Can ISO 27001 certification replace security questionnaires for your customers?
An ISO 27001 certificate can reduce the number of questions a buyer asks, but it seldom replaces security questionnaires entirely. A certificate covers only the certified scope and the controls in the Statement of Applicability, so a customer whose data or service falls outside that scope will still ask about it. Before you answer a customer's request, read the certificate yourself: check the scope statement, the issue status and the standard named on it, and confirm that the service your customer buys is inside that boundary. Four factors decide how much a certificate will shorten the process for a given customer. The first is the scope on the certificate, including which products, sites and cloud services it names. The second is the customer's risk tier: a low-impact vendor may accept a certificate and a short letter, while a customer handling sensitive data may still send a detailed questionnaire. The third is whether the customer is a regulated entity with its own third-party risk obligations, which often require it to review the controls behind a certificate. The fourth is whether your service is hosted by you or delivered as software that the customer runs, since the questions change with that split.
Responsibilities stay clearly separated throughout. Your organization owns its controls and answers for them. An implementation partner can help prepare systems, policies and evidence, but it does not decide what your customer accepts. Only an accredited certification body issues the ISO 27001 certificate, and customers can verify it through the IAF CertSearch database as described on the ISO certification page. Confirm with your customer, in writing, which documents they will accept in place of a questionnaire, such as the certificate, the Statement of Applicability or an independent report, and what they will still require. Agreeing that list early is the most reliable way to shrink the questionnaire without arguments later.
What an ISO 27001 certificate shows a buyer and what it leaves out
An ISO 27001 certificate is a narrow statement: it names the standard, its issue status and a scope, and it was issued by a body whose accreditation can be checked. The cards below separate what a buyer can rely on from what the certificate leaves for the buyer to verify.
Standard and issue status
The certificate must name ISO/IEC 27001 and state its issue status, so a buyer can tell whether it is a current edition or a superseded one. Under IAF MD 26:2023, certificates to the 2013 edition had to expire or be withdrawn by 31 October 2025, so a certificate that still cites 2013 is not a current 2022 certificate. Check the edition and the status on the certificate itself before relying on it.
Scope as stated on the certificate
The scope defines which products, services, sites and systems the certificate covers. Accreditation rules require that scope not be misleading or ambiguous, so a well-formed certificate names what was assessed. A buyer should read the scope against the service they will receive, because a certificate for a corporate office or one product line says nothing about the platform they actually use.
Accredited, checkable issuer
ISO does not certify organizations. An accredited certification body issues the certificate, and the buyer can confirm it in the IAF CertSearch database, by contacting the certification body or by contacting the accreditation body. A certificate that cannot be found in a registry or traced to an accreditor is a document the buyer has not verified, whatever its appearance.
Controls outside the scope
The certificate covers only the controls the Statement of Applicability includes and the scope the certification body accepted. Exclusions are allowed when justified, and a buyer who needs a specific control, such as secure development for a product outside the scope, must ask whether that control is in the SoA. Read the exclusions before assuming coverage.
Operation between audits
An audit tests the ISMS at a point in time and on a sample of evidence. Surveillance audits sample the system again, but they do not show how consistently controls ran in between, such as whether access reviews happened each quarter or incidents were logged. A buyer who needs continuous operating evidence should ask for internal audit results, management review records and corrective action history.
Subprocessors and contract terms
A certificate does not show that a vendor's subprocessors were assessed unless they sit inside the scope, and it does not reflect the data processing, liability, notification or audit rights in a particular customer contract. Ask which subprocessors fall within scope, and treat the certificate as one input to the contract review rather than a replacement for it.
Why the Statement of Applicability is the document buyers read first
Clause 6.1.3 d) of ISO/IEC 27001:2022 requires the organization to produce a Statement of Applicability (SoA), which records which Annex A controls the organization applies, why it applies them, whether they are implemented, and why any control is excluded. Of everything a certificate-holder can share, the SoA comes closest to an answer key for a security questionnaire. A certificate only tells a buyer that an accredited body audited an ISMS within a stated scope. The SoA shows how the organization reasoned about its own risks and which of the 93 Annex A controls it chose to carry. That is why buyers ask for it under NDA and map their own questions onto its control lines, asking, for example, where a question about access reviews or supplier oversight is answered.
A thin or generic SoA works against the organization. If every justification reads as boilerplate, or if exclusions are unexplained, buyers will treat the gaps as questions and send follow-ups, sometimes more than a questionnaire would have produced. Before sharing it, check that each applicable control names the actual tools, roles and evidence in your environment, and that each exclusion ties back to a documented risk decision. Confirm with your certification body how it expects the SoA to be presented, and confirm whether your customers' legal teams accept it as a stand-alone document or want it read alongside the certificate and scope statement.
The organization writes, owns and maintains the SoA. It must change whenever the risk assessment, the risk treatment decisions or the ISMS scope changes, such as when you add a product, move hosting or onboard a new subprocessor. An auditor reviews the SoA against the risk treatment process and the evidence in the ISMS, and reports on whether the document is consistent with what they observe. The auditor does not write the justifications or decide which controls apply. Keep a revision history with dates and approvals so that the version a customer receives can be matched to the version the auditor reviewed.
Which evidence fits which customer request
This table compares four ways to answer a customer's security request: the ISO 27001 certificate with its Statement of Applicability, a STAR Level 1 self-assessment, a STAR Certification, and a bespoke questionnaire. Read each row to see who issues the evidence, how much effort it takes, and which customer requests it can answer. The main takeaway is that a certificate covers the ISMS, while buyers may still need answers to questions outside its scope.
| Evidence option | What it shows and who issues it | Effort to produce | When it fits |
|---|---|---|---|
| ISO 27001 certificate and SoA | Shows an accredited certification body found the ISMS conforms to ISO/IEC 27001 within the stated scope. The SoA lists which Annex A controls apply and why. An accredited certification body issues the certificate. | Largest. Requires an ISMS, risk assessment, internal audit, management review and an accredited certification audit, repeated across the three-year cycle. | Customers that require certification or accept an independent ISO report. Confirm with the customer whether the certificate's scope covers the service they buy. |
| STAR Level 1 self-assessment | Shows the organization's own answers to the CAIQ v4, based on the Cloud Controls Matrix, listed in the public STAR Registry and updated annually. The organization publishes it; CSA does not verify the answers. | Low in cash terms because the assessment is free. Effort lies in completing the CAIQ accurately and keeping the entry current each year. | Cloud and SaaS vendors whose buyers want a standard, public answer set before a questionnaire. Useful as a first step for startups. |
| STAR Certification (Level 2) | Shows a third-party assessment that combines ISO/IEC 27001 requirements with the CCM. Performed by CSA-approved assessment firms and expires after three years unless updated. | Substantial. Needs an ISO 27001 base plus the CCM assessment. Confirm the assessment firm's fees and timeline in writing. | Cloud buyers that ask for a CSA-recognized third-party report. Usually follows an existing ISO 27001 program. |
| Bespoke questionnaire | Shows the answers the buyer asked for, scoped to their use case. The vendor writes the answers; the buyer assesses them. No independent issuer is involved unless the buyer requires one. | Repeated per customer. Each response takes staff time, and answers often need evidence attached. | Customer-specific questions, such as data residency, subprocessors or product security not covered by a certificate. Supplement any certificate with these answers. |
When buyers still ask for more, by buyer type
Banks, healthcare providers and critical infrastructure operators run formal third-party risk programs. They are expected to review independent assessment reports for their suppliers, and a certificate is one input among several. Regulators address this directly: the Federal Reserve's proposed third-party risk guide for community banks (91 FR 58438) suggests reviewing independent assessment reports, giving SOC 2 reports and ISO reports as examples, when assessing a cybersecurity vendor. Because the buyer must show its own oversight, it will still ask for evidence of how the controls operate in your environment.
- Scope and Statement of Applicability: Expect questions on whether the certified scope covers the service they buy, and why excluded controls are excluded.
- Control operation evidence: Access review records, change logs, backup restore tests and vulnerability remediation data for the period the buyer asks about.
- Subcontractor oversight: Your supplier list, how you assess those suppliers, and their certificates or reports.
- Testing results: Penetration test summaries and remediation status, with the scope and tester identified.
- Incident and continuity records: Past incident summaries, notification timelines and tested continuity plans.
Before the first request arrives, prepare a shared evidence index that maps each buyer question to a current document and an owner, and confirm with the buyer's own regulator guidance which reports they accept.
Enterprise procurement teams usually treat the certificate as the opening position, not the end of the review. They combine it with a contractual security schedule and their own questionnaire, which covers topics a certification audit does not target in the same depth. The certificate confirms that an accredited body found a management system in place for the certified scope. It does not answer how your product handles their data, which subprocessors touch it, or how you respond to an incident affecting their tenant.
- Data handling and location: Where data is stored, processed and backed up, and who can access it, described for their specific contract.
- Subprocessor list: Named subprocessors, their locations, the services they provide and notice periods for changes.
- Incident response commitments: Notification timelines, contacts, escalation paths and the evidence of past exercises.
- Contract schedules: Security addenda, audit rights, liability and insurance terms, which are negotiated outside the certificate.
- Custom questionnaire answers: Responses that go beyond the Statement of Applicability, often on encryption, logging retention and secure development.
Before sales cycles start, keep a current subprocessor register, a pre-approved set of questionnaire answers and an incident communication template. Confirm early which of these the buyer requires in writing.
Smaller customers often have fewer resources to run a long review, so they tend to accept a lighter package. For many of them, a public entry in the CSA STAR Registry, or a short questionnaire, is enough to start a relationship. The STAR Level 1 self-assessment completes the CAIQ v4 questionnaire, based on the Cloud Controls Matrix, and lists it publicly, which lets a buyer read your answers without sending their own form. CSA also offers CCM Lite and CAIQ Lite for SMEs and startups.
- Self-assessment answers: A completed CAIQ or CAIQ Lite that matches your current practice, updated when your environment changes.
- Core policies: Access control, acceptable use, incident response and backup policies in short form.
- Data processing terms: A standard data processing agreement and a clear statement of where customer data is held.
- Security contact: A named person for vulnerability reports and security questions.
- Basic technical proof: Encryption in transit and at rest, multi-factor authentication and a summary of recent backup tests.
Before responding, check whether the buyer wants a registry reference, a questionnaire or both, and keep the STAR entry date-stamped so the answers can be compared against your current systems.
How a buyer verifies an ISO 27001 certificate before accepting it
This sequence lets a buyer confirm that a certificate is genuine, current, and covers the service being bought, so the buyer can decide how much weight it carries before sending a questionnaire or accepting the vendor's claim.
Request the certificate and its scope statement
The buyer asks the vendor for a copy of the certificate and the scope statement that describes which products, services, sites and teams are covered. The vendor provides both documents, and the buyer checks that the certificate names the certification body, the standard and the scope. If the vendor offers only a logo, a marketing claim or a certificate with no scope, the buyer stops here and asks for the full documents before going further.
Look up the certificate in IAF CertSearch
ISO directs buyers to IAF CertSearch to check accredited certificates. The buyer searches by organization name or certificate number, and can check one certificate at a time, in bulk, or through the API. The output is a database record showing the certificate holder, the certification body and the certificate status. Global ACI now holds the accreditation roles that the IAF previously held, since 1 January 2026, so buyers should expect the same database to be the reference point.
Confirm the certification body directly if needed
If the database entry is missing, unclear or conflicts with the vendor's copy, the buyer contacts the certification body or the accreditation body directly. ISO lists both as valid routes, along with Global ACI. The buyer asks the certification body to confirm in writing that the certificate is valid, names the correct standard and scope, and has not been suspended or withdrawn. The written reply becomes part of the buyer's due diligence file.
Check the standard edition and issue status
The buyer confirms that the certificate refers to ISO/IEC 27001:2022. Under IAF MD 26:2023, every certification to the 2013 edition had to expire or be withdrawn by 31 October 2025, so a 2013-based certificate no longer counts as current. The buyer also checks the issue status and expiry date, and notes that a certificate under a three-year cycle needs at least one audit in every calendar year. A certificate that lists only the 2013 edition, or that has lapsed, is not a valid answer to a request for current certification.
Check that the scope covers the purchased service
The buyer compares the scope statement with the service it is buying. A certificate that covers corporate IT but not the production platform, or that covers one product line but not the hosted service the buyer uses, does not support the buyer's risk assessment for that service. The buyer records which services, locations and support functions are in scope and marks any gap for follow-up. A scope that is vague or that refers to standards outside the accredited scope is a warning sign.
Read the Statement of Applicability for exclusions
The Statement of Applicability is the document the vendor maintains to list each Annex A control, state whether it applies, and give the reason for any exclusion. The buyer reads the exclusions and asks how the excluded controls are handled, especially where the exclusion touches the buyer's data, access or hosting. The buyer's output is a short list of controls that are excluded, partially applied or not explained, which becomes the basis for targeted questions instead of a full questionnaire.
What to prepare so questionnaire answers match the certificate
A certificate only reduces questionnaire work if the answers behind it are accurate, current and traceable to the certified scope. The items below are what the organization must hold ready before it replies, and the organization owns each one. An implementation partner can help build the systems and evidence, but the certification body alone decides conformity.
Scope that matches the product
Define exactly which products, services, environments and hosting models the certificate covers, and name the locations and teams inside that boundary. Buyers compare their own deployment with this scope, so a scope that leaves out the production platform or the support tooling invites follow-up questions. Check that the scope statement on the certificate and the one in your marketing and questionnaire answers use the same wording. If the product runs in a cloud account the company does not operate, confirm how that account is described.
Statement of Applicability tied to current risk
The Statement of Applicability lists each Annex A control, whether it applies, and why. It is required by clause 6.1.3 d) and must reflect the most recent risk assessment and treatment decisions. Before answering a questionnaire, confirm that each control a buyer asks about is either marked applicable with its implementation described or excluded with a reason that still holds. An SoA that predates a major product or hosting change will contradict the answers.
Subprocessors and cloud services in scope
Keep a current, documented list of the cloud services, subprocessors and suppliers that handle customer data and fall inside the certified scope. Buyers often ask who else touches their data, and the answer must match the supplier controls in your SoA and the cloud services controls you claim. Record the owner, the data handled and the review date for each entry. Confirm with each supplier which of its own certificates or reports you can cite without implying that you are certified by association.
Evidence that controls run between audits
A certificate describes controls at the time of audit, so buyers ask whether the controls still operate. Keep dated records such as quarterly access reviews, change approvals, vulnerability scan results, backup restore tests and incident tickets with root cause notes. Pick a sample of each record type and confirm you can produce it within a day. Gaps here show up quickly when a buyer asks for a recent example rather than a policy.
Answer library cross-referenced to Annex A
Maintain a pre-written answer library where each recurring question links to the Annex A control ID, the policy or procedure that governs it, and the evidence an assessor would review. Assign an owner to each answer and a review date tied to your change process. This keeps answers consistent across customers and lets you show which parts of a response are backed by the certificate and which are supplemental. Review it after each audit, since findings often change what you can truthfully claim.
STAR Registry entry kept current
If you list a CSA STAR Level 1 self-assessment in the public STAR Registry, check that the CAIQ answers still match your current product, scope and controls, and that the entry reflects its annual update. A stale registry entry can be read as a current claim, so treat it as a public statement that needs the same review as the questionnaire library. Confirm whether your customers accept the registry as a substitute for their own form before you point them to it.
How CSA STAR entries and STAR Certification relate to the ISO certificate
The Cloud Security Alliance runs two STAR levels, and buyers often confuse them with the ISO certificate. STAR Level 1 is a self-assessment: the organization completes the Consensus Assessments Initiative Questionnaire (CAIQ v4), which is based on the Cloud Controls Matrix (CCM), and lists the result in the public STAR Registry at no charge. The entry is updated annually. CSA says that publishing it lets customers see your security and compliance posture without sending each of them a separate questionnaire, which can reduce repeated questionnaire work. CSA also offers CCM Lite and CAIQ Lite for small and startup companies, so a small team can start with a reduced set of questions rather than the full matrix.
STAR Certification is a Level 2 third-party assessment. It combines the ISO/IEC 27001 requirements with the CCM and is performed by CSA-approved assessment firms, so an independent party tests the claims rather than the vendor alone. Under normal ISO/IEC 27001 practice, a STAR Certification expires after three years unless it is updated. Confirm with CSA which assessment firms are approved and what the current assessment scope and fees are, since these are set outside this page and are not supplied here. Note that a STAR entry is a vendor statement, while a STAR Certification is an independent assessment. Neither one replaces the ISO certificate, and neither widens its scope: the certificate covers only the services and sites named in the certification body's scope statement, so check that a STAR document covers the same product and locations your customer is buying.
Before you choose between these routes, ask the customer which document they will accept. Some procurement teams will take a Level 1 entry and a copy of the Statement of Applicability, while others will ask for a verifiable accredited certificate or a STAR Certification. Confirm the requirement in writing at the start of the deal, and keep the STAR entry, the certificate scope and the Statement of Applicability aligned so that a reviewer comparing them finds no contradictions.
Why a certificate fails to end questionnaires and how to avoid it
An ISO 27001 certificate only answers questions about what it covers, in the edition named, at the date it was issued. The pitfalls below are the places where a certificate looks like a shortcut but leaves buyers with gaps, and each one has a clear owner inside the organization.
Scope excludes the sold product
The certificate scope must match what customers actually buy. If the audited scope covers the corporate office and internal IT but not the production platform, buyers will send questionnaires about the platform anyway. Check that the scope statement names the product, its hosting environment and the teams that build and run it. Owner: the top management and the ISMS lead, who define scope under clause 4.3.
Broad exclusions in the SoA
The Statement of Applicability records which Annex A controls apply and which are excluded, with reasons. Many exclusions, especially for controls a SaaS vendor would normally need, prompt buyers to ask why. Each exclusion should have a justification that a customer can read and accept. Owner: the ISMS lead, reviewed against the risk treatment decisions made under clause 6.1.3.
Pending, expired or 2013 certificates
A certificate that is still in progress, has lapsed, or cites ISO/IEC 27001:2013 does not describe current controls. The 2013 certifications had to expire or be withdrawn by 31 October 2025 under IAF MD 26:2023. Before sharing, confirm the issue status, the edition and the expiry date in the public registry. Owner: the compliance lead, who keeps the certificate record current.
Certification by association
A cloud provider's ISO 27001 certificate covers that provider's infrastructure under its own scope. It does not certify your application, your staff or your processes, and it does not transfer to you. Buyers who accept it as proof of your own certification are relying on a claim the provider cannot make for you. Show the inherited controls separately and state which responsibilities remain yours. Owner: the platform or engineering lead for the shared responsibility split.
Sharing the PDF without scope
A certificate PDF on its own omits the context a reader needs. Without the scope statement, the standard edition and the SoA reference, a reader cannot tell which services are covered. Send the certificate together with its scope text and the current SoA, and point buyers to the public registry so they can verify it independently. Owner: the sales or account lead who sends documents, with the compliance lead approving the bundle.
Questionnaire answers that contradict the SoA
When a questionnaire says a control operates and the SoA says it is excluded, or the answer describes a tool the SoA does not mention, the buyer loses trust in both documents. Reconcile every questionnaire answer against the current SoA and the evidence behind it before submission. Owner: the security lead who signs off questionnaire responses, using a single answer library.
Questions buyers and practitioners ask about ISO 27001 and questionnaires
Does an ISO 27001 certificate remove all security questionnaires?
No. A certificate reduces the questionnaires a customer sends, but only for the scope the certificate covers. Buyers still ask about systems outside the certified scope, about contract-specific obligations, about data locations and subprocessors, and about controls the certification body never tested in depth. Many buyers accept the certificate and its Statement of Applicability as the starting point, then send a shorter set of follow-up questions. Ask each major customer in writing which questions they will drop if you hold a certificate, and check that the answer matches your certificate scope.
Is a STAR Level 1 entry enough to satisfy a customer?
It depends on the buyer's risk tier and the contract. A STAR Level 1 entry is a free self-assessment: you complete the Consensus Assessments Initiative Questionnaire (CAIQ v4), based on the Cloud Controls Matrix, and list it in the public STAR Registry. CSA says the registry can reduce repeated questionnaires, but it is not a third-party assessment. Low-risk buyers often accept it. Buyers in regulated sectors, or those with contract clauses requiring independent assurance, may still ask for an ISO 27001 certificate or a STAR Certification, which is a third-party assessment. Confirm which of these your contract names before you choose.
Can a SOC 2 report replace an ISO 27001 certificate for a buyer?
Not automatically. The sources treat SOC 2 and ISO 27001 as different assurance types. A SOC 2 report is issued by a CPA firm under AICPA attestation standards and describes controls against the Trust Services Criteria for a period. An ISO 27001 certificate is issued by an accredited certification body against a management system standard. Some buyers accept either, some require a specific one, and some ask for both. The Federal Reserve's proposed community bank guide, which suggests reviewing SOC 2 and ISO reports as examples, shows that regulators name both as possible evidence. Ask the buyer which report type and scope they accept before you commit to one.
How long does a Statement of Applicability and its evidence take to prepare?
The time depends on your scope and headcount, so ask for a written scope before you plan. The Statement of Applicability is required by clause 6.1.3 d) of ISO/IEC 27001:2022. It lists the Annex A controls you include or exclude, with reasons, and links each included control to its implementation. The work grows with the number of systems, suppliers, sites and people in scope, and with how much evidence already exists. A small product team with one cloud account has far less to document than a multi-product company with several subprocessors. Request a fixed scope and a deliverables list from any implementation partner before agreeing on a timeline.
Can our own team answer questionnaires without outside help?
Yes, if staff have the time and the knowledge of your systems. Building a reusable questionnaire library, with answers mapped to your policies, controls and evidence, is internal work that many teams do. The certification audit is different. Only an accredited certification body can issue an ISO 27001 certificate, and it works through a two-stage initial audit and then surveillance or recertification audits within a three-year cycle. Your team can prepare for that audit, but the certification body must perform it. Decide early which parts you will run internally and which you will buy.
What do consultants and implementation partners do, and what do they not do?
Consultants and implementation partners prepare systems, controls and evidence for your assessment. They can design the ISMS documentation, configure tooling, close gaps, run internal reviews and build a questionnaire library. They do not own your controls, and they do not issue audit reports or certificates. The organization remains responsible for its decisions, its risk acceptance and its Statement of Applicability. An independent auditor or certification body performs the assessment and issues the result. DeployOpen works this way: it plans, implements and documents self-hosted open-source platforms and prepares evidence for assessments, but it does not certify anyone. Ask for the deliverables in writing so both sides know who owns each one.
How do we check that a customer's ISO 27001 certificate is valid?
Verify it with the certification body or in the IAF CertSearch database. ISO says an accredited certificate can be checked in IAF CertSearch, individually, in bulk or through an API, or by contacting the certification body, accreditation body or Global ACI. Confirm that the certificate names the standard and its issue status, that its scope matches the service you buy, and that it was issued by an accredited body. The European Accreditation FAQ 36.10 explains that a scope must not be misleading or ambiguous. If a vendor's certificate covers only a hosting provider's data center and not their product, it does not cover the product.
How DeployOpen prepares the evidence buyers ask for
A certificate answers some questionnaire items and leaves others open, so the useful work is sorting which answers an accredited audit can support and which need their own evidence. DeployOpen prepares the systems, controls and documentation behind those answers inside your own infrastructure, while the organization owns its controls and an independent certification body issues any certificate.
How we scope
- We agree a written scope covering the services, systems and sites a buyer's questionnaire actually asks about.
- We map the Statement of Applicability to the questionnaire topics your customers send, so gaps are visible before a buyer finds them.
- Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts.
How we build
- We deploy self-hosted open-source platforms in your cloud accounts, data centers or air-gapped networks, configured to produce evidence.
- We set up access, logging, backup and change records so each control leaves an artifact an assessor can sample.
- We run security testing against applications, APIs and infrastructure so the answers you give rest on tested controls.
How we hand over
- We document each control's owner, procedure and evidence source so your team can answer follow-up questions without us.
- We prepare a reusable evidence pack covering policies, risk treatment records and configuration exports for customer reviews.
- We confirm with your certification body or auditor which claims they can verify, and label anything outside that scope as your own statement.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers after the initial handover.
- We keep documentation current as systems change, so questionnaire answers still match the environment a buyer reviews.
- We can prepare your team for a customer's follow-up review, while the organization itself remains accountable for every answer it gives.
