ISO 27001 for government suppliers: is it worth it?

ISO/IEC 27001 is the most widely recognized security certification in public IT tenders around the world. It's often a mandatory requirement for contracts involving personal data, hosting or managed services, and a scored advantage in many others.

What it is

ISO 27001 sets out how to run an information security management system (ISMS): a structured way of finding your security risks, choosing controls to manage them, and checking and improving them over time. The current version is ISO/IEC 27001:2022, with its control list in Annex A, organized into organizational, people, physical and technological controls.

It's not a technical checklist. It's about having a managed, documented, audited process.

What certification involves

1. Scope: decide what parts of the business the ISMS covers, such as the whole firm or one service.
2. Risk assessment: identify your information security risks.
3. Controls: choose and put in place controls to manage them, documented in a Statement of Applicability.
4. Policies and records: write the required policies and keep evidence that you follow them.
5. Internal audit and management review.
6. Certification audit: an accredited certification body audits you in two stages.
7. Surveillance audits every year, and recertification every three years.

Time and cost for a small firm

For a firm of 10 to 50 people, getting certified usually takes six to twelve months. Costs include the certification body's audit fees, staff time, any consultant help, and tools. Ask several accredited certification bodies for quotes, and budget for the yearly audits too.

Is it worth it?

Get ISO 27001 if:

• Your target buyers regularly list it as mandatory or score it.
• You host, process or have access to sensitive public data.
• You want to bid for managed services, cloud or security work.

Consider alternatives first if:

• You mostly sell small projects to buyers who accept lighter assurance.
• Your buyers are in the UK, where Cyber Essentials is often the baseline.
• Your US clients want SOC 2 instead.

Make sure it's accredited

Buyers usually expect certification from a body accredited by a recognized accreditation body, such as UKAS, the Standards Council of Canada or ANAB. Check before you sign up.

Common questions

Is ISO 27001 required for government contracts?

Not always, but it's a common requirement for contracts involving sensitive data, hosting or managed IT services, and is often scored as an advantage elsewhere.

How long does ISO 27001 certification last?

Certificates last three years, with surveillance audits each year in between.

Can I say we're "ISO 27001 compliant" without certification?

You can say you follow the standard, but buyers who ask for certification want a certificate from an accredited body. Be clear about which you have.