What is ISO 27001?
ISO/IEC 27001 is the international standard for an information security management system (ISMS): the policies, risk assessments, controls and reviews a company uses to protect information. Certification is granted by an accredited certification body after an external audit. The 2022 version organizes 93 controls in four themes: organizational, people, physical and technological. A certificate runs on a three-year cycle with annual surveillance audits. In Europe and many international markets it is the reference security credential in tenders and enterprise procurement.
Who needs it
- Startups selling to European enterprises and public bodies
- Companies with international customers who ask for a recognized certificate
- Teams that already have SOC 2 and want a second, global credential
What usually triggers it
- A tender or enterprise contract lists ISO 27001 as a requirement
- A European prospect asks for your certificate
- Investors or partners ask how you manage security risk
How the process works
- Define the scope of your ISMS
- Run a risk assessment and select controls (Annex A)
- Write and roll out policies, train the team
- Internal audit and management review
- Stage 1 and Stage 2 certification audits by an accredited body
How Holam helps
We work out whether ISO 27001 is what your customers actually need, and in what order alongside other frameworks. We then introduce you to a compliance platform and specialists that fit your stage, and stay involved until the result is in your hands. Holam receives a referral fee from providers we introduce when you engage them. You pay the provider directly, we add nothing to their price, and you remain free to choose another provider.
Frequently asked questions
How long does certification take?
It depends on size and maturity. Small, well-prepared companies move faster; the audit itself is only the final step.
Which version applies?
The current version is ISO/IEC 27001:2022. Certificates on the 2013 version had to transition by October 2025.
Can ISO 27001 replace SOC 2?
For many European buyers, yes. US buyers often still ask for SOC 2, so companies selling on both sides frequently hold both.