Is ISO 27001 mandatory? Who needs certification

Is ISO 27001 mandatory for my organization?

ISO/IEC 27001 is a voluntary international standard, and ISO itself says certification is optional. No general law requires an organization to hold it. Some organizations implement the standard only for its best practices, while others certify so that customers and clients can see that its recommendations are followed. The question that matters for your organization is narrower: does a customer, a contract, a sector rule or a regulator in your situation require a current accredited certificate, or does it accept evidence that you run a mature information security program? Those are different obligations, and they lead to different budgets.

Start by reading the actual demand. A contract clause that names ISO/IEC 27001 certification, a procurement questionnaire that asks for a certificate number, and a request for evidence of security practices often sound alike but carry different weight. Ask the requesting party which document they will accept and who must issue it. Financial entity customers under DORA, for example, must contract only with providers that comply with appropriate information security standards, and the rule does not by itself name a certificate. NIS2 does not require ISO 27001 certification either. Where a regulator or customer lists a framework as one acceptable option, implementing the controls and holding an independent assessment may satisfy the demand without a certificate. Confirm this in writing before you commit budget.

Keep two things apart. Implementing the standard means you design, run and record an information security management system (ISMS) and its controls in your own environment. Certification means an accredited certification body has audited that system and issued a certificate. Your organization owns its controls and its ISMS. Implementation partners can prepare the systems, policies and evidence, but only an independent certification body issues the certificate, and it does so under its own accreditation. If your customers ask for proof, check the certificate's scope, issuing body and expiry date rather than accepting a statement that you are "ISO 27001 aligned." The ISO certification page explains how certification works and is the right next read before you contact a certification body.

Which laws and regulators point to ISO 27001, and which do not

Few laws name ISO 27001 by name. Most rules set security outcomes and leave the method open, and some supervisors accept ISO reports as one kind of evidence among several. The cards below separate what each rule actually says from what buyers often assume it says.

NIS2 does not require certification

NIS2 is EU law enforced by national authorities, with fines for essential and important entities. It requires risk-management measures under Article 21, but it does not require ISO/IEC 27001 certification. ENISA's mapping of Implementing Regulation (EU) 2024/2690 to ISO/IEC 27001:2022 does not measure equivalence, so a certificate alone does not show NIS2 compliance. Check each technical requirement against the regulation itself and confirm with the national authority how it will assess you.

DORA asks for standards, not ISO

DORA Article 28(5) says financial entities may contract only with ICT providers that comply with appropriate information security standards, and for critical or important functions they must consider the most up-to-date and highest quality standards. ISO/IEC 27001 is one such standard, but the article does not name it or require certification. Ask a bank customer which standards it accepts and what evidence it wants, rather than assuming a certificate settles the question.

Community bank reviews of independent reports

The Federal Reserve's proposed third-party risk guide for community banks, published in September 2026 at 91 FR 58438, suggests reviewing independent assessment reports when assessing a cybersecurity vendor. It gives SOC 2 reports and ISO reports as examples. This is guidance, not a rule that makes ISO 27001 mandatory, and a bank will still judge whether the report's scope and controls fit the service it buys. Read the scope statement and the exceptions before accepting either report type.

General data protection and sector rules

The GDPR requires appropriate technical and organizational security measures, breach notification and processor oversight, but it does not name ISO 27001 or any certification as a condition of compliance. Many sector rules in healthcare and payments likewise set outcomes and leave the method to the organization. Map each obligation to a control you can show, and use ISO 27001 only where it helps prove that control. Confirm with your data protection authority or sector regulator whether they accept it as evidence.

A certificate does not prove compliance

An ISO 27001 certificate shows that an accredited certification body found an information security management system in place for a stated scope on the audit dates. It does not show that a regulator's specific rule is met, and it does not cover systems outside the scope. Ask each regulator or customer which requirements the certificate covers, which it does not, and what additional evidence they expect for the rest.

Implement, certify or pursue another assurance report

This table compares four routes a buyer can take when a customer or regulator asks about information security: implementing ISO 27001 without certifying, certifying through an accredited body, pursuing a SOC 2 report, or using a sector-specific assessment. Read each row to see who issues the output, what a buyer can verify and where each route falls short, because the right choice depends on what the person asking will accept.

Route	Who issues the output	What the buyer can verify	Main limitation
Implement the ISMS without certifying	The organization itself, through its own policies, risk assessment and records	Only what the organization chooses to share, such as documents or a questionnaire response	No independent statement exists, so customers must accept the organization's word or run their own audit
Certify to ISO 27001 through an accredited body	An accredited certification body issues the certificate after its audits	The certificate, its scope and its validity, checked in the IAF CertSearch database	Certifies a management system within a stated scope, not the security of a specific product or service
Pursue a SOC 2 report	A licensed CPA firm issues an attestation report against the AICPA Trust Services Criteria	The report, its type and the period it covers, which the buyer reviews directly	Reports describe controls the organization designed and tested, and the scope of the report defines what is covered
Sector-specific or regulator-led assessment	The regulator, a sector body or a contractually named assessor, depending on the requirement	The assessment outcome or evidence set the requirement names, such as a mapping or questionnaire	Recognition depends on the buyer's sector and contract, so confirm acceptance before investing

How customers and bank regulators read an ISO 27001 certificate

A financial institution or enterprise customer reviewing a vendor does not stop at the logo on a certificate. It checks what the certificate covers and whether it is still valid. The scope statement on the certificate defines which business units, sites, systems and services sit inside the information security management system, and that is the first thing a reader compares against the service being bought. If your customer's data flows through a platform outside the certified scope, the certificate does not answer their question, however well-run the rest of the organization is. Ask for the scope in writing before you rely on it.

Verification runs through the certification body and its accreditation, not through the certificate alone. Confirm that the body is accredited for ISO/IEC 27001 and that the certificate appears in the IAF CertSearch database, which ISO still points to for checking accredited certificates. A certificate that is expired, withdrawn or issued under the superseded 2013 edition will not pass a careful review, since all 2013-based certifications had to expire or be withdrawn by 31 October 2025. Regulators are also described as reviewing independent assessment reports in third-party risk work. A Federal Reserve proposal for community banks lists SOC 2 and ISO reports as examples, so an ISO certificate is one form of evidence among several, not a standalone answer.

Implementing the controls without certifying can still satisfy some buyers, but only if they accept it. Some customers accept a self-assessment against the Annex A controls, a readiness package or an independent gap assessment in place of a certificate. Others will refuse anything short of an accredited certificate. Before you decide, ask the buyer to confirm in writing which evidence they accept, who must prepare it, whether an independent party must review it, and how long it stays valid. Treat that written answer as the acceptance criteria for the decision, because a verbal assurance from a procurement contact rarely survives a vendor review.

Checks before you hire a certification body or implementation partner

Hiring for ISO 27001 involves two separate parties: a certification body that audits and certifies, and an implementation partner that prepares systems and evidence. The checks below help you keep those roles apart and confirm that each party does only what it is qualified and authorized to do.

Confirm the certification body is accredited

Ask whether the certification body holds accreditation for ISMS certification, and ask for the accreditation scope in writing. Accreditation is what gives a certificate weight with customers and regulators, so an unaccredited body's certificate may not be accepted by the buyers who asked for one. Confirm this before you sign any audit contract, because the audit fee is paid for a certificate that must be recognized.

Check the certificate in the database

Do not rely on a PDF or a logo. Look up the certificate in the IAF CertSearch database, which ISO still points to for accredited certificates, and confirm the certificate number, scope, sites and validity dates. Repeat this check for any certificate a supplier shows you, since the certificate must match the scope your customers will read.

Keep the implementer separate from the auditor

Do not use the same firm to build your ISMS and to certify it. A certification body must remain impartial, and an implementation partner that also performs the audit creates a conflict that can undermine the certificate. Ask every candidate which accredited body it would expect to audit you, and confirm that it has no role in the audit.

Confirm who issues what

Ask the partner to state in writing that it prepares systems, controls, policies and evidence, and that it does not issue audit reports, attestations or certificates. DeployOpen describes its own role this way. Only an independent auditor or certification body issues those outputs, so any supplier who promises a certificate or a pass result should be treated as a warning sign.

Get a written scope before work starts

Require a written scope that lists the systems, sites, people and deliverables in the ISMS, along with the acceptance criteria and the responsibilities that stay with your organization. A fixed-scope agreement makes it clear what you are paying for. Ask how changes to scope will be priced and approved before the work begins, not after.

Confirm your organization owns the controls

Ask who will hold management responsibility for policies, risk decisions, the Statement of Applicability and management review. These decisions belong to your leadership team and cannot be delegated to a supplier. A partner that offers to make these decisions for you is taking on work that the audit will expect your organization to own.

What each situation usually requires

Vendors selling to larger organizations often find that the procurement team asks for a named certificate in the tender or master agreement. The customer's wording usually refers to ISO/IEC 27001 certification, sometimes accepting an equivalent independent report. ISO notes that organizations certify to reassure customers that the standard's recommendations are followed, so a certificate is the most direct answer when the customer has written it into the contract. Where the customer only asks that the supplier be "aligned with" the standard, a documented implementation with internal audit records may be accepted in its place.

Named requirement: Check whether the contract says "certified" or only "compliant with" the standard.
Certificate scope: Confirm which products, sites and services the certificate covers, since customers check the scope on the certificate.
Accredited body: Ask whether the customer requires a certificate from an accredited certification body.
Timing: Find out the date by which the certificate must be in place, and whether an in-progress audit is acceptable.
Alternatives: Ask whether an independent SOC 2 report or a completed assessment questionnaire would satisfy the requirement.

Confirm all of these in writing before committing, because a certificate that covers the wrong scope or comes from an unaccepted body may not satisfy the clause.

What to do when a contract sets an ISO 27001 deadline

This sequence turns a contract clause into a written, scoped and dated plan so that you know what the customer actually accepts, what you must deliver and whether certification or implementation evidence is the right answer.

Get the requirement in writing
Ask the customer or contract owner to quote the exact clause that mentions ISO 27001, including the standard edition, the named certificate or report type, and any named certification body or accreditation. Ask whether the clause refers to ISO/IEC 27001:2022 or the older 2013 edition, since the 2013 certificates had to expire or be withdrawn by 31 October 2025 under IAF MD 26:2023. Your legal or procurement lead owns this step. It is done when you hold the clause text in a dated email or contract annex, not a verbal summary.
Confirm the evidence type demanded
Determine whether the clause asks for an accredited ISO 27001 certificate, an independent assessment report, or only evidence that the ISMS is implemented and operating. These are different deliverables. A certificate is issued by an accredited certification body after an audit, while an implementation statement is prepared by your own team. Put the answer to the customer in writing and record which option they accept. This step is done when the required evidence type is agreed and documented.
Define the scope with the customer
Agree which services, products, sites, systems and teams the ISMS must cover. Scope drives both the certificate's wording and the audit effort, because the certificate's scope is what the customer will check. Confirm whether the customer's data flows through shared platforms that must sit inside the scope. Record the agreed scope statement, the excluded parts and the reason for each exclusion. This step is done when both parties sign off a short scope statement.
Decide whether to certify or implement first
Compare the deadline with the work that remains. If the customer accepts implementation evidence, your team can build the controls, policies and records first and defer certification. If an accredited certificate is required, you must plan for the certification body's stage 1 and stage 2 audits and any corrective action. Ask the certification body for its own timeline in a written proposal, since no duration is set by the standard itself. This step is done when you have a decision recorded with its reason and a named owner.
Check the timeline against the certificate cycle
Map the contract date against the three-year certification cycle under ISO/IEC 17021-1. A certificate is valid for a three-year cycle with at least one audit in every calendar year, either surveillance or recertification. Confirm in which calendar year the first certificate would be issued and when the next audit falls, so that the contract's renewal or review dates do not coincide with an unplanned audit gap. The output is a dated audit calendar agreed with the certification body and shared with the customer.
Record the commitment and monitor it
Write the agreed evidence type, scope, decision and audit calendar into a contract tracker with an owner for each item. Set internal checkpoints before each audit date and before the customer's review dates. Keep the certificate or implementation evidence in a location the customer can access, and verify any certificate through the accredited register before sending it. This step is done when the tracker is live and each commitment has a named owner and due check.

Mistakes that turn a requirement into an expensive surprise

Most expensive surprises in this area come from assuming one document covers another obligation. The cards below cover the mistakes buyers make when a customer, contract or regulator asks for ISO 27001, and what to check before committing budget or staff time.

Treating any ISO certificate as NIS2 proof

An ISO 27001 certificate does not by itself demonstrate NIS2 compliance. ENISA's mapping of Implementing Regulation 2024/2690 to ISO/IEC 27001:2022 does not measure equivalence, so regulators will still look for evidence against the NIS2 technical requirements. Ask your national authority or legal adviser which gaps remain after certification, and map the Article 21 measures to your existing evidence before assuming the certificate closes them.

Certifying a narrower scope than the contract

A certificate covers only the scope written on it, and customers check that scope when they review it. If the service your customer buys runs on systems, sites or teams outside the ISMS boundary, the certificate will not support the contract claim. Compare the certificate scope line by line with the services named in the contract before the stage 1 audit, and agree any exclusions in writing with the customer.

Accepting a consultant's certificate claim

Consultants and implementation partners prepare the ISMS, but only an accredited certification body issues the certificate. Before accepting any claim of certification, look up the certificate in the IAF CertSearch database and confirm the issuing body, the scope and the expiry date. A certificate you cannot verify is a document, not evidence.

Treating a pre-audit as certification

A pre-audit or readiness review, whether run by a consultant or a certification body, is not the stage 1 or stage 2 certification audit. It can reveal gaps, but it does not produce a certification decision or a certificate. Budget for the formal two-stage process as a separate step, and confirm with the customer that a pre-audit result will not be presented as certification.

Starting before confirming acceptance

Some organizations implement ISO 27001 only for its practices, while others certify to reassure customers. Certification is optional under the standard, but a contract may require a certificate specifically. Before starting, ask the customer whether an implemented ISMS with an independent assessment report is acceptable, or whether an accredited certificate is required, and get the answer in writing.

Assuming a certificate covers DORA duties

DORA sets its own ICT risk management, incident reporting, resilience testing and third-party requirements, and financial entities must assess them in their own right. Article 28(5) asks financial entity customers to consider the most up-to-date and highest quality standards for critical functions, which an ISO certificate may support but does not replace. Ask your financial entity customer which DORA evidence they will request beyond the certificate.

Questions buyers ask before deciding

Is ISO 27001 mandatory under any law?

No law in the research notes requires ISO/IEC 27001 certification. ISO describes certification as optional: some organizations implement the standard only for its best practices, while others certify to reassure customers and clients that its recommendations are followed. The obligation usually comes from a contract, a customer's supplier program or a regulator's framework that names certification as one way to show evidence. Confirm the exact wording of any requirement, because a clause that asks for "an information security standard" may accept an alternative such as a SOC 2 report.

Can a customer require ISO 27001 in a contract?

Yes, a customer can write certification into a contract, and this is the most common reason organizations pursue it. The contract should state which certificate is required, the certification body that must issue it, the scope the certificate must cover and the deadline. Ask the customer whether an implementation without certification, a self-assessment or an independent report would be accepted. The cost and timeline follow from the scope you agree, so settle the scope before the contract date is fixed.

Does NIS2 require ISO 27001 certification?

No. NIS2 is EU law enforced by national authorities with fines, and it does not require ISO/IEC 27001 certification. ENISA's mapping of Implementing Regulation (EU) 2024/2690 to ISO/IEC 27001:2022 does not measure equivalence, so a certificate does not by itself demonstrate NIS2 compliance. Many organizations use the ISO 27001 management system as a base and then check the gaps against the Article 21 measures and the implementing regulation. Ask your national competent authority or legal counsel how they will assess evidence.

Does DORA require financial entities to use ISO 27001 vendors?

DORA does not name ISO 27001 as a requirement, but Article 28(5) says financial entities may contract only with providers that comply with appropriate information security standards. For critical or important functions, they must consider the most up-to-date and highest quality standards. An ISO 27001 certificate is one way a provider can show this, which is why bank customers often ask for it during due diligence. Check with each financial customer which evidence they accept, and whether a SOC 2 report or a direct assessment would also be considered.

Is implementing ISO 27001 without certifying enough?

It can be, if the reason is internal improvement or the customer accepts an alternative. The ISO/IEC 27001:2022 introduction states that the standard can be used by internal and external parties to assess the organization's ability to meet its own information security requirements, so an implemented ISMS has value without a certificate. The trade-off is evidence: without a certificate, a customer will ask for your own assessment, and that assessment carries less weight than an accredited certification body's decision. Decide this before building, because the management system work is largely the same either way.

How long does the decision take to affect the business?

The decision affects timing more than the outcome. Certification follows a three-year cycle under ISO/IEC 17021-1, with at least one audit in every calendar year, so a certificate is a multi-year commitment, not a one-time event. Timelines are set by the work needed before stage 1, the gap between stages and the closure of nonconformities, and the research notes do not give a standard duration. Ask a certification body and your implementation partner to estimate the timeline from your written scope, and check it against the date in the contract.

What does the work need from our internal team?

The organization must own its controls, policies, risk decisions and management review, and no outside party can take those over. Expect internal time from security, IT, HR, facilities and management for risk assessment, the Statement of Applicability, internal audit and evidence collection, and the time scales with the number of people and systems in scope. A partner can prepare systems, documentation and evidence, but staff must run the processes afterward. Ask any provider which tasks they will do and which remain with your people.

How do we verify a certificate or a provider's claim?

Check the certificate in the IAF CertSearch database, which ISO points to for accredited certificates, and confirm the issuing body is accredited and that the scope on the certificate matches the service you buy. Since 1 January 2026, Global ACI has assumed the roles of IAF and ILAC, so confirm the current arrangement with the accreditation body. A provider that says it can certify its own systems, or that a partner issued the certificate, is describing a conflict. DeployOpen prepares systems and evidence but does not issue certificates; only independent certification bodies do.

How DeployOpen prepares ISO 27001 evidence and systems

Whether ISO 27001 is required for your organization depends on your contracts, customers and regulators, and that answer should come before any build work. DeployOpen starts from a written scope tied to the systems and evidence your decision actually needs, then prepares the controls and records that a certification body or assessor would examine.

How we scope

We agree in writing which systems, sites, teams and suppliers the work covers before it starts.
We record which customer, contract or regulatory demands the scope must satisfy, so the boundary matches what is actually asked for.
Engagements are fixed-scope, with deliverables and timelines confirmed in writing before any work begins.

How we build

We implement the controls the scope requires on self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks.
We configure logging, access, backup and change records so the evidence they produce is kept in a consistent, retrievable form.
We run security testing against the in-scope systems and document the findings and fixes alongside the controls they affect.

How we hand over

We deliver documentation, configuration records and evidence packs that your team owns and can maintain after the engagement.
We identify which decisions, approvals and policy statements must remain with your organization and leave those for your management to sign.
We state clearly what remains for an independent auditor or certification body, which issues any report or certificate.

How we support

Ongoing support, upgrades and continuous testing are available as retainers once the initial work is handed over.
Retainers can keep evidence current between certification body visits, so your next audit does not start from a backlog.
Ask us to confirm the support scope, response expectations and fees in writing before you rely on them for an audit cycle.