How ISO 27001 is applied in sectors with their own expectations: healthcare, energy utilities, telecoms, data centers and hosting, vendors to financial institutions, managed service providers, automotive suppliers and AI companies.
How healthcare providers and health software vendors use ISO 27001: the ISO 27799:2025 health controls built on ISO/IEC 27002, scope for EHR systems and medical device software, and how certification relates to HIPAA obligations for US business associates.
How electricity, gas, oil and heat utilities apply ISO 27001 with ISO/IEC 27019:2024: energy-specific controls for process control and supporting systems, what is out of scope, and how operational technology fits the ISMS scope and Statement of Applicability.
How telecommunications organizations apply ISO 27001 with ISO/IEC 27011:2024: sector guidance on top of ISO/IEC 27002, scoping network services, and why an ISO 27001 certificate does not by itself show NIS2 compliance.
ISO 27001 for colocation, hosting and IaaS providers: physical and environmental controls, the physical security monitoring control added in 2022, multi-site certificates, cloud extensions in ISO/IEC 27017 and STAR, and how large providers publish their certificates.
What ISO 27001 does for a vendor selling to banks and other financial entities: how US bank regulators treat ISO reports in third-party due diligence, DORA's contract and assurance rules for ICT providers, and what banks ask for beyond a certificate.
How MSPs and MSSPs scope ISO 27001 around access to customer environments: supplier controls customers apply to them, privileged access and MFA expectations from CISA guidance, contracts that split responsibilities, and multi-site delivery centers.
How automotive suppliers relate ISO 27001 to TISAX: the ENX-governed assessment and labels, the ISA catalogue's alignment with ISO 27001:2022, predefined assessment scope versus a freely set ISMS scope, assessment levels and label validity.
Whether an AI company needs ISO 27001, ISO 42001 or both: what each certifies, the shared harmonized structure, separate certification body rules, integrated audits, and the cloud and AI provider certificates customers already rely on.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.