ISO/IEC 27001 is the international standard that defines requirements for an information security management system, or ISMS. No law forces most companies to certify. You need it when customers, regulators or tenders ask for it, or when you want a proven way to manage security risk. Without such pressure, adopting the practices alone can be enough.
What exactly is the standard?
It is a requirements standard for a system of management, not a list of tools. ISO says it defines the requirements an ISMS must meet and gives organizations of any size guidance on establishing, implementing, maintaining and continually improving one. The goal is preserving confidentiality, integrity and availability of information through a risk management process.
The name matters in contracts. The official reference is ISO/IEC 27001 because ISO and the IEC publish it jointly, and ISO advises writing the full reference, for example "certified to ISO/IEC 27001:2022". The current edition is the 2022 one, with an amendment issued in 2024 on climate action changes.
Is certification required?
ISO says companies can decide whether to go through certification. Some implement the standard for the practices, others also certify to reassure customers. A certificate from an accredited certification body adds a layer of confidence, because an accreditation body has independently confirmed that the certifier is competent.
ISO's Survey 2022 reported over 70,000 certificates in 150 countries, and information technology was the sector with the largest share, almost a fifth of valid certificates in the 2021 survey. So it is common, though common does not mean universal.
Who needs it in practice?
Think in four buyer situations.
A customer put it in a questionnaire or contract. This is the most common trigger for software vendors. Ask the customer which they accept: a certificate, a SOC 2 report, or a completed questionnaire. Some accept alternatives.
You sell into a market where it is the norm. If every competitor shows a certificate on its trust page, silence costs deals.
A regulator or framework points at it. Some sector rules reference recognized security standards. Read your own rule text, since ISO/IEC 27001 is rarely named as mandatory on its own.
You want a management discipline. Founders sometimes adopt it because they want an owner for risk, an internal audit rhythm and a review loop. That is a legitimate reason, with or without a certificate.
Who can probably wait?
A pre-revenue team with no customer asking, no regulated data and no procurement pipeline. A short written security policy, patching, access control and backups give most of the protection. Certify later, when a deal needs it. Ask a certification body what recurring audits cost in money and staff time, so you can time the start.
How does certification work?
You build the ISMS, run it long enough to generate records, and an accredited certification body audits it. Ask the body how its stages and follow-up audits are scheduled, because that detail varies and we did not confirm it from ISO's own page. Then check the evidence you will need, which our post on auditor requests covers.
Software supply chain work feeds several areas the standard cares about: asset inventory, supplier risk, vulnerability handling and change control. SBOMs and dependency scans can support them. They do not replace the management system.
What to do
- Ask your top five customers what assurance they accept.
- List the contracts or tenders that would require a certificate.
- Decide scope: whole company, one product, or one service.
- Name an owner for the ISMS and a senior sponsor.
- Run a gap review against the clauses before you pay for an audit.
- Choose an accredited certification body and confirm what accreditation it holds.
- Use the full reference, ISO/IEC 27001:2022, in anything you publish.
Quick check
Is ISO 27001 the same as SOC 2?
No. ISO/IEC 27001 certifies a management system against an international standard. SOC 2 is an attestation report. Buyers may accept one, the other, or either.
Does a small company need it?
Only if a customer, regulator or deal requires it, or you want the discipline. The standard is designed to scale to any size.
Sources
Last reviewed: 18 October 2026.
