ISO 27001:2022 Information Security Management
Is ISO 27001 mandatory for your business?
No general rule makes ISO 27001 mandatory for a company. In practice, customers, tenders and supplier questionnaires often ask for it, and then it is required for that deal. If a customer is waiting, you can hold the certificate within 4 hours of passing the online self-assessment and paying.
01: Short answer
Is ISO 27001 mandatory for companies?
ISO 27001 is a voluntary standard. It is published by ISO, it is not a statute, and no authority obliges a company to hold the certificate because it processes customer data.
Legal duties around data protection and information security do exist. They differ by country and by sector, and they ask for appropriate protection rather than for a specific certificate. ISO 27001 is one recognised way to organise that protection. If your sector has special rules, ask your legal adviser what they require.
The more useful question is commercial: will your next customer sign without it?
02: In practice
When ISO 27001 becomes required in practice
The pressure rarely comes from a regulator. It comes from the people who buy from you.
A supplier questionnaire
The purchasing department asks whether you hold ISO 27001. A no usually leads to a much longer list of security questions, or to the end of the review.
A tender
Tender documents list the certificate as a selection criterion or as proof of suitability. Without it, your bid can be scored lower or excluded.
A place in a supply chain
A large customer has its own security obligations and passes them down to its suppliers. The certificate is the shortest proof you meet them.
An industry that expects it
IT service providers, cloud providers, financial firms and healthcare suppliers are asked for ISO 27001 so often that buyers assume it.
A customer audit
A customer announces an audit of your security. A valid certificate gives the auditor a documented starting point and shortens the conversation.
03: Requests
What buyers ask for, and what answers it
Read the request word for word before you decide anything. Buyers use similar phrases for different needs.
| Situation | What the buyer asks | What you hand over |
|---|---|---|
| Supplier questionnaire | Do you hold ISO 27001? | Certificate PDF with the verification link |
| Tender | Proof of an information security management system | Certificate with number and QR code, attached to the bid |
| Customer audit | Evidence of controls and risk assessment | Certificate plus your policy, risk assessment and Statement of Applicability |
| Framework contract renewal | Current certificate, not an old one | Certificate whose public verification page shows it is valid |
Some buyers name a specific type of audit in their documents. If yours does, ask them before you choose a route.
04: The standard
What ISO 27001:2022 asks of your company
The standard describes how an information security management system (ISMS) is built. The risk assessment sits at its core: it decides which Annex A controls you implement and why. The 2022 edition revised those controls and covers cloud services, data protection and cyber risks, among other topics.
- Risk assessment
- You identify which information security risks apply to your business and rate them.
- Policy and objectives
- Management writes down a security policy and sets objectives you can check.
- Annex A controls
- You implement the controls your risk assessment calls for.
- Statement of Applicability
- A document that lists the controls you apply, and why you leave others out.
- Awareness and training
- Employees know the rules and their part in them.
- Incident handling
- Security incidents are recorded, handled and used to improve the system.
05: Customer waiting
How to get ISO 27001 quickly when a customer asks
A request with a deadline calls for a short, ordered path.
Clarify the request
Check whether the buyer wants a certificate or only documented security measures, and by which date.
Take the self-assessment
Answer the 48 yes/no questions about your information security. It is free to start.
Close any gaps
If a question comes back as no, fix that point and answer again.
Send the proof
Attach the certificate PDF to your reply and point the buyer to the verification page.
06: With Zertify
How Zertify issues the ISO 27001 certificate
Zertify certifies on the basis of an online self-assessment. There is no on-site audit. To pass, you answer yes to all 13 mandatory requirements of the standard and to at least 24 of the other 35 questions. G6 Agency AG issues the certificate under licence from SICE, and SICE reviews every assessment before the certificate goes out.
After you pass and pay, the certificate arrives within 4 hours. Every certificate can be checked publicly by its number or by the QR code on the PDF, so a buyer verifies it without calling you. A short online re-audit confirms it each year.
The price is CHF 849 (€849) in the first year, then CHF 569 (€569) per year including the yearly online re-audit. The certificate is valid for 3 years. You can cancel in your customer account at any time to the end of the current year, and the certificate then ends with the paid year. You need no account to buy.
07: FAQ
Questions about ISO 27001 being mandatory
08: Guide
Related pages
A customer is asking for ISO 27001?
Take the self-assessment and find out today whether you pass.
Free and without registration.