ISO/IEC 27001 by industry
ISO/IEC 27001 for software, SaaS and technology: an ISMS built around your platform, pipeline and cloud
Clause by clause: ISO/IEC 27001:2022 requirements: every clause explained →
What changes when the organisation seeking ISO/IEC 27001 is a SaaS, software, platform or data company: why European and UK buyers ask, what the scope must cover, the Annex A themes auditors sample, and where ISO/IEC 27017, 27018 and 27701 fit.
Key points
- European and UK enterprise buyers of software usually ask for an ISO/IEC 27001 certificate rather than a SOC 2 report, and they read the scope statement on it before anything else.
- For a multi-tenant platform, the risk assessment has to deal with tenant separation, the cloud shared-responsibility split and the release pipeline, not office IT.
- The Annex A controls that carry the audit are secure development, configuration, logging and monitoring, data leakage prevention, backup and cloud supplier security.
- ISO/IEC 27017, ISO/IEC 27018 and ISO/IEC 27701 can be added to the same ISMS, which is how cloud and data companies answer privacy clauses in customer contracts.
Why software and SaaS companies are asked for ISO/IEC 27001
The trigger is usually a deal. A bank, insurer, public body or large manufacturer in Europe or the UK adds a supplier-assurance step, and its information security team asks for a certificate, the certification body's name and the scope wording. For those buyers an accredited certificate is the familiar proof; a SOC 2 report is often read only as a supplement.
Three buyer groups drive most requests: enterprise customers onboarding a new platform, resellers and system integrators who carry your product into their own contracts, and data customers whose data processing agreements require certified security. If your pipeline is mostly North American, the SOC 2 route may come first; the SOC 2 for SaaS and technology page covers that path, and ISO/IEC 27001 vs SOC 2: which one, or both? helps you choose.
What an ISO/IEC 27001 scope covers for a SaaS company
The scope statement should read the way a customer's security reviewer thinks: the named product or platform, the production environments and cloud regions that serve customers, the engineering and operations teams that build and run it, and the offices or remote working arrangements those teams use.
Three mistakes recur. Certifying only the head office and corporate IT while the platform sits outside, which leaves the certificate useless in procurement. Treating the cloud provider as if its certificate covers you: it covers the provider's layer, while your account configuration, identities, encryption keys and tenant data remain yours to control and evidence. And forgetting the data you hold outside production, such as customer extracts in analytics tools, support tickets and test environments seeded with live records. The general boundary rules are in ISO/IEC 27001 scope: boundaries, interfaces and the mistakes that cost you.
Where Annex A carries the weight for software and SaaS
For a platform business, these are the themes where the certification body's auditor usually spends the most time.
| Annex A theme and control area | What it means in a SaaS or software company | Evidence the auditor samples |
|---|---|---|
| A.5 Organisational: supplier and cloud services security | Choosing, contracting and monitoring the hosting provider, managed services and third-party APIs, with the shared-responsibility split written down | Supplier register with risk ratings, reviewed provider certificates and reports, contract security clauses, a responsibility matrix per cloud service |
| A.8 Technological: secure development | Security built into the SDLC: requirements, coding standards, code review, testing and the separation of development, test and production | Secure coding guideline, pull requests with review, results of static and dependency scanning, test data rules, release approvals |
| A.8 Technological: configuration and vulnerabilities | Hardened baselines held as infrastructure as code, drift detection and patching of images, libraries and containers | Baseline templates in the repository, drift reports, vulnerability scans with remediation dates, exceptions accepted by the risk owner |
| A.8 Technological: logging, monitoring and data leakage prevention | Recording privileged and tenant-level activity, alerting on misuse, and stopping customer data leaving through exports, logs or support tools | Log retention settings, alert rules and responses, masking of customer data in non-production, export and sharing restrictions |
| A.8 Technological: backup | Backups of customer data and configuration that can be restored per tenant within the recovery times promised to customers | Backup policy, job success reports, restore tests with timings, backup encryption and separation |
The full control set is explained in Annex A: the 93 controls by theme, explained.
ISO/IEC 27017, ISO/IEC 27018 and ISO/IEC 27701 alongside the ISMS
Cloud and data companies are often asked for more than the base certificate. ISO/IEC 27017 adds cloud-specific guidance for providers and customers, including how responsibilities are divided; it is assessed within the ISO/IEC 27001 certification rather than certified on its own. ISO/IEC 27018 adds controls for a public cloud processing personal data for its customers, covering purpose, data location, sub-processors and deletion, and it too sits inside the ISMS.
ISO/IEC 27701 governs privacy information management as a controller, a processor or both. Since the 2025 edition it is a standalone management system standard that aligns with an existing ISO/IEC 27001 system, so a SaaS company can extend one risk method, one audit programme and one management review rather than run a second system. See Integrating ISO/IEC 27001 with ISO/IEC 27701 and ISO 22301: one management system.
What an ISO/IEC 27001 engagement looks like for a SaaS company
The pace depends on how much of the platform is already defined in code, whether access to production runs through a single identity provider, how many products and regions the scope takes in, and the date a customer needs the certificate. The CTO or head of engineering, the platform or DevOps lead, the owner of customer contracts and a leadership sponsor must be involved. With Design™, Sterling guides your engineers to own the ISMS; with Drive™, Sterling carries more of the documentation, evidence and internal audit so releases keep moving.
How Sterling works with software, SaaS and technology companies
An ISMS that takes its evidence from your repositories and cloud accounts.
Our expert and experienced consultants tie the risk assessment and Statement of Applicability to your architecture, run the vulnerability assessment, audit the ISMS before the certification body does and keep the records in Effivity, included with the engagement, at no additional cost. Sterling does not certify; an independent, accredited certification body audits and decides. We ensure successful certification for our clients.
Book a free discovery callISO/IEC 27001 for software and SaaS: questions buyers ask
Does our ISO/IEC 27001 certificate need to cover every product we sell?
No, but it should cover every product your customers rely on for their data. A buyer checks whether the product they are purchasing appears in the certificate scope, so a missing product usually means a follow-up questionnaire or a lost deal.
Can a fully remote SaaS company get ISO/IEC 27001 certified?
Yes. Physical controls still apply to home working, devices and any shared spaces, and you justify in the Statement of Applicability why data-centre controls rest with your cloud provider.
How do we show customer data segregation to an ISO/IEC 27001 auditor?
Show it with design and test evidence together: the tenant isolation model in the architecture, access rules that enforce it, tests that attempt cross-tenant access, and logs proving the controls ran during the period.
Do SaaS companies need ISO/IEC 27017 and ISO/IEC 27018 as well as ISO/IEC 27001?
Only when customers or contracts ask for them. Both are assessed within the ISO/IEC 27001 certification, so adding them later extends the existing ISMS rather than starting a new project.
ISO/IEC 27001 by industry
Every guide in the ISO/IEC 27001 series is written for one question and links back to the hub for the whole picture.
- ISO/IEC 27001 for banking, fintech and financial services
- ISO/IEC 27001 for BPO and shared services
- ISO/IEC 27001 for government suppliers and public bodies
- ISO/IEC 27001 for healthcare and health-data processors
- ISO/IEC 27001 for professional and legal services
- ISO/IEC 27001 scope
- ISO 27001 certification in Singapore and South East Asia
- ISO/IEC 27001 for small businesses and start-ups
- ISO/IEC 27001 for software, SaaS and technology
- ISO/IEC 27001 Stage 1 and Stage 2 audits
- The ISO/IEC 27001 Statement of Applicability
- Supplier security review
- ISO/IEC 27001 for telecommunications and data centres
Keep exploring
Explore more about ISO/IEC 27001
Watch a video on how to implement ISO 27001 here.
Watch a video on ISO 27001 requirements here.
ISO/IEC 27001 resources
Services for ISO/IEC 27001
Talk to a consultant
Plan an ISO/IEC 27001 programme that fits how your engineers ship.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice