ISO/IEC 27001 specifies requirements for an information security management system, and a certificate says that system conforms within a stated scope. For a product manager the important word is scope: it decides which product, which sites and which processes the certificate actually covers, and what you can truthfully say to customers.
What is ISO 27001 in plain terms?
The standard sets out requirements for establishing, implementing, maintaining and continually improving an information security management system, or ISMS. Its requirements are in clauses 4 to 10: context of the organization, leadership, planning, support, operation, performance evaluation and improvement. An annex lists a reference set of controls, supported by ISO/IEC 27002 guidance. The current edition is 2022, amended in 2024. Certification is optional unless law, contract or another scheme requires it.
Why is scope the product manager's issue?
A certificate applies only within the scope stated on it. If the ISMS covers your core platform but not the new analytics add-on, the certificate does not cover the add-on, and sales material must not suggest it does. Scope also lists locations and processes, so a new office or an acquired product can sit outside it for a while.
Constructed example: a company is certified for its web application. Six months later, product launches a mobile app backed by a separate service run by a different team. The sales deck says "ISO 27001 certified" on every slide. The mobile backend was never in scope. The honest wording is "our core web platform is within the certified scope", and the fix is to bring the mobile service into scope at the next surveillance audit.
How does the audit cycle affect the roadmap?
Certification involves an external audit in two stages, after which the certification body makes a decision. Surveillance audits follow, with the first within twelve months of the decision and then at least once each calendar year, and a recertification audit within a three year cycle. That calendar is a fixed rhythm you can plan around. Big launches that change systems are best discussed with the security lead before the audit window, not during it.
What does the standard ask of product work?
The ISMS requires a risk assessment and treatment process and a Statement of Applicability that records which controls apply, why, whether they are implemented, and justification for any exclusion. Product decisions that add data stores, vendors or new access paths change the risk picture, so the risk register should hear about them. This does not mean heavy process. It means a short note at design time.
What customers will ask
Expect requests for the certificate, its scope statement and the Statement of Applicability, or a summary of it. Have the exact scope text ready and a plain description of which products it covers. Keep the certificate's validity dates in a place sales can find.
What about marketing claims?
Certification wording is easy to overstate. A badge on the website should match the scope text and the dates on the certificate. If the certificate covers one product, name that product. If it has lapsed or is in a surveillance window, say nothing that implies otherwise. Ask legal to approve the standard sentence once, and reuse it everywhere. A wrong claim on a pricing page costs more trust than a missing badge ever will.
How to apply this
- Get the current scope statement and read it with the product list beside it.
- Mark each product, service and location as in scope, out of scope or pending.
- Give sales and marketing approved wording per product.
- Add a design time question: does this feature add data, vendors or access paths that the risk register should know about?
- Share the audit calendar with the roadmap owners.
- Plan to bring new products into scope before large customer commitments.
Quick check
Does an ISO 27001 certificate cover every product we sell?
No. It applies within the scope stated on the certificate. Products or locations outside that scope are not covered.
Is certification legally required?
Not by the standard itself. It is optional unless law, a contract or another scheme requires it.
Sources
Last reviewed: 18 October 2026.
