ISO/IEC 27001 certification, explained
ISO/IEC 27001 (published jointly by ISO and the IEC, the International Electrotechnical Commission) is the standard for information security management systems. It asks an organization to assess its information security risks, choose controls to treat them and keep the system under review. It suits software and cloud providers, outsourcers, financial services firms and any business whose customers ask how their data is protected.
Updated 5 November 2026
Info. Showing a standard does not mean a partner holds scope for it. How matching works.
Who it may be relevant for
- Software, SaaS, hosting and managed service providers handling customer data
- Outsourcing and shared-service providers asked about security in customer due diligence
- Financial services, healthcare and government suppliers with sensitive information
- Organizations that want one risk-based method for security across people, processes and technology
What it covers
- Defining the scope of the information security management system and the context around it
- A formal information security risk assessment and treatment method
- A statement of applicability showing which controls are selected and why
- Security controls covering organizational, people, physical and technological matters
- Monitoring, internal audit, management review and continual improvement
What it can help with
- A documented, risk-based approach to protecting confidentiality, integrity and availability of information
- A common answer to customer security questionnaires, supported by an independent audit
- Clearer ownership of assets, access, suppliers and incident response
- A structure that fits alongside ISO 9001, ISO 22301 or ISO/IEC 27701 if you add them later
What the pathway means
ISO/IEC 27001 is a certifiable management-system standard. An independent certification body audits your information security management system against the standard, with a Stage 1 documentation and readiness review, a Stage 2 audit of implementation, a certification decision, annual surveillance audits and recertification. Certification covers the scope you define, not your whole organization unless you include it. MIYAAR CONNECT does not audit or certify. We connect your inquiry with independent certification bodies.
Edition. ISO/IEC 27001:2022 is the current edition, with Amendment 1:2024, which added climate-change considerations to the organizational context requirements. Ask the certification body what applies to your audit.
The typical process
Steps and timing vary by body and scope. This is the usual shape, not a promise.
- You and us
Your inquiry
You describe your needs and share the basics.
- Certification body
Application and contract review
The body reviews your scope, sites and size, then quotes.
- Certification body
Stage 1 audit
A readiness review of your management system documentation.
- Certification body
Stage 2 audit
An evaluation of how the system works in practice.
- This part is theirs
Certification decision
Made by the certification body, never by MIYAAR CONNECT.
- Certification body
Surveillance and recertification
Periodic surveillance audits, then recertification at the end of the cycle.
Where it is typically used
- A SaaS company defining a scope around its platform, development process and support team
- An IT outsourcing firm demonstrating supplier, access and change controls to client auditors
- A bank supplier showing how staff, devices and cloud services are covered by the same risk method
What affects cost
- Number of employees
- Number of sites
- Complexity of what you do and its risks
- Headcount within the scope and the number of locations, including remote and cloud-based operations
- Complexity of the IT environment, for example number of systems, in-house development and data centres
- How much work is outsourced, which affects supplier management and audit evidence
- Whether the scope includes sensitive or regulated data requiring auditors with sector knowledge
What affects timing
- Time to complete a risk assessment, statement of applicability and control implementation
- Evidence that controls have operated for a period, for example access reviews and incident handling
- Completing an internal audit and a management review before the Stage 2 audit
- Gaps found at Stage 1 that need time to fix, such as missing logs, policies or training records
What to have ready
- A short description of the intended scope: services, locations, systems and teams
- A summary of how information is stored and processed, including cloud and outsourced services
- A list of customers or tenders that ask for ISO/IEC 27001, with expected dates
- Whether other security frameworks or certificates are already in use
- Do not send risk registers, network diagrams or customer data at the inquiry stage
Accreditation and recognition
A certificate shows an audit of a stated scope, not that an organization is immune to attack. Certification bodies are assessed by accreditation bodies for defined scopes. Ask for the certificate number and the scope statement, and confirm the body's accreditation with its accreditation body or through the Global Accreditation Cooperation Incorporated (Global ACI) arrangement, which took over from the IAF and ILAC on 1 January 2026. Check the scope covers the services you actually use, and note that buyers decide for themselves what they accept.
Common questions
Does ISO/IEC 27001 make us secure?
Can the certificate cover just one product or team?
Is a separate security assessment of our systems included?
How does ISO/IEC 27001 relate to ISO/IEC 27701?
Related standards
Relevant industries
Useful reading
Sources
- ISO: ISO/IEC 27001 information security management systems (checked 5 November 2026)
Ask about availability for ISO/IEC 27001
We review availability for each inquiry. If no verified certification body fits your request, we will tell you plainly.