hello@sterling-grc.com +1 201 263 4443 New York ISO & GRC consulting in 60+ countries
Contact Sterling Academy login
SterlingInternational Consulting Talk to a consultantTalk to us
← All videos

Integrated programme

ISO/IEC 27001 and PCI DSS together: one control set, two outcomes: video

A film on building one control set for ISO/IEC 27001 certification and PCI DSS validation, for payment processors, fintechs and BPOs handling card data.

  • Integrated programme
  • 3 min 24 s

Key takeaways

  • ISO/IEC 27001 certification does not by itself make you PCI DSS compliant.
  • One control set can be mapped to both frameworks.
  • Design segmentation early to keep the cardholder data environment small.
  • The same logs, tickets and reviews serve the certification body and the assessor.
  • Plan surveillance audits and PCI DSS assessments on one calendar.

A management system and a card data standard

Payment processors, fintechs and the BPOs that handle card data for overseas clients are often asked for both. ISO/IEC 27001 provides the information security management system and, through an accredited certification body, the certificate. PCI DSS sets specific requirements for the cardholder data environment, validated every year by a Qualified Security Assessor or through the self-assessment questionnaire the acquirer accepts.

The two overlap heavily, but neither replaces the other: ISO/IEC 27001 certification does not make an organisation PCI DSS compliant, because PCI DSS has its own technical requirements and validation. A strong ISO/IEC 27001 system makes PCI DSS much easier, and the reverse. This short film walks through how one programme delivers both outcomes.

Segmentation decisions made early in the programme largely decide how much of the environment the annual PCI DSS assessment will have to cover.

One control set, a smaller scope, one calendar

The programme writes access, logging, change, vulnerability and supplier controls once and maps them to both frameworks. Segmentation is designed early so that PCI DSS applies to as little of the environment as possible, which shrinks everything that follows. Whether a Report on Compliance from a QSA or a self-assessment questionnaire applies depends on the merchant or service provider level set by the card brands and the acquirer, and that is confirmed before the plan is fixed.

Evidence is then collected once: the same logs, tickets and reviews serve the certification body and the assessor. Surveillance audits and the annual PCI DSS assessment are planned on one calendar, so engineers are not preparing for separate events every few months. One audit cannot formally cover both, because each outcome comes from a different independent party under its own rules, but one evidence base can serve both.

Delivery runs on Sterling OS™: a single engagement team, the control set and evidence held in Effivity, and one all-inclusive proposal rather than a project for each framework. The certificate is issued by the certification body and PCI DSS is assessed by the QSA; Sterling prepares for both.

ISO/IEC 27001 at a glance

Purpose
Information security management: protecting the confidentiality, integrity and availability of information through assessed risks and chosen controls
Relevant to
Any organisation holding client, personal or business-critical information, from technology and BPO to financial services, healthcare and public-sector suppliers
Edition
ISO/IEC 27001:2022 with Amendment 1:2024; 2013-edition certificates lapsed on 31 October 2025
Certification
Assessed and decided by an independent certification body accredited to ISO/IEC 17021-1 and ISO/IEC 27006-1
Sterling's role
Consulting with your team, Effivity, training, vulnerability assessment, internal audit and certification readiness, then Sustain™
Cost and timing
Total investment for an ISO/IEC 27001 ISMS depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 4 to 8 months

ISO/IEC 27001: the complete guide →

ISO/IEC 27001: questions people ask

Is ISO/IEC 27001 only for IT companies?

No. It applies to any organisation that holds information worth protecting, which is every organisation with clients, employees or a bank account. IT firms, BPOs and financial services feel the demand first because their clients ask; law firms, healthcare providers and public bodies certify for the same reasons.

What is the difference between ISO/IEC 27001 and SOC 2?

ISO/IEC 27001 is an international management system standard; an accredited certification body audits it and issues a certificate with a defined scope. SOC 2 is an attestation report on a service organisation's controls against the AICPA Trust Services Criteria, issued by a CPA firm and expected mainly by US clients. They overlap heavily in the controls examined, so one evidence base can serve both, but neither replaces the other; ask your clients which they accept.

How many controls does ISO/IEC 27001 have, and do we need all of them?

Annex A of the 2022 edition lists 93 reference controls in four themes: 37 organisational, 8 people, 14 physical and 34 technological. You are not required to implement every one. You must select controls from your risk treatment, compare the selection with Annex A so nothing necessary is missed, and record in the Statement of Applicability which controls apply, why, and whether they are implemented, with a justification for any you exclude.

Do we need a penetration test to get certified?

The standard requires you to manage technical vulnerabilities and assess risks; it does not prescribe a particular test. A vulnerability assessment is included in a Sterling ISMS engagement, and its findings feed the treatment plan. Whether a deeper penetration test is warranted depends on your risks, your clients' contracts and your regulator.

Does Sterling issue the ISO/IEC 27001 certificate?

No. Sterling consults, trains and prepares. An independent certification body accredited to ISO/IEC 17021-1 and ISO/IEC 27006-1 audits the ISMS in two stages and decides. A provider offering consulting and the certificate on one invoice is selling paper.

More ISO/IEC 27001 questions and answers →

Keep exploring

Related to this video

Read next

Services

Next steps

The complete guide

Everything on ISO/IEC 27001

Start with the ISO/IEC 27001 page · PCI DSS, or go straight to the guide you need.

On the ISO/IEC 27001 page

Guides

By country

By industry

Often combined with ISO/IEC 27001

More videos: Integrated programmes

All videos

Talk to a consultant

Plan your ISO/IEC 27001 certification with confidence.

Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.

hello@sterling-grc.com

+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page

What would you like to achieve?

Choose a starting point. The enquiry form takes about a minute.

Your goal
Book my free discovery call

Continue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice