ISO/IEC 27001
ISO/IEC 27001 is the international standard that sets the requirements for an information security management system (ISMS). Companies can be certified against it by an accredited certification body.
- Also called
- ISO 27001, ISO/IEC 27001:2022, ISO 27001 certification, ISMS standard
- Category
- Security and compliance
- Updated
ISO/IEC 27001 is published jointly by ISO and the IEC. The current version is ISO/IEC 27001:2022, the third edition, published in October 2022, with one amendment in 2024 that adds climate action changes. It does not list a fixed set of tools. It sets out how an organisation runs an information security management system (ISMS): understanding its risks, choosing controls to treat them, assigning responsibility, and reviewing and improving the system over time.
Certification is optional and ISO itself does not certify anyone. Independent certification bodies audit the ISMS and issue the certificate, and accreditation bodies check that those certification bodies are competent. ISO recommends naming the full reference, “certified to ISO/IEC 27001:2022”, rather than a bare “ISO 27001”.
Why it matters for a SaaS company
For SaaS companies selling to larger organisations, and especially to buyers in Europe, ISO 27001 is often a line item in security questionnaires and procurement checklists. A valid certificate answers a whole group of questions at once. Its scope matters as much as its existence: a certificate that covers one office or one product is not the same as one that covers the platform the buyer will use.
Buyers can verify a certificate with the certification body that issued it, or through the IAF CertSearch database. Any claim you make on your website should hold up when they do.
How DesignMe handles it
DesignMe does not implement, audit or certify management systems, and nothing here suggests DesignMe holds an ISO/IEC 27001 certificate. Certification stays with your compliance team and your certification body. Our part is presenting the facts they confirm, clearly, on the pages buyers check: security pages and trust center pages designed and built as part of a website design project. We show the standard and edition, the scope, the certification body and a route to the certificate, and we say plainly when certification is in progress.
Example
Say a fintech infrastructure company is certified to ISO/IEC 27001:2022 for its production platform and holds a SOC 2 Type 2 report. Its security page lists both, with the certificate scope in one sentence, the certification body’s name, the certificate number for verification, and a link to download the certificate. The SOC 2 report sits behind an NDA request on the same page.
Common mistakes
- Writing “ISO certified”. ISO does not certify. Name the certification body and the full standard reference.
- Showing an outdated edition. Certificates based on the 2013 edition are no longer valid.
- Hiding the scope. If only part of the business is covered, say which part.
- Using the ISO logo. ISO does not allow its logo to be used to show certification. Use the certification body’s mark under its rules.
- Claiming certification during the audit. Until the certificate is issued, say the audit is in progress.
Questions
- What is the difference between ISO 27001 and SOC 2?
- ISO/IEC 27001 is an international standard: an accredited body certifies that your information security management system meets it, and you get a certificate. SOC 2 is an American attestation report from a CPA firm on specific controls, with no certificate. US buyers often ask for SOC 2, European and global buyers often ask for ISO 27001, and many vendors end up with both.
- Is an ISO 27001:2013 certificate still valid?
- No. The International Accreditation Forum gave certification bodies until 31 October 2025 to move clients to the 2022 edition, and certificates based on the 2013 edition expired or were withdrawn at the end of that period. A current certificate should name ISO/IEC 27001:2022.