ISO/IEC 27001 by industry
ISO/IEC 27001 for BPO and shared services: what client security audits expect of a contact centre or back office
Clause by clause: ISO/IEC 27001:2022 requirements: every clause explained →
What changes when the ISMS belongs to a contact centre, back-office or KPO provider: why clients and RFPs ask, what belongs in scope, where people, floor and access controls are sampled, and how one system absorbs client schedules, PCI DSS and privacy laws.
Key points
- For a contact centre, back-office or KPO provider, ISO/IEC 27001 usually starts as a line in a client RFP or a finding in a client security audit, and it decides whether you stay on the shortlist.
- The scope must follow the client data: production floors, VDI and client-system access, call recordings, the delivery sites that serve each account and any agents working from home.
- People and physical controls carry unusual weight here, because hundreds of agents join, move between accounts and leave every year, and the floor itself is a control.
- One ISMS can absorb client-mandated controls and support PCI DSS for payment calls and the privacy laws of both client and delivery countries, if they are mapped from the start.
Why BPO and shared services clients ask for ISO/IEC 27001
The demand comes from the client side: vendor management offices running the RFP, the client's information security team scoring your questionnaire, and its internal or external auditors, who must show their own regulators how outsourced processes are overseen. An accredited certificate gives all three a common reference.
The pressure is sharper for providers serving banks, insurers and healthcare payers, whose supervisors expect outsourced work to be controlled. In-house shared services centres hear the same question from group audit.
What makes this sector different is repetition. Each client arrives with its own security schedule, audit rights and annual on-site visit. A certified ISMS turns each visit into a check against a system that already exists, not a scramble for evidence. The standard itself is explained in the ISO/IEC 27001 requirements guide.
What belongs in scope for a BPO or shared services centre
Scope starts with the services you sell and the client data each one touches: inbound and outbound voice, chat and e-mail support, claims or transaction processing, finance and accounting, research and analytics. It covers the delivery sites and floors that serve them, the workforce management and dialler platforms, call recording and quality monitoring tools, the VDI or remote-access path into client systems, and the recruitment, training and IT support functions behind the agents.
Client-owned platforms sit outside your control but inside your responsibility: you decide who gets credentials, from which device, and how fast they are removed. Home-based agents are in scope wherever they touch client data.
Three scope mistakes recur. Certifying one flagship site while the RFP covers every delivery centre. Naming only the IT department, which leaves operations, HR and workforce management outside the system that depends on them. And forgetting the recording archive and reporting extracts, often the largest store of client data in the business. The general rules are in ISO/IEC 27001 scope: boundaries, interfaces and the mistakes that cost you.
Where the Annex A controls bite for BPO operations
| Annex A theme or area | What it means on a BPO floor | Evidence the auditor samples |
|---|---|---|
| A.6 People controls: screening, terms of employment, awareness, leavers, confidentiality agreements | High-volume hiring and attrition, agents moving between accounts, client-specific confidentiality undertakings | Background-check records against the policy, signed NDAs and client undertakings, account-specific induction and refresher records, leaver checklists with access and asset return dates |
| A.7 Physical controls: secure areas, clear desk and clear screen | Clean-room production floors where phones, bags and paper stay outside, badge-controlled zones per client account | Entry logs and badge reviews, locker and clean-desk inspection records, CCTV retention against policy, visitor registers for client audits |
| A.5 Organisational controls: access, supplier and cloud security | Credentials for client systems, VDI pools per account, and the telephony, recruitment and hosting suppliers the service depends on | Joiner, mover and leaver tickets matched to client-system accounts, periodic access reviews signed by account managers, supplier security assessments and contract clauses |
| A.6 People controls: remote working | Home-based agents handling client data outside the floor | Remote-working agreements, device and network requirements, evidence that printing, local storage and screen capture are restricted |
| A.8 Technological controls: endpoints, logging, data masking and leakage prevention | Thin clients or locked-down desktops, masked fields in client screens, blocked removable media, monitored uploads | Endpoint baselines, leakage prevention alerts and their handling, masking settings, log reviews |
The full set of 93 controls is covered in Annex A: the 93 controls by theme, explained, and the Statement of Applicability that records your choices in The Statement of Applicability: how to write one that survives the audit.
Working alongside client-mandated controls, PCI DSS and privacy laws
Most master service agreements carry a security schedule: data handling, audit rights, incident notification windows and sometimes named controls. Treat each schedule as a set of requirements from an interested party, log it in the ISMS and map it to the controls in your Statement of Applicability.
Payment calls bring the cardholder data environment into play. ISO/IEC 27001 does not replace PCI DSS, but the same risk assessment, access reviews and floor controls feed it. See PCI DSS compliance.
Privacy obligations come from two directions: the law where the client and its customers sit, and the law where your delivery centre operates. For European clients that means the GDPR; for delivery from the Philippines, the Data Privacy Act of 2012. Extending the ISMS with ISO/IEC 27701 gives one system for both; see Integrating ISO/IEC 27001 with ISO/IEC 27701 and ISO 22301: one management system.
What a BPO engagement looks like
Duration depends on the delivery sites and client accounts in scope, how consistent floor controls are between them, and whether client-system access is centrally recorded. Operations heads and account managers take part alongside IT, HR, facilities and workforce management. With Design™, Sterling guides your team to run the ISMS itself; with Drive™, Sterling carries more of the documentation, evidence and readiness work so operations keep hitting their service levels.
How Sterling works with BPO and shared services providers
One ISMS that answers every client audit.
Our expert and experienced consultants map each client's security schedule to your controls, test floor, access and onboarding evidence the way an auditor will, carry out the vulnerability assessment and keep the records in Effivity, included with the engagement, at no additional cost. Sterling does not certify; an independent, accredited certification body audits and decides. We ensure successful certification for our clients.
Book a free discovery callISO/IEC 27001 for BPO: questions buyers ask
Will ISO/IEC 27001 certification stop clients auditing our BPO?
No, most contracts keep a right to audit. What changes is the audit itself: clients sample an operating ISMS and its records.
Do all our delivery sites need to be in the certificate scope?
Every site that serves the clients relying on the certificate should be. A single-site certificate offered against a multi-site contract is a common reason for a failed vendor review.
Can work-from-home agents be covered by ISO/IEC 27001?
Yes, if remote working is treated as a risk with its own controls: approved devices, secure connection to the VDI, restrictions on printing and local storage, and evidence that those restrictions are checked.
Our clients each send their own security requirements. Do we need a separate system for each account?
No. Record each client's requirements in one ISMS, apply common controls across the floor and add account-specific ones only where a contract demands them.
ISO/IEC 27001 by industry
Every guide in the ISO/IEC 27001 series is written for one question and links back to the hub for the whole picture.
- ISO/IEC 27001 certification in Australia
- ISO/IEC 27001 for banking, fintech and financial services
- ISO/IEC 27001 benefits
- ISO/IEC 27001 for BPO and shared services
- ISO 27001 case study
- ISO/IEC 27001 certification process, step by step
- ISO/IEC 27001 checklist
- ISO/IEC 27001 for government suppliers and public bodies
- ISO/IEC 27001 for healthcare and health-data processors
- ISO/IEC 27001 for professional and legal services
- ISO/IEC 27001 for software, SaaS and technology
- ISO/IEC 27001 for telecommunications and data centres
Keep exploring
Explore more about ISO/IEC 27001
Watch a video on how to implement ISO 27001 here.
Watch a video on ISO 27001 requirements here.
ISO/IEC 27001 resources
Services for ISO/IEC 27001
Talk to a consultant
Plan an ISMS that stands up to every client security audit.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice