How does ISO 27001 apply to a telecom operator with ISO 27011?
ISO/IEC 27001:2022 is certified by an accredited certification body, and ISO/IEC 27011:2024 adds telecommunications-specific implementation guidance on top of ISO/IEC 27002. A telecom compliance lead who receives a customer questionnaire, a regulator letter or a tender requirement for ISO 27001 should first establish which part of the operator the certificate will cover, because that decision drives most of the work. The organization owns its controls and its risk decisions. An implementation partner can prepare the management system, the network and operations evidence and the documentation, but only the independent certification body issues the certificate. ISO/IEC 27011 is guidance, not a second certificate, and it is not a separate audit path. Its edition supplied for this page is the 2024 edition, published on 28 March 2024, which replaced the 2016 edition and its 2018 corrigendum. Teams still citing the 2016 document in older policies should update those references.
Scope is where telecom organizations spend the most effort. Under clause 4.3 of ISO/IEC 27001:2022, the organization sets the boundary of its information security management system, and the boundary must reflect its internal and external issues and the requirements of interested parties identified under clauses 4.1 and 4.2. For an operator, the practical questions are whether core network functions, operations and business support systems, customer data platforms and outsourced network operations sit inside the boundary, and whether any of them are excluded with a justification. The Statement of Applicability, required by clause 6.1.3 d), then records which Annex A controls apply, how ISO/IEC 27011 guidance has been applied and why any control is excluded. Confirm the scope and the Statement of Applicability with the certification body before writing the controls, since a late scope change can reopen risk treatment and audit planning.
How to scope network services in the ISMS
Scope is the first decision an assessor tests, and for an operator it sets which networks, systems and sites the certificate covers. Clause 4.3 builds on the issues and interested parties identified in clauses 4.1 and 4.2, so each card below starts from a decision that must be recorded and justified.
Core and access network boundaries
Decide where the core network, transport and access domains begin and end, and whether each is inside the ISMS. Operators often split responsibility between engineering groups that own radio, fixed access and core functions, so a boundary drawn by org chart leaves gaps. Record each domain, its interconnections and the owner who approves changes. Assessors will ask for the network inventory, the interface list and the scope statement that matches them.
Operations and support systems
Operations support systems, element managers, provisioning platforms and billing systems can control the network without appearing in the network diagram. Decide whether each one is in scope, because a management system that can change core configuration is a high-impact asset. Check that privileged access paths, logging and change approvals cover these systems as well as the network elements. Expect the assessor to trace a sample of management systems back to the scope statement.
Customer-facing services
Decide which customer-facing services fall inside the ISMS, such as internet access, voice, hosted connectivity, portals and customer data stores. Scope that excludes the portal while including the network behind it creates an inconsistent picture of risk. Confirm that the Statement of Applicability reflects the services you sell. Evidence usually includes the service catalogue, the service-to-system mapping and the customer data handling rules.
Outsourced network functions
Many operators run network functions through managed service partners, cloud-hosted cores or vendor-operated maintenance. Decide whether each outsourced function is inside the scope, and if it is outside, document the supplier controls that cover it. Assessors test that the organization retains responsibility for controls it has not delegated. Ask for the supplier list, contract security clauses and the evidence of how the operator monitors supplier access.
Shared sites and co-located equipment
Exchanges, towers and data halls often hold equipment from several operators, landlords or tenants. Decide which rooms, cabinets and equipment belong to the operator's ISMS and which depend on a host's controls. Mistakes here leave physical access and environmental controls unclear. Confirm the access agreements and the division of physical responsibilities, and collect access logs and visitor records for the in-scope areas.
Interfaces between scope and exclusions
Every exclusion needs a stated reason and a clear interface to the in-scope systems, because an excluded system that feeds an in-scope service still carries risk. Record the data flows, trust relationships and shared credentials that cross the boundary. Assessors commonly test exclusions by following one data flow across the line. Keep the justification current as the network changes.
What the certification process looks like for a telecom operator
The sequence moves from defining the ISMS scope and risk picture to an independent certificate decision, with each phase producing a document or record that the next phase relies on. For a telecom operator, the network services in scope and the ISO/IEC 27011 guidance shape most of the early choices.
Define the ISMS scope and context
The organization works through clauses 4.1 and 4.2 to identify internal and external issues and the interested parties and their requirements, including regulators and wholesale customers. It then sets the ISMS boundary under clause 4.3, deciding which network services, core systems, operations centers, sites and suppliers fall inside it. The output is a written scope statement that the certification body will test against actual operations. Confirm early whether the scope covers customer-facing services, management networks or both, because this choice drives every later step.
Assess information security risks
The team identifies assets such as core network functions, operations support systems, lawful interception and customer data stores, then identifies threats and vulnerabilities and rates the resulting risks against defined criteria. ISO/IEC 27005:2022 is a useful reference for the method, and ISO/IEC 27011 adds telecom-specific threat examples to consider. The output is a documented risk assessment with an owner for each risk and a record of how each risk was rated.
Treat risks and produce the Statement of Applicability
For each risk, the organization chooses a treatment and selects the Annex A controls needed to deliver it, drawing on ISO/IEC 27002 and the telecom guidance in ISO/IEC 27011:2024. Under clause 6.1.3 d), the Statement of Applicability records each Annex A control, whether it applies, why, and where it is implemented or why it is excluded. The output is a signed Statement of Applicability that links back to the risk treatment plan.
Implement controls and collect evidence
Control owners in network operations, security, HR, procurement and facilities put the selected controls into practice, including access management for network elements, logging and monitoring, supplier terms and incident procedures. Each owner keeps records that show the control operates, such as configuration baselines, access reviews and change tickets. The output is an evidence set organized by Annex A control, which is what an assessor samples during the stage audits.
Run the internal audit
An internal auditor who is independent of the controls being tested checks the ISMS against clauses 4 to 10 and the Statement of Applicability, sampling records and interviewing staff in network and operations teams. Nonconformities are recorded with a root cause and a corrective action with an owner. The output is an internal audit report and a corrective action log that show the ISMS is working before an external body looks at it.
Hold the management review
Top management reviews the ISMS status, including audit results, risk changes, incidents, nonconformities, stakeholder feedback and improvement opportunities, and decides on resources and direction. Records of the meeting, decisions and any changes to scope or risk treatment become part of the management system evidence. The output is minuted management review records that show leadership actually directs the ISMS.
Pass the certification body's stage audits
An accredited certification body conducts the certification audit in two stages. The first reviews documentation and readiness, and the second tests whether controls operate in practice across the scope, including network services and sampled sites. The certification body decides how audit time is allocated based on the scope, number of sites and the rules it applies under ISO/IEC 27006-1:2024. The output is an audit report with any nonconformities that must be closed before a certification decision.
Receive the certificate and maintain the cycle
After the certification body confirms that nonconformities are resolved, it makes an independent certification decision and issues the certificate with its defined scope. Under ISO/IEC 17021-1, the certification cycle lasts three years, with at least one audit in every calendar year, either surveillance or recertification. The output is a certificate that customers and regulators can verify, plus a recurring audit schedule. Note that the certificate supports but does not replace the separate NIS2 assessment of the operator's obligations.
Why an ISO 27001 certificate does not by itself show NIS2 compliance
An ISO 27001 certificate does not by itself show NIS2 compliance. NIS2 is EU law, transposed into national law and enforced by national authorities who can impose fines. ISO/IEC 27001:2022 is a voluntary international standard. A certification body confirms that your information security management system meets the standard's requirements, but it does not confirm that you meet the obligations a national authority applies under NIS2. For a telecommunications operator, the certificate is useful evidence for part of the picture, and the rest must be checked against the directive and its national implementation separately.
ENISA's mapping of Implementing Regulation (EU) 2024/2690 to ISO/IEC 27001:2022 does not measure equivalence, so the mapping cannot be read as proof that certified controls satisfy each technical requirement. Start by taking the implementing regulation's requirements and the ISO 27001 Statement of Applicability side by side, and mark where a requirement has no clear control, where the control exists but its evidence is thin, and where the requirement depends on a national detail. Read the NIS2 Technical Implementation Guidance from ENISA alongside that comparison before deciding what your internal gap list should contain.
Three areas need their own checks in every telecom gap assessment. Incident reporting timelines under NIS2 are set in the directive and applied by national competent authorities, so your incident procedure under Annex A must be tested against the reporting steps your authority expects, not only against the ISO requirement to manage incidents. Supervisory evidence is also different from certification evidence, since authorities may ask for specific records, logs and governance proof on their own terms. Finally, national transposition details decide which entities are in scope and what is expected of them, so confirm these with your national authority and your legal team. Plan for these three checks as separate workstreams, and do not assume a surveillance audit will test them.
What an ISO 27001 telecom project costs and who is paid
This table lists each cost component of a telecom ISMS project, who is paid for it, whether it is one-time or recurring, and what moves it up or down. Use it to structure requests for scoped quotes, since no prices are published here and every figure depends on the written scope. The main takeaway is that the number of sites and in-scope network systems drives most components at once.
| Cost component | Who is paid | One-time or recurring | What drives it up or down |
|---|---|---|---|
| Certification body audit fees | Accredited certification body | Recurring: initial certification, then annual surveillance and a recertification cycle | Number of sites and in-scope systems, multi-site sampling approach, and the audit days the certification body calculates for the ISMS scope |
| ISO/IEC 27011 gap assessment | Consultant, implementation partner or internal team | One-time, repeated if scope changes | Number of network services and telecom-specific controls in scope, and how many current controls already map to ISO/IEC 27002 guidance |
| Implementation partner work | Implementation partner, under a fixed-scope written agreement | One-time, with optional recurring support retainers | Number of in-scope systems to harden, document and integrate, and whether evidence collection is automated from the start |
| Self-hosted or GRC tooling | Software vendor or open-source platform operator, plus infrastructure provider | Recurring licensing or hosting, plus one-time setup | Whether tools run in the operator's own infrastructure, how many systems feed evidence, and the number of users who need access |
| Internal staff time | The organization's own payroll | Recurring for control owners, one-time for initial documentation | Maturity of existing processes, number of network teams involved in the Statement of Applicability, and the ISMS owner's time |
| Risk assessment and treatment | Internal staff, sometimes supported by a consultant | Recurring annually and after material change | Number of network assets and suppliers in scope, and how the risk method is set up |
| Testing and assurance support | Security testing provider or internal red team | Recurring, aligned with the test calendar | Number of externally exposed network services, scope of penetration tests, and whether results feed the risk register |
| Certification scope changes | Certification body and internal staff | One-time per change, plus recurring audit effort | Adding a new network service, a new site or a new supplier to the ISMS scope |
Who does what: the operator, the implementation partner and the certification body
The telecommunications operator owns its information security management system. It decides what the ISMS covers, which risks it accepts, which controls it applies and how they are run day to day. Accountability for ISO/IEC 27001 and for any ISO/IEC 27011 telecom guidance it adopts stays with the operator's leadership, even when partners do much of the technical work.
- Scope and risk decisions: The operator sets the ISMS scope, including which network services, core systems and sites are inside it, and records its risk treatment choices in the Statement of Applicability.
- Policy approval: Senior management approves the information security policy and the supporting policies that the telecom controls depend on.
- Control ownership: Named internal owners run controls such as access reviews, incident handling, change approval and supplier oversight, and keep them running after the project ends.
- Management review: Leadership reviews ISMS performance, open risks, audit findings and improvement actions at planned intervals.
- Resourcing and accountability: The operator funds the work and decides who is accountable for network security outcomes.
Before engaging anyone, confirm which decisions in your own governance model must be taken by named executives and minuted.
An implementation partner such as DeployOpen helps the operator prepare its systems, controls and evidence. The partner works inside the operator's own infrastructure, whether that is its cloud accounts, data centers or air-gapped networks. The partner does not decide the risk appetite, approve policies on the operator's behalf or certify the result.
- Preparing systems: The partner plans and builds self-hosted open-source platforms for logging, identity, ticketing, asset inventory and configuration management that support the telecom controls.
- Configuring controls: Technical settings are hardened and documented so that the operator's control owners can run them.
- Collecting evidence: The partner sets up the systems that generate records, such as access logs, change records and backup reports, and arranges where the operator keeps them.
- Documenting: The partner writes runbooks, system descriptions and evidence maps that the operator reviews and adopts as its own.
- Supporting readiness: The partner can run internal checks against the control set, but the operator decides what to fix and whether to accept residual gaps.
Ask any partner for a written scope that lists deliverables and states which decisions remain with the operator.
An accredited certification body performs the independent audit and, if conformity is found, issues the ISO/IEC 27001 certificate. ISO itself does not certify organizations. The certification body must operate to ISO/IEC 17021-1 and ISO/IEC 27006-1, and its accreditation status can be checked in the IAF CertSearch database.
- Independent assessment: Auditors test the operator's ISMS against the standard and its Statement of Applicability, and they record nonconformities where requirements are not met.
- Audit cycle: Certification runs on a three-year cycle with at least one audit in every calendar year, including surveillance audits between recertification audits.
- Certificate issue and scope: The body issues the certificate and states the scope it covers, which should match the operator's documented ISMS scope.
- Separation from implementation: The body must remain independent of the consultants who helped prepare the ISMS, so the same firm should not design the controls and then audit them.
- Accreditation: Confirm that the body is accredited for ISO/IEC 27001 in the relevant sector and country before signing.
Verify the certificate and scope in the public database before relying on it in a tender or contract.
How to choose a certification body and an implementation partner
Certification and implementation are separate roles, and a telecom operator should keep them that way. The cards below cover the checks that confirm a certification body is accredited, that its auditors understand telecom networks and ISO/IEC 27011, and that the implementation partner stays independent of the auditor before you agree a fixed scope in writing.
Confirm accreditation in IAF CertSearch
Only an accredited certification body can issue an ISO 27001 certificate that customers and regulators will accept. Ask the body for its accreditation body and accreditation scope, then check the certificate status yourself in the IAF CertSearch database, which ISO points to for finding accredited certificates. Confirm that the accreditation covers ISO/IEC 27001 and that the body applies ISO/IEC 27006-1:2024 to your audit. Record the check date in your evidence file.
Test telecom and ISO/IEC 27011 familiarity
A certification body can be accredited and still have auditors who have never reviewed a core network, interconnection or lawful interception environment. Ask which audit team members have telecom experience, whether they know ISO/IEC 27011:2024, and how they will sample network elements in scope. Ask for a written audit plan that names the systems they intend to test. Ask how they handle operational technology and shared infrastructure if these sit in your ISMS scope.
Separate the implementer from the certifier
The partner that builds your controls and evidence should not also be the body that certifies them. Ask each party to confirm in writing that they have no advisory, ownership or financial ties that would impair independence. Check that the certification body will not design the controls it later audits. If the same firm would both prepare and certify, treat that as a conflict to resolve before contracting, not after the audit report.
Define deliverables before fixed-scope signature
Most implementation engagements are fixed-scope, so the written scope is your main control. Agree in writing which systems, network domains and sites are in the ISMS, which policies and procedures the partner will draft, and which evidence the partner will hand over. State what the organization still owns, such as approving the Statement of Applicability and running the controls day to day. Confirm the acceptance criteria and who signs them off.
Ask about evidence and handover
Ask how the partner will produce evidence that an auditor can sample, such as configuration exports from network management systems, access review records and change logs. Confirm the format and where the evidence lives, and that your team can operate it after the engagement ends. Ask whether the partner will prepare your staff for audit interviews and nonconformity responses, and what happens to the evidence repository if the contract ends.
Clarify what happens after certification
A certificate runs on a three-year cycle with at least one audit in every calendar year, so surveillance work does not stop at certification. Ask the partner whether ongoing support is a separate retainer and what it covers, such as internal audits, management reviews and control changes after network upgrades. Ask the certification body how it handles changes to your network scope between audits and what notice it requires.
Questions telecom operators ask before hiring outside help
How long does an ISO 27001 project for a telecom operator take?
The duration depends on how much of the management system already exists and how many network services, sites and business units sit inside the scope. No researched duration applies to telecom operators, so ask any partner for a timeline built from your written scope rather than a generic figure. The main pace setters are the scoping decision, the availability of network and operations staff for interviews and technical evidence, and how many systems must be inventoried before risk assessment can start. Ask for milestones tied to each deliverable, and for the dates on which your internal reviewers must respond.
What does the work need from our internal team?
The internal team owns the decisions, and an implementation partner cannot take them over. Expect to name an accountable executive, a project owner from network operations, and people who can explain how core, transport, access and OSS/BSS systems really behave. Security, legal, procurement and HR staff will need to review policies and supplier terms. Ask any partner to list each recurring meeting, each review and each approval the work depends on, so you can plan that time before the project starts.
Can a telecom operator implement ISO 27001 without outside help?
Yes, an operator can build an ISMS with its own staff if it has people with time, authority and the skills to run risk assessment and evidence collection. Outside help is usually considered where the team lacks experience with the standard, where network scope is large and complex, or where internal staff are needed for live operations. Whatever you decide, the organization still owns its controls, and an independent certification body must perform the certification audit. Ask a consultant which parts of the work they will perform, and which they expect you to perform yourselves.
Is ISO/IEC 27011 itself audited for certification?
ISO/IEC 27011:2024 gives telecommunications-specific guidance on implementing the controls in ISO/IEC 27002, and it is not a certifiable standard in its own right. A certification body audits your ISMS against ISO/IEC 27001:2022, and it will expect the telecom guidance to shape your scope, risk treatment and Statement of Applicability. Ask your certification body how it will assess the sector guidance you adopt, and make sure your documented reasoning for each control, including those you exclude, is ready for review.
Does an ISO 27001 certificate cover our NIS2 obligations?
No. An ISO 27001 certificate does not by itself demonstrate NIS2 compliance. ENISA's mapping of Implementing Regulation (EU) 2024/2690 to ISO/IEC 27001:2022 does not measure equivalence, and NIS2 is EU law enforced by national authorities with fines, while ISO 27001 is a voluntary international standard. NIS2 does not require ISO 27001 certification. Use the certificate as one body of evidence, then check the NIS2 technical requirements and national transposition rules separately with your regulator and legal advisers.
How do we check a certification body's accreditation?
Start by confirming that the certification body holds accreditation for ISO/IEC 27001 certification, and that it operates to ISO/IEC 17021-1:2015 plus ISO/IEC 27006-1:2024. Under IAF MD 29:2024, certification bodies had to apply ISO/IEC 27006-1:2024 to all clients by 31 March 2026, so ask how they have made that transition. ISO points to the IAF CertSearch database for checking accredited certificates, and since 1 January 2026 Global ACI has assumed the roles of IAF and ILAC. Confirm the accreditation scope in writing, and ask how the body will handle multi-site audits and any audit time it proposes.
What should a telecom operator ask a partner to put in writing?
Ask for a written scope that names the network services, sites, systems and suppliers included, together with the deliverables, the timeline, the internal roles each step requires and the exclusions. The engagement should state which documents and evidence the partner prepares and which the organization approves. Require a clear statement that the partner does not issue audit reports or certificates, and that the certification body is chosen and paid independently. Recurring costs such as surveillance audits, tool subscriptions and internal time should be listed separately from one-time implementation work.
How DeployOpen prepares telecom systems and evidence for an ISO 27001 audit
DeployOpen plans, implements and documents self-hosted open-source platforms inside the operator's own infrastructure, so the systems and evidence behind an ISO 27001 scope are ready for an independent certification body to test. We prepare systems, controls and evidence; the operator owns its controls and the certification body alone issues the certificate.
How we scope
- Agree the written scope of the engagement before work starts, covering which network services, platforms and sites are included.
- Map the ISMS boundary against the operator's network services, supporting systems and third-party dependencies so nothing sits unowned.
- Identify which ISO/IEC 27011 telecom guidance applies to each in-scope system and record the decision for the Statement of Applicability.
How we build
- Implement and harden self-hosted platforms for logging, access control, backup and monitoring within the operator's own cloud accounts, data centers or air-gapped networks.
- Configure controls against ISO/IEC 27002 guidance and the telecom-specific measures agreed in scope, so each control has a working system behind it.
- Run security testing of in-scope applications, APIs and infrastructure, and track findings to closure before the certification audit.
How we hand over
- Document configurations, runbooks and control owners so the operator's own staff can operate and explain each control.
- Collect evidence such as configuration exports, access reviews, change records and test reports, organized by Annex A control.
- Deliver the agreed artifacts and a handover session, then let the operator and its chosen certification body decide what to present at audit.
How we support
- Ongoing support, upgrades and continuous testing are available as a retainer after the initial engagement closes.
- Support can cover surveillance audit preparation, changes to the in-scope network services and platform upgrades that affect evidence.
- Confirm with DeployOpen during scoping which support terms, responsibilities and reporting cadence will apply after handover.
