Start for free Start for free

ISO 27001

ISO 27001 is an international standard for running an information security management system: the policies, people and processes a company uses to manage security risk. A vendor certified to it has passed an audit by an independent certification body.

What is ISO 27001?

ISO/IEC 27001 is an international standard from ISO and the IEC, two standards bodies. It sets requirements for an information security management system (ISMS): the policies, roles and routines a company uses to find and manage security risks.

According to the ISO help center, it applies to organizations of any size, covers people, policies and technology, and its 2022 revision includes 93 controls grouped into four domains. Certification is voluntary.

ISO itself does not certify anyone. Its certification page says "ISO does not perform certification or issue certificates." Independent certification bodies do that. A certificate is valid for three years, with surveillance audits by the certification body in each of the two years in between, as the Cloud Security Alliance explains.

What it proves and how it differs from SOC 2

An ISO 27001 certificate shows the vendor runs a management system that meets the standard, for the scope written on the certificate. It says the vendor manages risk in a structured way. It does not list test results for each control.

A SOC 2 report works differently. It is a US attestation report from a CPA firm, and a Type 2 report shows how each control was tested over a period, including exceptions. See SOC 2 vs ISO 27001.

Vendors often have both. Atlassian's Security Measures, for example, name ISO 27001 and SOC 2 as standards they verify against.

Why it matters to you

European and global customers often ask for ISO 27001 the way US customers ask for SOC 2. If your vendors hold it, your own security questionnaire answers get easier.

But a certificate is only as useful as its scope. A certificate for one office or one product says nothing about the product you use.

What to check

  • Ask for the certificate and read the scope statement on it.
  • Check the issue and expiry dates, and that it names the 2022 version.
  • Note the certification body and check that it is accredited.
  • Ask for the statement of applicability, which lists which annex controls apply and why.
  • For deeper evidence on specific controls, ask for a SOC 2 Type 2 report too.

How Venpo helps

Venpo monitors your vendors' trust center pages, security addenda and other public legal pages, and emails you in plain English when a security commitment changes. Each vendor gets a change history you can point to in reviews.

Start for free

Frequently asked questions

Is ISO 27001 better than SOC 2?

Neither is better; they answer different questions. ISO 27001 shows a managed security program, while a SOC 2 Type 2 report shows how specific controls were tested.

Who issues ISO 27001 certificates?

Independent certification bodies, not ISO. Check that the body is accredited and that the certificate's scope covers the product you use.

Related terms

Comparisons SOC 2 vs ISO 27001 SOC 2 is a US audit report, written by a CPA firm, on how well a vendor's security controls are designed and run. ISO 27001 is an international certification that a vendor runs a managed security program. Both are useful, and SOC 2 gives you more detail to read. Security and Compliance ISO 27701 ISO 27701 is an international standard for managing privacy: how a company handles personal data as a controller or processor. It began as a privacy extension to ISO 27001, and its 2025 edition became a standalone standard. Security and Compliance SOC 2 SOC 2 is an independent audit report on a vendor's security controls, written by a CPA firm under AICPA standards. It shows what an auditor tested and found for specific systems over a specific period, not a blanket promise that your data is safe. AI and Your Data ISO 42001 ISO 42001 is an international standard for managing how a company builds and uses AI. A certificate shows an outside auditor checked the company's AI governance process, not that any AI product is safe. Security and Compliance Security Questionnaire A security questionnaire is a list of questions a buyer sends a vendor about how it protects systems and data: access, encryption, testing, incidents and subprocessors. The answers describe the vendor on the day they were written. Vendor Documents Trust Center A trust center is a vendor's page or portal for security, privacy and compliance information, such as SOC 2 reports, certificates, subprocessor lists and security policies. Some documents are public, and others need sign-up or an NDA.

Sources

Last reviewed