ISO/IEC 27001:
the standard proof of IT security

In brief

ISO/IEC 27001 describes an information security management system (ISMS). The standard does not prescribe any particular technology. It requires you to know the risks to the confidentiality, integrity and availability of your information, choose suitable controls, operate them and review them regularly. Annex A of the 2022 version contains 93 controls in four groups: organizational, people, physical and technological. In a Statement of Applicability you define which of them apply to you and why.

Today only ISO/IEC 27001:2022 is valid. The transition period for certificates issued under the 2013 version ended on October 31, 2025. An old certificate that you still attach to tenders does more harm than good.

Several extensions sit around the standard, and EU customers ask for them specifically. ISO/IEC 27701 adds privacy to the ISMS and suits processors under the GDPR well. ISO/IEC 27017 and ISO/IEC 27018 cover cloud services and personal data in the cloud. If you sell cloud services to public agencies or large corporations in Germany, you will also hear about the C5 criteria catalog published by the BSI. All of these build on ISO/IEC 27001. So start there, and add the others when a specific customer asks for them.

Why EU customers ask for it

Most EU cybersecurity rules do not reach you directly. They reach you through your customer. NIS2 requires important and essential entities in the EU to manage the security of their supply chain (Art. 21). That means your customer has to check how securely you work. DORA requires banks, insurers and other financial entities to assess ICT service providers before signing a contract and to agree on specific clauses (Art. 28 to 30). The GDPR allows a controller to use only processors that provide sufficient guarantees for technical and organizational measures (Art. 28 and 32).

An ISO/IEC 27001 certificate answers a large share of these questions at a glance. It does not fully replace your customer's own assessment: incident reporting deadlines, data locations and exit rules still go into the contract or the questionnaire. But the questionnaire gets shorter, and an on-site audit at your premises is often dropped. If you ship products with software to the EU, the Cyber Resilience Act adds obligations that go beyond the ISMS.

Who needs it in South America

EU customers ask these companies most often:

• Software companies and development service providers, for example in Montevideo, Buenos Aires, Medellín or Florianópolis, that write code for European clients or run SaaS
• BPO operations and contact centers in Colombia, Peru or Brazil that see customer data of European clients
• Fintechs and IT service providers that supply EU banks or insurers and therefore fall under their customers' DORA requirements
• Data centers, hosting providers and managed service providers
• Industrial companies whose EU customers share design data or remote maintenance access

For automotive suppliers, TISAX is usually the better fit. If you mainly serve US customers, you know SOC 2; for the EU, ISO/IEC 27001 remains the first choice.

Steps to certification

1. Define the scope: which sites, services, systems and teams. It has to cover the service your EU customer is buying.
2. Carry out a risk assessment and select controls, documented in the Statement of Applicability.
3. Put policies and controls in place, for example access rights, backups, supplier management, training and incident management.
4. Run the ISMS for a few months, perform an internal audit and hold the management review. Without this evidence no certification body can move forward.
5. Stage 1 audit: the certification body reviews your documentation and readiness.
6. Stage 2 audit: it checks whether the ISMS works in daily operations. You have to fix any nonconformities before the certificate is issued.
7. Certificate valid for three years, with annual surveillance audits and a recertification at the end.

A midsize company starting from zero typically needs 6 to 12 months to get certified. With a small scope and existing basics it sometimes goes faster; with several sites or tight resources it takes longer. Plan a few weeks between Stage 1 and Stage 2 to work through findings from the document review. Nobody can guarantee a date, because the Stage 2 audit depends on real operating evidence. Costs vary widely with size, scope and certification body, so get several quotes.

Accreditation: which body counts

For EU buyers, a certificate is only worth as much as the body that issued it. The certification body must be accredited for ISO/IEC 27001 by an accreditation body that has signed the international recognition arrangement. Until the end of 2025 that was the IAF MLA. Since January 1, 2026 it has been the MRA of the Global Accreditation Cooperation Incorporated (Global ACI). Accreditations under the IAF MLA remain recognized during the transition.

All nine countries have an accreditation body that Global ACI lists as a signatory (as of October 11, 2026):

A signature alone does not mean the body is also recognized for information security. Check the scope of accreditation of your certification body. Using a body from your own country is not required; accreditation by DAkkS, ENAC or any other signatory is recognized just the same.

Common mistakes

• The scope covers only headquarters, while development for the EU customer happens in another office or at a subcontractor.
• The certificate comes from a body that is not accredited. Many EU buyers now check this and reject such papers.
• The Statement of Applicability was copied from a template and does not match your own risk assessment. This shows up immediately in the Stage 2 audit.
• The ISMS exists only on paper: no records, no internal audit, no management review.
• The supply chain is missing. Cloud providers and freelancers belong in supplier management, because that is exactly what your customer asks about under NIS2 and DORA.

For the technical controls on vulnerability management, auditors want to see evidence that you check regularly. An external attack surface check such as veyrisk looks at what is reachable from the internet, such as open services, certificates and DNS or mail configuration, and documents the results in a report.

How Sightadel helps

Sightadel is a GRC platform from neonotu GmbH in Munich. It keeps your risk assessment, Statement of Applicability, policies, evidence and internal audit in one place and up to date for the surveillance audit. If you have little capacity in house, you can add a consulting package in which experienced consultants guide you all the way to the certificate.

FAQ