Do you need ISO/IEC 27001? A decision guide for boards, security leads and the people answering the questionnaires

The short answer: voluntary, until someone makes it a condition

No law obliges every organisation to hold ISO/IEC 27001 certification. Adopting the standard is one choice; having an accredited certification body audit your information security management system (ISMS) is another. Either becomes an obligation only when someone whose approval you need writes it down: a customer in a contract, a public buyer in tender criteria, a regulator in the rules for your sector, or a parent company in group policy. Usually the certificate is expected rather than required, so start with the questionnaires, tenders and contract clauses of the past year. Who asked, in what words, and by when?

Who asks for ISO/IEC 27001, and how binding each request is

Every request is mandatory (a written condition nothing else satisfies), expected (favoured in reviews and scoring; work can be won without it, more slowly) or optional (nobody asks; the value is internal).

Read the wording closely. "Certified" means a current certificate from a certification body accredited by an accreditation body recognised through the Global ACI arrangement, covering the service concerned; "compliant with", "aligned to" or "or equivalent" leave room for other evidence, so ask the buyer in writing what it will accept.

Regulation seldom names the certificate. The EU's NIS2 Directive, for instance, refers to European and international standards and asks Member States to encourage their use, without requiring ISO/IEC 27001 certification. National practice varies: Belgium's Centre for Cybersecurity recognises ISO/IEC 27001 certification as one pathway for essential entities.

What a certificate changes for the people answering questionnaires

For whoever completes security questionnaires, a certificate changes how each review opens: you attach it, state its scope and, where asked, share the Statement of Applicability under a non-disclosure agreement. Reviewers then concentrate on questions about their own data.

Those questions remain: data location, subcontractors, incident notification times, backup retention. The certificate shows they are managed; it does not answer them. Keep one library of approved answers tied to the ISMS records, and check the scope: a certificate that excludes the delivery centre holding the customer's data leaves the questions open.

Alternatives and complements: when something else answers the request

• A SOC 2 report. An attestation from a licensed CPA firm, not a certificate, and the document many US enterprise buyers name. If your pipeline is mainly North American, read ISO/IEC 27001 vs SOC 2: which one, or both? first.
• Cyber Essentials. The UK government-backed baseline of five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. Certificates last twelve months, and the Plus level adds independent testing of your systems. Under PPN 014, UK central government and NHS buyers require it, or evidence of equivalent controls, from suppliers handling citizens' personal information or OFFICIAL-level data. It complements ISO/IEC 27001 rather than replacing it.
• A customer's own audit. A strategic customer may exercise a right to audit with its own checklist: cheaper than certification for one customer, costlier once several ask.
• Building to the standard without certifying. A sound first phase, but "aligned with ISO/IEC 27001" tells an outside reader that nobody independent has checked, and it never meets a certification requirement.

The decision table: situation, recommendation and why

Find the row closest to your position; where two apply, the firmer obligation wins.

Five questions to settle before you commit

1. What exactly was asked? Certified or compliant, for which service, whether an equivalent is accepted, and by when.
2. What must the certificate cover? The services, sites, cloud platforms and teams behind the request; ISO/IEC 27001 scope: boundaries, interfaces and the mistakes that cost you shows how to draw it.
3. Who owns the budget, and who owns the ISMS? Fund it from the side that gains, often the commercial one; appoint an ISMS lead with the time and authority to run it; keep leadership visibly in charge, as the standard requires. ISO/IEC 27001 certification cost: what moves the price explains the drivers.
4. How mature are your controls? If access management, logging, backups or supplier controls must be built first, the project becomes partly remediation. The free readiness check gives a first view; the gap analysis measures it.
5. Does the timing work against the contract date? A single-site organisation with a capable IT function typically needs four to eight months to the certification decision. Count back from the date; ISO/IEC 27001 timeline: how long certification takes, stage by stage shows where the months go.

When not to start yet

• Nothing external is driving it, and the basics are missing. Put multi-factor authentication, tested backups, patching and access reviews in place first, so the ISMS governs controls rather than absences.
• A major change is weeks away. A cloud migration, acquisition or restructuring redraws scope and risks mid-project; start once it settles, or scope around it deliberately.
• Nobody can own it. Without a leadership sponsor and an ISMS lead with time, projects stall once the policies are written.
• The date can only be met by a shortcut. A certificate issued in days, without Stage 1 and Stage 2 audits by an accredited body, will not survive the first customer who checks it; see How to verify an ISO/IEC 27001 certificate, and spot a fake one.

Deciding on ISO/IEC 27001: questions buyers ask