ISO 27001 for data centers and hosting providers: scope and audit

Does a data center or hosting provider need ISO 27001, and what does it cover?

When a customer, tender or regulator asks a colocation, hosting or IaaS provider for ISO 27001, the provider owns its controls, and an accredited certification body issues the certificate after an independent audit. Neither DeployOpen nor any other implementation partner issues that certificate. Cost and timeline depend on scope and sites, so the first decision is not which consultant to hire but which facilities, services and staff the certificate must cover. Ask the requester whether they need a certificate for one building, a set of data centers, or the provider's whole operating company, and whether they need evidence for a specific cloud service or for the management system behind it. The scope decides which facilities, services and staff are in the audit. A scope statement names the sites, the services sold to customers, and the teams that operate them, including remote administrators and staff in support centers who can reach customer environments. Everything inside the scope must meet the requirements of clauses 4 to 10 and the Annex A controls that apply, which the Statement of Applicability records with reasons for each inclusion or exclusion. The current edition has 93 Annex A controls, and organizations that certified to the 2013 edition had to move to the 2022 edition before the 31 October 2025 transition deadline. A provider still holding a 2013 certificate should confirm its status with the certification body rather than assume it carried over.

For a provider, the physical and environmental controls usually carry the most weight. Before committing to a scope, list every site, its perimeter and access routes, the power and cooling supply, fire suppression, and the equipment and storage media kept there, then check which of these your own operating model actually controls. Where a landlord, a facility manager or a power supplier runs part of the building, decide in writing which party owns each control and how the evidence is produced. An illustrative case: a colocation operator leasing a shell building may own access logging and visitor management but depend on the landlord for perimeter maintenance, so both arrangements belong in the Statement of Applicability and in supplier agreements. Confirm these boundaries with the certification body before the audit, because an unclear boundary is a common reason a scope is challenged.

Single site, multi-site or cloud scope: which fits your provider

A single-facility colocation provider runs one building or one data hall under one management system. The scope statement names that site, its address, the services delivered from it (power, cooling, cage and rack space, remote hands, and any managed network or backup services you sell) and the internal teams that operate them. Because the physical estate is contained, the Statement of Applicability can cite the physical and environmental controls in Annex A theme 7 directly against the building, its perimeter, power and cooling plant, and its equipment disposal process. Customers usually expect the certificate itself plus evidence that your physical security monitoring and access logs cover the site.

Scope statement: name the facility, the services and the customer-facing processes, and exclude anything the site does not operate.
Statement of Applicability: record which physical controls apply, such as secure areas and supporting utilities, with the local evidence for each.
Suppliers: list cleaning, maintenance, security guarding and utility providers as suppliers under the supplier controls.
Customer expectation: a certificate that matches the facility name, plus a clear statement of what the customer's cage or contract is covered by.
Growth: adding a second building later changes the scope and may trigger a multi-site audit design.

Before you commit to this model, confirm with your certification body that the site's operations, not only its address, fall within the scope you describe.

When ISO 27017 and CSA STAR add value for hosting customers

Hosting customers ask for more than an ISO 27001 certificate when they move workloads into a provider's environment. ISO/IEC 27017 and CSA STAR address that gap with cloud-specific guidance and a cloud assurance scheme, and each has its own scope and expiry rules to check.

ISO/IEC 27017:2026 replaces the 2015 edition

ISO/IEC 27017:2026 is edition 2 of the cloud security guidance, published 27 July 2026 and replacing the 2015 edition. It adds cloud-specific guidance and additional controls to ISO/IEC 27002 for both cloud service customers and cloud service providers, covering public, private and hybrid clouds. For a data center or hosting provider, the question is whether the provider's ISMS and Statement of Applicability reflect this edition, and whether the certification body's scope statement names the cloud services in scope. Ask which edition the certificate references.

CSA STAR Level 2 combines ISO 27001 with CCM

CSA STAR Certification is a STAR Level 2 third-party assessment that combines ISO/IEC 27001 requirements with the Cloud Security Alliance Cloud Controls Matrix. It is performed by CSA-approved assessment firms, so it is a different assurance route from an accredited ISO certificate. Hosting providers use it to show cloud-specific control coverage to customers who ask beyond the ISO certificate. Check whether the customer's questionnaire expects the STAR registry entry or only the ISO certificate.

STAR expires after three years

Following normal ISO/IEC 27001 practice, a CSA STAR Level 2 certification expires after three years unless it is updated. A customer reviewing a provider in year three may find a lapsed or out-of-date assessment, so vendor reviews should record the expiry date alongside the ISO certificate's own cycle. Ask the provider for the current assessment date, the assessment firm and the scope it covers, and set a reminder to request the renewed report before the old one lapses.

Provider certificates do not cover your tenant

AWS, Microsoft Azure and similar providers publish ISO/IEC 27001 certificates that cover their own security management over a named set of services, regions and data centers. Those certificates do not automatically cover a tenant's workloads, configurations, identities or data handling. Your organization still owns the controls for its own systems, so the provider's scope statement must be read against the services and regions you actually use. Confirm this boundary in your shared responsibility documentation before relying on the provider's certificate as evidence.

Check certificates in the registry

A certificate in a customer's file is only as good as its verification. Check the certification body's accreditation status and the certificate number in the IAF CertSearch database, and confirm the scope, sites and validity dates match the document provided. For CSA STAR, check the registry entry for the assessment level and expiry. Keep a dated record of each check, since a provider's certificate may be reissued or withdrawn during a customer's contract term.

How the certification audit runs for a hosting provider

The sequence moves a hosting provider from scoping and a gap assessment to an issued certificate, then through one audit in every calendar year of the three-year cycle. Each phase closes with a defined output that the next phase depends on.

Define the ISMS scope and sites
The provider decides which services, data centers, facilities and supporting teams fall inside the management system, and records the boundary in writing. Leadership approves the scope, and the team identifies which cloud regions, colocation halls or hosted customer environments are in or out. The step is done when the scope statement is approved and the list of sites and their roles is documented, because the certification body will test the scope against what the organization actually runs.
Run the gap assessment against clauses and Annex A
The organization compares its current practices with the requirements in clauses 4 to 10 and with the 93 Annex A controls, including the physical controls for facilities and the physical security monitoring control added in 2022. Internal staff or an independent advisor review access logs, visitor records, environmental monitoring and supplier arrangements. The output is a gap register with owners and due dates for each finding, plus a draft Statement of Applicability showing how each control is applied or excluded.
Close gaps and collect operating evidence
Owners fix the gaps in the register, which often means updating procedures for data center access, environmental alarms, change control and customer communication. The ISMS must also run for a period before the assessor arrives, so records such as management review minutes, internal audit reports, risk treatment decisions and incident logs need to exist. The step ends when every gap is closed or has an accepted risk treatment, and the evidence folder can show that each control has operated.
Complete the Stage 1 documentation review
The certification body reviews the documented ISMS, including the scope, policies, risk assessment, Statement of Applicability and internal audit and management review records. It checks whether the design is ready for a full assessment and may visit sites or hold interviews to confirm the basics. The output is a Stage 1 report listing any findings that must be resolved before Stage 2, and the provider uses it to plan the main audit.
Complete the Stage 2 implementation audit
The auditor tests whether the ISMS works in practice across the agreed sites, sampling physical access records, monitoring alerts, change tickets, backup restores, supplier reviews and customer-facing controls. Interviews with data center operators, facilities staff and cloud engineers form part of the evidence. The output is a Stage 2 report with nonconformities classified by severity. Minor findings are handled with corrective action plans, and major nonconformities must be resolved before a certificate can be issued.
Resolve nonconformities and issue the certificate
The provider submits evidence of corrective action for each nonconformity, and the certification body reviews that evidence before making a decision. A separate decision-maker, independent of the audit team, approves certification. The output is the ISO/IEC 27001 certificate that names the organization, the scope and the sites in scope. Buyers can check the certificate status in the IAF CertSearch database, which ISO still points to for accredited certificates.
Hold one surveillance audit each calendar year
Under ISO/IEC 17021-1, the three-year certification cycle requires at least one audit, either surveillance or recertification, in every calendar year. The auditor samples a subset of controls and sites, checks that corrective actions held, and reviews changes to the scope, such as new data halls or new hosted services. The output is a surveillance report that either keeps the certificate in force or raises findings that must be closed within the timeframe the certification body sets.
Recertify at the end of the three-year cycle
Before the cycle ends, the certification body runs a full recertification audit that covers the whole ISMS and every site in scope, similar in depth to Stage 2. The provider must show that the ISMS has been maintained and improved across the cycle, including internal audits, management reviews and handling of changes. The output is a renewed certificate for a new three-year cycle, and the provider's program then continues with annual surveillance audits.

What must be in place before the auditor arrives

An ISO 27001 certification audit tests whether the management system works in practice, not just on paper. The items below are the documents and records a data center or hosting provider should have ready, and each one should be checked against the sample the certification body selects.

Documented ISMS scope

The scope statement must name the sites, facilities, customer-facing services and supporting functions inside the management system, and state any exclusions with reasons. For a colocation or hosting provider, the scope decides whether a single data hall, a campus or several regions are covered. Check that the scope in the certificate application, the Statement of Applicability and the network and asset inventories describe the same boundary. A mismatch here is one of the first things an auditor finds.

Risk assessment and treatment records

The risk assessment should cover physical threats such as unauthorized entry, fire, flood, power loss and cooling failure, along with the logical risks to the hosting platform. Each risk needs an owner, a rating method and a treatment decision that links to controls. Ask the team to walk the auditor from one risk, such as loss of utility power, to the control that treats it and the record that shows it operates. Gaps between risks and controls are a common source of findings.

Statement of Applicability

The Statement of Applicability lists each Annex A control, states whether it applies, and gives the justification for every inclusion and exclusion. For data centers, the physical controls in theme 7 need particular care, because exclusions there are hard to justify when the provider runs the facility. Confirm that each control marked as implemented points to a current procedure and a recent record. Verify the document carries the version and approval date that the auditor will sample.

Physical access records

Access logs, visitor registers, badge reports, escort records and access-right reviews form the evidence for the physical access controls. Auditors commonly select a sample of individuals and a sample of dates, then ask for proof that access was granted through approval, removed on exit and reviewed periodically. Pull the records for the sample period before the visit and confirm that badge data, visitor logs and the ticketing system agree. Missing approvals or unexplained entries should be explained and corrected in advance.

Physical security monitoring evidence

A.7.4 Physical security monitoring is one of the 11 controls that were new in the 2022 revision of Annex A. Auditors will ask how cameras, intrusion sensors and alarms are monitored, who responds to alerts and what happens to recordings. Prepare sample alert tickets, camera coverage maps, retention settings and records of monitoring staff shifts. Confirm that the retention period and the review frequency in the procedure match what the systems actually do.

Power and network supplier controls

Utilities, fuel suppliers, carriers, transit and colocation peers, and cooling or fire system maintainers are suppliers whose services affect availability. Their contracts, service level reports, maintenance records and incident notifications should be filed under the supplier control set. Check that each critical supplier has been assessed, that contract terms cover security and notification duties, and that the provider can show what happened during the last outage involving a supplier. Ask each supplier for current assurance documents where they exist.

Internal audit results and corrective actions

Clause 9.2 requires internal audits of the management system, and auditors expect to see the audit program, the audit reports and the corrective actions that followed. Physical and environmental findings from internal audits should be visible and closed, with evidence of root cause analysis. Confirm that the internal auditors were independent of the areas they reviewed and that open actions have owners and dates. An internal audit that found nothing for two cycles often invites questions about its depth.

What ISO 27001 costs a data center or hosting provider

This table separates the cost components of an ISO 27001 program for a colocation, hosting or IaaS provider, showing who is paid for each, whether it is one-time or recurring, and what moves it up or down. Use it to structure requests for quotes so that every party prices the same scope.

Cost component	Who is paid	One-time or recurring, and main drivers
Certification body audit days	Accredited certification body	Recurring across the three-year cycle, with at least one audit every calendar year. Drivers: number of sites, persons in scope and services in scope. Ask for the audit-day calculation method under ISO/IEC 27006-1.
Implementation partner for systems and evidence	Implementation partner (for example DeployOpen, if engaged)	Mostly one-time for gap analysis, scope definition, policies and evidence design. Drivers: number of sites, existing physical security records and whether monitoring tools already exist. Ask for a fixed-scope deliverable list.
Physical security monitoring tooling	Vendor or open-source platform operator	Initial setup is one-time; licences, hosting and maintenance recur. Drivers: camera, access control and alarm integrations needed to evidence A.7.4 across sites.
Internal staff time	Your organization (salaried staff)	Recurring for facilities, operations, security and HR staff who produce access reviews, logs and environmental records. Drivers: site count and the volume of manual evidence collection.
ISO/IEC 27017 cloud extension	Certification body or assessor, as scoped	Added when cloud service customers or providers need cloud-specific controls evidenced. Ask whether the extension is audited inside the ISO 27001 audit or as a separate assessment.
CSA STAR assessment	CSA-approved assessment firm	Recurring, with three-year expiry unless updated, per the CSA. Drivers: CCM scope, number of services and whether you already hold ISO 27001. Ask how the STAR assessment reuses the ISO audit evidence.
Surveillance and recertification effort	Internal teams and certification body	Recurring each year after certification. Drivers: changes to sites, services and personnel, and the number of nonconformities raised at previous audits.

Who owns the controls, who prepares evidence and who certifies

The provider's own staff remain accountable for the information security management system (ISMS) and for every Annex A control in its scope. Management sets the policy, approves the risk treatment decisions and the Statement of Applicability, and signs off on what is accepted as residual risk. Operations staff run the facilities, cages, access lists and incident response every day, and no outside party can take those duties over on paper.

Scope and risk decisions: Management defines which facilities, services and customer environments fall inside the ISMS and accepts the risk treatment plan.
Physical operations: Staff run badge access, visitor logs, CCTV review, environmental monitoring and maintenance of power and cooling.
Control ownership: Each control in the Statement of Applicability has a named internal owner who answers for it at audit time.
Internal audit and management review: The provider runs its own internal audits and management reviews and acts on the findings.
Customer and supplier obligations: The provider manages its own suppliers, such as power, carriers and facility contractors.

Before engaging anyone, confirm that each control owner can explain and demonstrate their control without relying on the consultant.

Frequently asked questions about ISO 27001 for hosting providers

Can a multi-site hosting provider certify one data center first?

Yes, a provider can plan a multi-site ISMS in phases, but the scope has to be defined clearly from the start and the certificate must state exactly which sites and services it covers. A certification body audits the sites in the agreed scope, and the organization must show that one management system governs all of them, including central policies, internal audits and management review. Sites outside the first certificate are not covered by it, so customers will ask which locations are in scope before relying on the certificate. Confirm the phasing approach and the certificate wording with your certification body before the first audit.

How many persons drive audit time for a multi-site hosting provider?

Under clause C.6 of ISO/IEC 27006-1:2024, as explained in European Accreditation FAQ 48.5, on-site audit time for multi-site organizations is generally calculated from the total number of persons doing work under the organization's control, wherever they are located. That means staff, contractors and other people working under the organization's control at every site in scope count toward the calculation, not only the staff at the headquarters. Certification bodies then apply their own calculation rules within that framework. Ask your certification body to show the persons counted, the sites sampled and the resulting audit days in writing before you sign.

Do customers accept a provider's AWS or Azure ISO 27001 certificate?

Customers often accept a cloud provider's certificate as evidence for the infrastructure layer, but they still assess your own management system and the controls you run on top of it. AWS lists the in-scope regions and services on its ISO certificate and ISO Certified page, and Microsoft's Azure certificate covers Azure, Azure Government and Azure China, with Azure DevOps under a separate certificate. A hosting provider that rents cloud capacity must define which parts of its service rely on those certificates and which controls it operates itself. Review the scope statements in each certificate and state the shared responsibility split in your own Statement of Applicability.

How long does an ISO 27001 certificate last?

A certificate issued under the ISO/IEC 17021-1 certification cycle lasts three years. Within that cycle, the certification body must perform at least one audit in every calendar year, either a surveillance audit or the recertification audit, as described in European Accreditation FAQs 51.7 and 37.12. The certificate stays valid only while surveillance audits continue to pass and the management system keeps operating. Plan internal audits and management review throughout the cycle, not only before the recertification audit, so that surveillance findings do not surprise the team.

Can an implementation partner run the ISO 27001 audit for us?

No. An implementation partner can prepare systems, documentation and evidence, but only an accredited certification body can audit the management system and issue the certificate. The partner should also be independent of the certification body that audits you, because a consultant who designed the controls and then certifies them creates a conflict. DeployOpen prepares systems, controls and evidence for compliance assessments and does not issue audit reports, attestations or certifications. Your organization owns its controls and decides the scope and the Statement of Applicability.

What does the work need from our own staff?

The work needs named owners inside the organization for the ISMS, the risk process, each control area and the physical site operations, because those decisions and the day-to-day evidence cannot be handed to an outside party. Facilities, operations, security and network teams must run access logs, visitor records, environmental monitoring checks and change records as routine work. Management must approve the scope, the risk treatment decisions and the policies. Ask any partner to list the internal roles and hours it expects in the written scope before work starts, so you can plan staff time against the project.

What drives the cost of ISO 27001 for a hosting provider?

The main drivers are the number of sites and people in scope, the number of customer-facing services, how much of the physical and environmental estate is already documented, and how many controls must be built or changed. Certification body fees depend on audit days, which follow the rules described under clause C.6 and the multi-site guidance. Consulting or implementation effort is separate and follows the written scope. Ask for a quote that separates one-time costs, such as gap analysis and documentation, from recurring costs, such as surveillance audits, internal audits and tooling licenses.

How to check a certification body and an implementation partner

Hosting and data center scopes pull in facilities, cloud services and multiple sites, so the people you hire need to prove they have handled that combination before. The four checks below cover who can certify you, who can help you prepare without compromising that certification, what experience they bring, and what is written down before work begins.

Confirm accreditation before signing

Only an accredited certification body can issue a certificate that buyers and regulators will recognize. Ask for the body's accreditation scope and check the certificate itself in the IAF CertSearch database, which ISO points to for accredited certificates. Confirm the body operates to ISO/IEC 17021-1:2015 together with ISO/IEC 27006-1:2024, which IAF MD 29:2024 required all clients to be audited against by 31 March 2026. Ask how it applies that standard to multi-site facility audits, since the sample and time calculations differ from a single office.

Keep consultant and auditor separate

The organization owns its controls, the implementation partner prepares systems and evidence, and only the certification body issues the certificate. A partner that also performs your certification audit has a conflict of interest, and most certification bodies will refuse that arrangement. Ask the consultant to name the certification bodies it has worked with, confirm in writing that it will not perform or sign off your audit, and check that your certification body does not design the controls it will later test.

Ask for facilities and cloud experience

Generic ISMS experience does not cover data center work. Ask for examples where the partner documented physical and environmental controls, access logs for secure areas, power and cooling dependencies, and suppliers such as colocation landlords or hardware maintainers. For cloud scopes, ask whether they have mapped shared responsibility with an IaaS provider and how they used that provider's certificate and in-scope service list. Request named references you can contact, and treat any unnamed or anonymized claim as something to verify rather than accept.

Agree scope and deliverables in writing

Scope drives both the cost and the outcome. Before work starts, the written agreement should list which sites, data halls, customer services and cloud regions fall inside the ISMS, the Statement of Applicability version to be produced, the evidence set for each Annex A control, and who performs each task. It should also name the milestones, the handover of documents you will keep, and what happens if the certification body raises nonconformities that need more work. Ask for a fixed-scope quote built from this document, so changes to scope are priced as changes rather than absorbed quietly.

How DeployOpen prepares a hosting provider's ISO 27001 evidence

DeployOpen plans, implements, hardens, documents and supports self-hosted open-source platforms inside the client's own infrastructure, so the evidence for ISO 27001 controls comes from systems the provider actually runs. DeployOpen prepares systems, controls and evidence for the assessment, while the organization owns its controls and an independent certification body issues any certificate.

How we scope

We agree the ISMS scope in writing, naming the sites, facilities, customer services and systems that fall inside it.
We map which Annex A physical and technological controls apply to each site and which are owned by the facility operator or cloud provider.
We confirm with your certification body how multi-site and remote locations will be counted before work starts.

How we build

We configure access control, environmental monitoring and logging so each physical and technological control produces records an auditor can sample.
We build the physical security monitoring evidence for A.7.4, covering alarms, camera coverage and how alerts are reviewed and escalated.
We test the controls we implement and document the results, including gaps we find and how they were closed.

How we hand over

We deliver the Statement of Applicability, control documentation, runbooks and an evidence index mapped to each in-scope control.
We provide the evidence in a structured format so your internal team and the auditor can locate records without our involvement.
We train your staff to run the controls and keep the evidence current after the engagement ends.

How we support

Ongoing support, upgrades and continuous testing are available as a retainer, scoped in writing alongside the initial work.
Surveillance audits and recertification reviews depend on evidence kept current, so we can maintain the platforms and records between cycles.
Quotes follow from the written scope, so ask us to itemize what is one-time setup and what recurs under a retainer.