ISO 27001:2022 for IT companies
ISO 27001 for IT companies: certified online
If you run a software house, an IT service firm or a managed hosting business, your customers will sooner or later ask for ISO 27001. Zertify issues the certificate after an online self-assessment of 48 yes/no questions. No on-site audit is needed, and you receive the PDF within 4 hours after passing and payment.
01: Demand
Why do customers and tenders ask IT companies for ISO 27001?
An IT company holds things that belong to others: customer data, access credentials, source code, sometimes the production systems of the client itself. The purchasing department of a client cannot inspect your setup. So it sends a supplier questionnaire, and one of the first questions is whether you hold an ISO 27001 certificate.
Tenders for software, hosting or support contracts work the same way. Information security appears as a requirement or an evaluation criterion, and a certificate is the shortest proof. Without one, you fill in the same fifty questions by hand for every quote.
Partners ask as well. A platform vendor or a reseller wants to know that a weakness in your systems does not become theirs. A certificate with a public verification page lets them check it themselves instead of taking your word for it.
02: Risks
Which risks of an IT company does ISO 27001 address?
The standard starts with a risk assessment (clause 6, Planning). You list your assets, the threats to them and how likely each one is. The result decides which Annex A controls you apply and why. In an IT company, the risks usually look like this:
- Source code and repositories
- A developer leaves the company but keeps access to every repository, or an access token ends up in a public commit. Relevant controls cover access rights, offboarding and the handling of secrets.
- Customer data in the cloud
- A misconfigured storage bucket exposes client files. The 2022 edition added controls for the use of cloud services, configuration and monitoring.
- Privileged access
- One shared admin password opens the environments of several customers. Individual accounts, multi-factor authentication and logging reduce this risk.
- Build and deployment pipeline
- An unreviewed change reaches production on a Friday evening. Change management and code review are the answer.
- Support tickets and mailboxes
- A screenshot with personal data sits in the ticket tool for years. Retention rules and data handling controls apply here.
- Subcontractors
- A hosting provider, a freelancer or a SaaS tool processes data on your behalf. You assess these suppliers and agree security terms with them.
03: Requirements
How does an IT company meet the key requirements in practice?
Management has to own the system (clause 5, Leadership). In a small company that means the owner or the CTO approves the policy and reviews the results once a year (clause 9, Performance evaluation).
| Requirement | Example in an IT company |
|---|---|
| Assess information security risks | A risk register per service, updated when you add a product or change the hosting provider. |
| Security policy and objectives | A short policy signed by management, with an objective such as patching critical vulnerabilities within a defined period. |
| Security controls (Annex A) | Multi-factor authentication on all admin accounts, code review before merge, encrypted backups that are tested by restoring them. |
| Statement of Applicability (SoA) | A list of all controls with status and reason. Physical controls for a server room are excluded because hosting is outsourced. |
| Awareness and training | An onboarding session for new hires and a yearly refresher for developers and support staff, including phishing examples. |
| Incident management | An incident ticket template and a review after each case, for example a leaked API key, ending with a concrete change to the process. |
04: Scope
How do you define the scope of the ISMS for a software or service company?
The scope states which services, teams and locations the management system covers. In a company of up to a few dozen people, the simplest choice is the whole company. A narrower scope makes sense only if it matches what your customers actually ask about.
Start from the supplier questionnaires you already receive. If they all concern your hosted product, the product, its operations team and its suppliers must be inside the scope. Then write the Statement of Applicability: go through the Annex A controls one by one, mark each as applied or excluded, and give a reason.
Check the wording of the tender or contract before you decide on a route. If it prescribes an on-site audit by a certification body, you need the classic route. If it asks for an ISO 27001 certificate without saying more, an online certificate is usually what the buyer wants to see.
05: With Zertify
How do you get ISO 27001 certified quickly with Zertify?
The self-assessment contains 48 yes/no questions on ISO 27001:2022. Thirteen of them are mandatory requirements of the standard and must all be answered yes. Of the other 35 questions, at least 24 need a yes. The certificate is issued by G6 Agency AG under licence from SICE, and SICE reviews every assessment before the certificate is issued.
Answer the questions
The self-assessment is free and needs no registration. Where an answer is no, you see what is still missing in your ISMS.
Pass and pay
Once you have passed, you pay by card or invoice. No account is needed to buy.
Receive the certificate
The PDF arrives within 4 hours. A certificate number and a QR code on the PDF lead to a public verification page, so a customer can check it in seconds.
Confirm it every year
A short online re-audit keeps the certificate valid. The certificate runs for 3 years.
The price is CHF 849 (€849) in the first year, then CHF 569 (€569) per year including the yearly online re-audit. Prices include 8.1% Swiss VAT for customers in Switzerland and Liechtenstein. The subscription renews each year and can be cancelled at any time in your customer account, to the end of the current year. If you cancel, the certificate ends with the paid year.
IT companies often add ISO 27017 for cloud services or ISO 27018 for personal data in the cloud. Two standards earn a 20% discount, three or more 30%, also on the yearly fee.
06: FAQ
Questions about ISO 27001 for IT companies
07: Guide
Related pages
Find out in one sitting whether your company passes
Answer 48 yes/no questions about your information security and see where your ISMS stands.
Free and without registration.