your management system conforms to the standard. Public, short, easy to verify.
SOC 2
An attestation report from a licensed CPA firm on your controls, usually shared under NDA. Detailed, read by buyers' security teams.
Sources: ISO/IEC 27001:2022 (scope and purpose, public information only); ISO/IEC 17021-1 for the role of certification bodies; AICPA SOC suite descriptions for the SOC 2 comparison.
Questions about who needs it
Is ISO 27001 mandatory in India?
Not as a general rule. Some sectors and contracts expect it.
No general Indian law requires every business to certify. Certain regulators and many government tenders reference it or expect equivalent controls. Check your specific regulator and contracts.
Does ISO 27001 make us compliant with the DPDP Act?
No. It helps with security safeguards, not the whole Act.
The Act covers consent, notice, rights and more. A working ISMS supports the duty to protect personal data with reasonable security safeguards, which is one part.
Can a very small company get certified?
Yes. Size does not prevent it; ownership does.
Small companies certify regularly with a narrow scope and lean documents. The question is whether someone can keep it running between audits.
Our customer accepts either. Which is cheaper to keep?
It depends on your markets and existing controls.
Running costs depend on scope, audit fees and internal effort, not the label. If you will need both eventually, a shared control set keeps the second one cheaper.
Find out whether now is the time.
An ISO 27001 gap analysis shows the size of the job, so the decision rests on facts rather than a buyer's deadline.