ISO/IEC 27001 by industry
ISO/IEC 27001 for telecommunications and data centres: what customers and auditors expect of network and facility operators
Clause by clause: ISO/IEC 27001:2022 requirements: every clause explained →
What changes when the organisation is a telco, ISP, colocation or hyperscale data centre operator: why customers and tenders ask, what belongs in scope, where auditors sample across security zones, networks and change windows, and how the ISMS sits beside ISO 22301, ISO/IEC 20000-1 and SOC 2.
Key points
- For a telco, ISP or colocation operator, the certificate is usually requested by enterprise, financial-services and public-sector customers placing critical traffic or equipment with you, often as a condition of a tender or a renewal.
- The scope has to say which facilities, network services and operations centres are covered; a certificate that names the head office but not the NOC, the data halls or remote hands will not answer the customer's question.
- Auditors spend their sampling on physical security zones, network segmentation and DDoS response, capacity and change windows, and the contractors who hold keys, badges and console access.
- Power and cooling resilience sits inside the ISMS through the utilities and continuity controls, and pairs naturally with ISO 22301 and ISO/IEC 20000-1.
Why telecoms and data centre customers ask for ISO/IEC 27001
The demand comes from the organisations that put their most sensitive traffic, servers and records in your hands. Banks moving racks into a colocation hall, BPOs taking connectivity and hosted voice, SaaS companies renting cages and government agencies procuring network services use the certificate to show their own auditors how they oversee an outsourced infrastructure provider.
In tenders it is typically a pass or fail line on the supplier qualification sheet, sitting beside questions on uptime commitments, site tiering and customer audit rights. Hyperscale tenants expect it from the facility operator before signing a long-term lease.
What changes in this sector is that information security is physical as much as digital. The same ISMS has to govern a mantrap, a cross-connect order, a core router configuration and a generator test.
Scope for a telco, ISP or data centre operator
A credible scope names the facilities by site, the services customers contract for (colocation, cages, cross-connects, remote hands, transit, managed network, hosting), the NOC and SOC that monitor them, the provisioning and ticketing systems behind them, and the HR, procurement and facilities functions behind them.
What usually sits outside is the customer's own equipment and data inside a cage. You secure the space, power, access and connectivity; the tenant secures its servers. Say so in the scope statement and in customer contracts.
Three scope mistakes recur here: certifying one flagship facility while tenders are won on a portfolio of edge sites and points of presence; leaving the outsourced guarding, maintenance or field engineering contractors out of the supplier controls; and excluding the NOC because it is run by another group entity or from another country. The general rules are in ISO/IEC 27001 scope: boundaries, interfaces and the mistakes that cost you.
Where the requirements bite in telecoms and data centres
| Requirement area | What it means here | Evidence the auditor samples |
|---|---|---|
| A.7 Physical controls | Perimeters, security zones from the fence to the data hall, customer cages, physical monitoring, equipment siting, cabling and utilities | Badge and biometric access logs by zone, visitor and escort records, CCTV retention and review, cage key or code issue logs, cabling and power maintenance records |
| A.8 Technological controls: networks | Segmentation between customer, management and corporate networks, logging and monitoring in the NOC and SOC, protection against DDoS | Network diagrams against device configurations, out-of-band management access lists, SOC alert and response tickets, DDoS incident records and post-incident reviews |
| Capacity and change (clauses 6 and 8) | Planned changes to core network, power and cooling handled in agreed change windows, with the risk assessment repeated on significant change | Change requests with approval and customer notice, maintenance-window records, rollback plans, capacity reports for power, cooling, ports and bandwidth |
| A.5 Organisational controls: suppliers and continuity | Guarding, maintenance, carriers, fibre and field contractors who hold physical or console access; continuity readiness for loss of power, cooling or a site | Supplier security assessments and contract clauses, contractor access reviews and revocations, generator and UPS test records, continuity exercise reports |
| A.6 People controls | Screening and awareness for NOC engineers, security officers and remote-hands technicians who act on customer instructions | Screening records, training and awareness records, remote-hands work orders verified against authorised customer contacts |
The full control set is explained in Annex A: the 93 controls by theme, explained.
Working alongside ISO 22301, ISO/IEC 20000-1 and SOC 2
Customers who ask about security in this sector usually ask about resilience next. ISO 22301 adds the business impact analysis, recovery objectives and exercises for loss of a site, power or a carrier, and extends the continuity readiness already in Annex A. ISO/IEC 20000-1 covers the incident, change, capacity, continuity and supplier disciplines behind the services you sell. One risk method, one change process and one evidence calendar can serve all three; see Integrating ISO/IEC 27001 with ISO/IEC 27701 and ISO 22301: one management system.
Operators with US or enterprise tenants are often asked for a SOC 2 report as well; the choice is covered in ISO/IEC 27001 vs SOC 2: which one, or both? Cloud and hosting providers serving public-cloud workloads may add ISO/IEC 27017 cloud controls on the same ISMS. National telecoms and critical-infrastructure rules vary by country; record the ones that apply in the context register and confirm them with your regulator.
What a telecoms or data centre engagement looks like
Duration depends on the number of facilities and points of presence in scope, whether access control, CCTV and building management systems already produce retrievable records, and how many contractors hold physical or console access. The NOC and SOC leads, facilities engineers, network engineering, procurement and the tender team must be involved. With Design™, Sterling guides your teams to own the controls; with Drive™, Sterling carries more of the documentation and evidence.
How Sterling works with telecoms and data centre operators
One ISMS from the perimeter fence to the core router.
Our expert and experienced consultants map the requirements to your access control, NOC and SOC tooling, change calendar and contractor base, test the controls the way the auditor will, and keep the evidence in Effivity, included with the engagement. Sterling does not certify; an independent, accredited certification body audits and decides. We ensure successful certification for our clients.
Book a free discovery callISO/IEC 27001 for telecommunications and data centres: questions buyers ask
Does a data centre's ISO/IEC 27001 certificate cover the servers our customers put in their cages?
No. It covers the operator's controls: physical access, power, cooling and connectivity. The tenant's servers, data and logical access sit in the tenant's own scope.
Can we certify one data centre first and add other sites later?
Yes. Many operators start with one facility and extend the scope at surveillance or recertification, provided the certification body agrees the extension and the new sites run the same controls.
Do remote hands and outsourced security guards fall under ISO/IEC 27001 supplier controls?
Yes, if they can reach customer space or equipment. Contracts, screening, access reviews and work orders tied to authorised customer requests are the evidence auditors sample.
How does ISO/IEC 27001 treat DDoS protection for an ISP or telco?
It is a risk you assess and treat, not a fixed product requirement. Auditors look for the risk in the register, the chosen protection, monitoring in the NOC or SOC, and records of real or tested incidents.
ISO/IEC 27001 by industry
Every guide in the ISO/IEC 27001 series is written for one question and links back to the hub for the whole picture.
- ISO/IEC 27001 for banking, fintech and financial services
- ISO/IEC 27001 for BPO and shared services
- ISO/IEC 27001 for government suppliers and public bodies
- ISO/IEC 27001 for healthcare and health-data processors
- ISO/IEC 27001 for professional and legal services
- ISO/IEC 27001 for software, SaaS and technology
- The ISO/IEC 27001 Statement of Applicability
- Supplier security review
- ISO/IEC 27001 surveillance and recertification
- ISO/IEC 27001 for telecommunications and data centres
- ISO 27001 certification in the Philippines
- ISO 27001 certification in the UAE and GCC
- ISO 27001 certification in the UK
Keep exploring
Explore more about ISO/IEC 27001
Watch a video on how to implement ISO 27001 here.
Watch a video on ISO 27001 requirements here.
ISO/IEC 27001 resources
Services for ISO/IEC 27001
Talk to a consultant
Plan an ISO/IEC 27001 programme that covers every facility and network service you sell.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice