ISO 27001: The Complete Guide for IT and SaaS Companies

ISO/IEC 27001 is the international standard for running an information security management system (ISMS). It is voluntary, but it is the security certificate enterprise customers most often ask IT and SaaS companies for, especially outside the United States. The current edition is ISO/IEC 27001:2022, amended in 2024. Since 31 October 2025, only certificates issued against the 2022 edition are valid.

What is ISO 27001?

ISO 27001 sets out how to build, run and keep improving a system for managing information security risk. It doesn’t tell you which firewall to buy. It requires you to find your own risks, decide how to treat them, put controls in place, check that they work and fix what doesn’t.

The standard has two parts:

• Clauses 4 to 10 are the management system requirements. Every one of them is mandatory if you want certification.
• Annex A is a reference list of 93 security controls. You must compare your risk treatment against it, but you only implement the controls your risks call for, and you justify any you leave out.

The official definition of an ISMS is part of the management system that preserves the confidentiality, integrity and availability of information by applying a risk management process. In practice, for a software company, it covers your people, your offices or remote set-up, your laptops, your cloud accounts, your code and your suppliers.

ISO 27001 vs ISO 27002. ISO 27001 contains the requirements you are audited against. ISO 27002 is a separate guidance document that explains how to implement each Annex A control. You can’t be certified to ISO 27002.

History and why it was introduced

ISO 27001 grew out of a British standard written in the 1990s, when companies needed a common way to show partners that their information was handled safely.

The 2022 revision was introduced to reflect how companies actually work now: cloud services, remote work, threat intelligence, secure coding and data leakage were all either missing or underplayed in 2013.

Main objectives:

1. Protect the confidentiality, integrity and availability of information.
2. Make security decisions based on risk, not checklists.
3. Give leadership clear accountability for security.
4. Provide independent, comparable proof of security to customers and partners.
5. Keep security improving as the business, threats and technology change.

Who needs ISO 27001?

No law requires ISO 27001 on its own. Companies get certified because customers, tenders or regulators ask for it, or because it is the most efficient way to answer security questionnaires.

Industries where it is most common: software and SaaS, IT services, fintech and banking suppliers, healthcare technology, telecoms, cloud hosting and government suppliers.

Geography. ISO 27001 is used worldwide. Certificates are issued by certification bodies that are accredited by a national accreditation body, such as UKAS (UK), ANAB (US), DAkkS (Germany) or NABCB (India). A certificate from an accredited body is recognised internationally through IAF agreements, and you can check it on the IAF CertSearch database.

Where laws point to it. Some laws refer to it directly or accept it as evidence:

• In India, Rule 8 of the SPDI Rules 2011 names IS/ISO/IEC 27001 as one standard that meets the “reasonable security practices” requirement under Section 43A of the IT Act. Those rules fall away once the DPDP Act fully takes effect in May 2027. After that, ISO 27001 is a strong way to show the “reasonable security safeguards” the DPDP Rules require, though the Rules don’t name it.
• GDPR Article 32 and NIS2 Article 21 require risk-based security measures. ISO 27001 doesn’t give automatic compliance, but it covers much of the ground and is widely used as evidence.

Key requirements

Clauses 4 to 10: the management system

Annex A: the 93 controls

The 2022 edition groups controls into four themes:

The 11 new controls in 2022, several of them especially relevant to software companies:

Controls that matter most for software companies

Access control (5.15 to 5.18, 8.2, 8.5). Single sign-on with MFA for every system, least privilege, a joiner-mover-leaver process, and quarterly access reviews of production and admin accounts. Auditors sample leavers and check their access was removed promptly.

Secure development (8.25 to 8.31). A defined secure development lifecycle, separate development, test and production environments, peer review before merge, automated security testing, and no real customer data in test without masking. The OWASP Top 10 is a useful baseline here.

Supplier security (5.19 to 5.22). A list of suppliers that touch your data (cloud host, email, analytics, support tools), security checks before onboarding, contract clauses, and periodic review.

Logging and monitoring (8.15, 8.16). Logs from production, identity provider and cloud control plane, kept for a defined period, protected from tampering, and reviewed.

Backups and recovery (8.13, 5.30). Automated backups, stored separately, with restore tests on a schedule and documented results.

Incident management (5.24 to 5.28). A written process, defined severity levels, a way to collect evidence, lessons learned, and links to legal deadlines such as CERT-In’s 6-hour reporting rule in India or GDPR’s 72-hour breach notice.

How to implement ISO 27001

1. Get leadership commitment. Name an executive owner, agree budget and a target certification date.
2. Define the scope. Usually the product, the teams that build and run it, and the cloud environments it runs in. A tight scope is fine for a first certificate, but customers will read it, so don’t exclude what they care about.
3. Gap assessment. Compare current practice with clauses 4 to 10 and Annex A.
4. Choose a risk method. Define how you score likelihood and impact, and what risk level is acceptable. ISO 27005 gives guidance.
5. Asset inventory and risk assessment. List information assets and systems, then identify risks to each.
6. Risk treatment plan and Statement of Applicability. Decide which controls treat each risk, and record all 93 Annex A controls as included or excluded, with reasons.
7. Write policies and procedures. Keep them short and true to what you actually do.
8. Implement controls. Usually the longest step: SSO and MFA, device management, logging, backups, vendor reviews, secure development practices.
9. Train staff. Security awareness for everyone, plus role-specific training for engineers and admins.
10. Operate and collect evidence. Run the controls for long enough to produce records. Many certification bodies want to see around 2 to 3 months of operation, though the standard itself sets no minimum.
11. Internal audit. Audit the whole ISMS against the standard, using someone independent of the work they audit.
12. Management review. Leadership reviews results, risks and improvement actions, and records decisions.
13. Fix nonconformities. Close internal audit findings with root cause and corrective action.
14. Certification audit. Stage 1 and Stage 2, described below.

Typical timeline

These are typical ranges from practice, not requirements of the standard.

Documentation and policies

Documented information the standard requires:

• ISMS scope (4.3)
• Information security policy (5.2)
• Risk assessment process (6.1.2)
• Risk treatment process (6.1.3)
• Statement of Applicability (6.1.3 d)
• Information security objectives (6.2)
• Evidence of competence (7.2)
• Documented information needed for the ISMS to be effective (7.5.1 b)
• Operational planning and control records (8.1)
• Risk assessment results (8.2)
• Risk treatment results (8.3)
• Monitoring and measurement results (9.1)
• Internal audit programme and results (9.2)
• Management review results (9.3)
• Nonconformities and corrective actions (10.2)

Policies and procedures most auditors expect for Annex A (not all are mandatory, but you will need to show how each included control works): access control, acceptable use, asset management, backup, business continuity, change management, cryptography, data classification and handling, data retention and deletion, incident response, logging and monitoring, mobile devices and remote work, secure development, supplier security, and vulnerability management.

Audits, assessments and certification

Certification is done by an independent certification body. Choose one accredited for ISO 27001 by a member of the IAF, because unaccredited certificates are often rejected by customers. Accredited bodies follow ISO/IEC 17021-1 and ISO/IEC 27006-1, which also set how many audit days your audit needs, based mainly on headcount in scope and complexity.

What evidence auditors sample: access review records, leaver tickets, patch reports, vulnerability scan results, backup restore tests, training completion, vendor assessments, change tickets with approvals, incident records, and the risk register with dates.

A major nonconformity, such as no internal audit, or a key control that is not working at all, blocks certification until it is fixed. If problems found in a surveillance audit aren’t resolved, the certificate can be suspended or withdrawn.

Cost

ISO 27001 cost varies widely, so be wary of a single figure. The main cost areas are:

To compare quotes, ask each certification body for the number of audit days for Stage 1, Stage 2 and each surveillance audit, and its daily rate. Daily rates vary by country.

Benefits of certification

• Faster sales. One certificate answers a large part of most security questionnaires and removes a common blocker in enterprise deals.
• Access to tenders that require or score ISO 27001.
• Fewer, smaller incidents. Risk assessment, access reviews and tested backups reduce both the chance and the impact of a breach.
• Easier compliance with laws. The same controls support GDPR, the DPDP Act, NIS2 and contract requirements.
• A base for other standards. ISO 27701, ISO 22301 and ISO 42001 share the same structure and can be added to the same management system.

Risks of not having it

ISO 27001 is voluntary, so there is no fine for not having it. The real risks are commercial and operational:

• Lost or delayed deals when a customer’s procurement requires it.
• Longer sales cycles answering questionnaires one at a time.
• Being found to have weaker security after an incident, which can hurt your position with regulators, customers and insurers.
• A suspended or withdrawn certificate if you are certified but stop running the ISMS, which customers can see in public databases.

Common mistakes

1. Buying policy templates and calling it done. Auditors check that you do what the policy says. A policy you don’t follow becomes a nonconformity.
2. A scope that excludes what customers care about, such as leaving out production cloud environments.
3. A generic risk register with no link to your actual systems, threats or controls.
4. Excluding Annex A controls without a real reason, such as excluding secure development at a software company.
5. Skipping the internal audit or management review, or doing them the week before Stage 1.
6. Evidence collected only at audit time, rather than as part of normal work.
7. Ignoring suppliers. Your cloud host and SaaS tools are part of your risk.
8. Treating certification as the finish line. Surveillance audits check that the system keeps running.

Challenges for IT companies

• Fast change. Weekly releases and frequently changing cloud resources make manual evidence collection impractical; automate it where you can.
• Remote and distributed teams. Physical controls shift to device management, disk encryption and secure home working rules.
• Developer resistance. Controls work best when built into existing tools, such as branch protection, CI security checks and infrastructure as code, rather than added as extra paperwork.
• Shared responsibility in the cloud. You must show which controls your cloud provider covers (using their own ISO 27001 and SOC 2 reports) and which you run yourself. ISO 27017 helps here.
• Multiple frameworks at once. Customers ask for ISO 27001, SOC 2 and privacy evidence. Map controls once and reuse the evidence.

Best practices

• Keep the scope honest and explain it clearly on the certificate.
• Assign an owner to every control, with evidence produced automatically where possible.
• Review access and risks on a calendar, not just before audits.
• Bring engineering in early; most Annex A technological controls live in their tools.
• Use your cloud provider’s compliance reports for controls they own.
• Run a real internal audit with someone who can challenge the team.
• Measure a small set of objectives, such as MFA coverage, patch times and restore test success, and report them to management.

Tools that help

Tools support the ISMS but don’t replace it. Useful categories:

How ISO 27001 relates to other frameworks

Real-world examples

• Major cloud providers. AWS, Microsoft Azure and Google Cloud all publish ISO 27001 certificates and their scope statements in their compliance centres. SaaS companies rely on these certificates for the controls their cloud provider covers.
• Indian IT services. ISO 27001 certificates are a common requirement in the outsourcing contracts and RFPs of the large Indian IT services firms, and the SPDI Rules named it as a recognised security practice.
• Illustrative scenario, not a real company: a 40-person B2B SaaS company is losing deals in Europe because it lacks a certificate. It scopes the ISMS to its product, engineering, support and AWS production accounts. It turns on SSO and MFA, device management and centralised logging, runs quarterly access reviews and a backup restore test, completes an internal audit and management review, and passes Stage 2 with two minor nonconformities about five months after starting.

Frequently asked questions

Is ISO 27001 mandatory? No law requires ISO 27001 in general. It becomes required when a customer contract or tender demands it. Some laws and regulators accept it as evidence of good security.

What is the latest version of ISO 27001? ISO/IEC 27001:2022, with Amendment 1 published in 2024. Certificates to the 2013 version expired on 31 October 2025.

How many controls are in ISO 27001:2022? 93 controls in Annex A, grouped into 4 themes: 37 organisational, 8 people, 14 physical and 34 technological.

Do I have to implement all 93 controls? No. You must consider all of them in your Statement of Applicability, implement those your risk assessment needs, and justify each one you exclude.

How long does ISO 27001 certification take? Typically 3 to 6 months for a small cloud-native company and 6 to 12 months or more for larger organisations. It depends mostly on how mature your security already is.

How long is an ISO 27001 certificate valid? Three years, with surveillance audits in the first and second years and a recertification audit before it expires.

What is the difference between ISO 27001 and SOC 2? ISO 27001 certifies your management system against an international standard. SOC 2 is an attestation report from a CPA firm on your controls against the AICPA Trust Services Criteria. They overlap heavily, and many SaaS companies hold both.

Can a small company or startup get ISO 27001? Yes. The standard scales to any size. Small companies usually have a shorter, simpler implementation.

Can an individual be ISO 27001 certified? Organisations are certified. Individuals can take personal courses such as ISO 27001 Lead Implementer or Lead Auditor, which are training certificates, not ISO 27001 certification.

How do I check if a company’s ISO 27001 certificate is real? Ask for the certificate and check the certification body’s accreditation, then search the IAF CertSearch database or the certification body’s own register. Read the scope to see what is actually covered.

What is a Statement of Applicability? A required document that lists every Annex A control, whether it applies, whether it is implemented, and why it is included or excluded.

Does ISO 27001 make us GDPR or DPDP compliant? No. It covers security, which both laws require, but not other legal duties such as consent, notices, data subject rights or breach notification rules. ISO 27701 extends the system to privacy.

Can ISO 27001 be done remotely? Many audits are now partly or fully remote, depending on the certification body’s rules and your set-up. Physical sites in scope may still need a visit.

What happens if we fail the certification audit? Major nonconformities must be fixed and verified before a certificate is issued. This usually delays certification rather than restarting it.

Next steps

• Decide why you need it: list the customers, tenders or regulations asking for it.
• Draft a scope that covers what those customers care about.
• Run a gap assessment against clauses 4 to 10 and Annex A.
• Set a target audit date and shortlist accredited certification bodies.
• Turn on the high-impact controls first: SSO and MFA, device management, logging, backups.