Do I need ISO 27001 to win government IT contracts?

ISO/IEC 27001 is the international standard for an information security management system, and the security certification public buyers ask for most often around the world. Whether you need it depends on what you sell and to whom.

When it is likely to matter

• You host, process or can access sensitive public data, such as health or personal records.
• You bid for managed services, cloud or cybersecurity work.
• Your target buyers list it as a mandatory requirement again and again.

When something else may do

• UK: Cyber Essentials is the baseline for many central government contracts.
• US: buyers and states often accept SOC 2, and federal cloud work needs FedRAMP instead.
• Australia: agencies often ask about Essential Eight maturity, and IRAP for cloud services.
• Small projects: many buyers accept a completed security questionnaire.

What it takes

For a firm of 10 to 50 people, certification usually takes six to twelve months, through a certification body accredited by a recognized accreditation body, such as UKAS, the Standards Council of Canada or ANAB. Certificates last three years, with surveillance audits every year. Costs vary, so get quotes from several accredited bodies.

If you're not certified, never say you are. You can say you follow the standard, but buyers who ask for certification want a certificate. See ISO 27001 for government suppliers.