ISO 27001: What it is, what certification requires, and whether your organization needs it

ISO 27001 is the international standard for information security management systems. It is the most widely recognized security certification globally, accepted by enterprise clients, regulators, and insurers as evidence of a systematic, audited approach to managing information security risk.

According to the 2026 Kaseya State of the MSP Report, regulatory compliance and reporting ranks among the top ten service needs for MSP clients in 2026, and ISO 27001 is the certification most commonly required by enterprise procurement teams. Download the full report.

For IT teams and MSPs, ISO 27001 matters on two fronts: as an internal security standard worth pursuing, and as a requirement that enterprise clients increasingly impose on their service providers. Understanding what the standard requires, and whether formal certification is genuinely necessary or whether alignment without it delivers equivalent value, is where every good decision starts. Kaseya’s compliance tools support ISO 27001 gap assessment and evidence collection for organizations at every stage of that decision.

What is ISO 27001?

ISO/IEC 27001 is an international standard published jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). It specifies the requirements for establishing, implementing, maintaining, and continually improving an information security management system (ISMS), a structured framework for identifying and managing information security risks across an organization.

ISO 27001 is not a checklist of specific security controls. It is a management system standard. The standard requires an organization to have a documented risk management process, implement controls appropriate to the risks it has identified, measure the performance of its ISMS, and continuously improve it. Certification is issued by an accredited third-party certification body after a formal audit.

ISO 27001:2022 is the current version, released in October 2022. The October 2025 deadline for organizations to transition from ISO 27001:2013 has now passed. Any valid ISO 27001 certificate should reference the 2022 version. Organizations still citing the 2013 standard should be treated with caution by enterprise procurement teams, as those certifications are no longer considered valid.

Adoption has grown sharply. According to the ISO Survey 2024, the number of valid ISO 27001 certificates globally reached nearly 97,000, up substantially from prior years as organizations across financial services, technology, and healthcare increasingly treat certification as a baseline security expectation.

ISO 27001 vs ISO 27002

These two standards work together and are frequently confused.

ISO 27001 specifies the requirements of an ISMS and what the management system must include to qualify for certification. It is the standard organizations are certified against.

ISO 27002 provides guidance on how to implement the information security controls listed in ISO 27001’s Annex A. It is a reference document, not a certifiable standard. Organizations are certified to ISO 27001, using ISO 27002 as implementation guidance.

Think of ISO 27001 as the specification (what you must have) and ISO 27002 as the implementation guide (how to build it). Passing an ISO 27001 audit does not require implementing ISO 27002 directly, but the guidance is practically useful for any organization working through control implementation for the first time.

What ISO 27001 certification requires

The certification requirements are organized into clauses 4 through 10. Each must be addressed for certification.

Clause 4, Context of the organization: Define the scope of the ISMS. Identify the internal and external issues that affect it, the interested parties with requirements around information security, and what information assets fall within scope.

Clause 5, Leadership: Senior management must demonstrate active commitment to the ISMS. This means endorsing a documented information security policy, assigning roles and responsibilities, and ensuring the program has adequate resources.

Clause 6, Planning: Conduct a formal information security risk assessment. Identify risks to information assets, evaluate their likelihood and potential impact, and produce a risk treatment plan documenting how each risk will be handled, whether accepted, mitigated, transferred, or avoided.

Clause 7, Support: Confirm the ISMS has the resources it needs, that personnel have appropriate competence, that awareness of security responsibilities is actively maintained, and that documentation is controlled properly.

Clause 8, Operation: Implement the risk treatment plan. This is where the Annex A controls are deployed and where the operational security activities described in the plan are actually carried out.

Clause 9, Performance evaluation: Monitor and measure ISMS performance against defined objectives. Conduct internal audits. Management must review the ISMS at planned intervals.

Clause 10, Improvement: Address any nonconformities that arise, take corrective action, and continuously improve the ISMS over time.

The certification audit itself has two stages. Stage 1 is a documentation review: does the ISMS exist, and is it adequately designed? Stage 2 assesses implementation: is the ISMS actually operating as designed? After initial certification, surveillance audits occur annually, with a full recertification audit at the three-year mark.

For organizations starting from a low baseline, the full journey from gap assessment to certified ISMS typically takes six to eighteen months and requires meaningful investment in professional services, internal resource time, and tooling.

Annex A controls: the 93 security measures

ISO 27001:2022’s Annex A contains 93 controls organized into four themes.

Organizational controls (37): Policies, roles and responsibilities, threat intelligence, information security in project management, supplier relationships, incident management procedures, and business continuity planning.

People controls (8): Pre-employment screening, employment terms related to information security, security education and awareness, disciplinary processes, and remote working policies.

Physical controls (14): Physical security perimeters, equipment security, clear desk and clear screen policies, and secure equipment disposal.

Technological controls (34): Access control, authentication mechanisms, cryptographic key management, secure development practices, vulnerability management, network security monitoring, backup and recovery, logging, and encryption.

Not all 93 controls are mandatory for every organization. The Statement of Applicability (SoA) is a required document in which the organization records which controls apply to its scope and risk profile, and justifies any exclusions. Controls are excluded when they genuinely do not apply to the organization’s operations, not to reduce compliance effort. An auditor will scrutinize exclusions closely.

Certification vs. alignment: when is formal certification worth it?

ISO 27001 certification is a significant investment. The full process, covering gap analysis, ISMS development, internal auditing, stage 1 and stage 2 certification audits, and ongoing surveillance, typically demands six to eighteen months of effort and real budget.

Formal certification is clearly worth pursuing when:

• Enterprise clients require it. Large organizations in financial services, healthcare, and government are increasingly making ISO 27001 certification a vendor qualification criterion. If key clients or target prospects require it, the commercial case is straightforward. Losing a contract or being filtered out of a procurement process before a conversation even starts is a real risk for uncertified providers.
• Regulatory alignment demands it. Certain sector-specific regulations in the EU and UK reference ISO 27001 as an acceptable compliance mechanism. For organizations subject to those regimes, certification may be the clearest path to demonstrating compliance.
• Market differentiation justifies it. In competitive markets where enterprise clients are evaluating multiple providers, ISO 27001 certification signals security maturity that many competitors lack.

Alignment without formal certification may be sufficient when:

• The primary driver is internal security improvement. Implementing the ISMS structure, completing a risk assessment, and deploying appropriate controls delivers most of the security benefit without requiring the certification audit.
• The organization is working toward certification but is not ready yet. Building the ISMS progressively toward a certification audit is a legitimate strategy, particularly for smaller organizations or those with limited internal compliance resource.

A practical example: an MSP managing 200 client endpoints that is competing for a mid-market financial services contract will almost certainly find ISO 27001 certification on the vendor qualification checklist. The same MSP serving SMB clients across general IT support may find that demonstrating alignment, with documented policies and a completed risk assessment, satisfies what clients actually ask for.

ISO 27001 for MSPs

ISO 27001 is particularly relevant for MSPs, for two distinct reasons.

MSPs as a supply chain risk. Enterprise clients have learned from high-profile supply chain incidents that MSPs represent a meaningful attack surface into their environments. ISO 27001 certification is the recognized evidence that an MSP has a systematic, audited security program. MSPs pursuing enterprise contracts, or retaining existing enterprise clients as procurement processes mature, will increasingly find certification a de facto requirement.

The 2025 ISMS.online State of Information Security survey found that most organizations have experienced at least one third-party or vendor-related security incident in the prior year. Procurement teams have noticed. MSPs without structured security programs are being filtered out of conversations before a sales team ever gets involved.

MSPs delivering compliance services to clients. MSPs that help clients achieve ISO 27001 alignment or certification need to understand the standard well enough to conduct gap assessments, guide control implementation, and prepare clients for audits. This is a growing service category. Mid-market companies are one of the fastest-growing segments seeking ISO 27001 certification, and many of them lack the internal expertise to do it themselves.

Compliance Manager GRC supports ISO 27001/2 assessment within its framework library, allowing MSPs to manage client ISO 27001 gap assessments, control mapping, and evidence collection from a centralized platform. An MSP running multiple clients through ISO 27001 preparation simultaneously benefits significantly from a structured tool over ad hoc spreadsheets and shared drives.

How ISO 27001 relates to other frameworks

One of ISO 27001’s practical advantages is its alignment with other major frameworks. Implementation effort compounds: an organization that builds a solid ISMS for ISO 27001 will have addressed significant portions of several other compliance obligations at the same time.

NIST CSF. Strong alignment. Both are risk-based approaches focused on managing information security systematically. An ISO 27001-certified organization will find most NIST CSF requirements already addressed by its ISMS. The NIST framework does not certify, but it is widely referenced, particularly by organizations with US government contracts or customers.

SOC 2. Substantial overlap in control areas, particularly around access control, logging, change management, and availability. The audit methodology and report format differ significantly, but ISO 27001 certification accelerates SOC 2 readiness in a meaningful way. Organizations frequently pursue both.

GDPR. ISO 27001 addresses many of GDPR’s technical and organizational security requirements. An ISO 27001 ISMS provides solid evidence for the Article 32 obligation to implement appropriate security measures. GDPR’s privacy-specific requirements go further, covering data subject rights, lawful basis, and data protection impact assessments, but the ISMS provides the security foundation.

CIS Controls. ISO 27001’s Annex A controls map extensively to the CIS Controls. Organizations that have implemented CIS Controls IG2 or IG3 will have addressed a significant share of Annex A requirements and should find a certification audit more manageable as a result.

NIS2. NIS2’s Article 21 security measures align closely with ISO 27001’s ISMS approach. ISO 27001 certification is not equivalent to NIS2 compliance, but it provides a credible foundation and satisfies much of what regulators are looking for in terms of documented, systematic security management.

For a broader comparison of ISO 27001 alongside SOC 2, NIST, and PCI DSS, see Top compliance standards and the differences between them.

Explore how Compliance Manager GRC supports ISO 27001 assessment and compliance management.