Why your customers ask for ISO 27001
ISO 27001 is not a badge for your website. It opens doors in sales. In one attachment, it answers the question every buyer asks: "Is my data safe with you?"
Three situations come up again and again:
- The tender. The specifications require an ISO 27001 certificate. Without it, your bid is set aside before anyone reads it.
- The enterprise contract. Procurement sends you an endless security questionnaire. With a certificate, many of the answers are already covered.
- Vendor due diligence. A customer or an investor reviews your security before committing. The certificate proves an independent third party has already done it.
The hidden benefit: your teams stop filling in questionnaires one by one. They get back to selling and shipping.
A tender coming up?
Check what you need in 30 minutesISO 27001 explained: what the standard really requires
ISO/IEC 27001 is an international standard. It describes how a company manages information security. It does not impose any tool. It asks you to prove that you control your risks.
At its core is the ISO 27001 ISMS. ISMS stands for Information Security Management System: the set of rules, roles and routines that govern your security. In practice, you must:
- Define a scope, meaning the activities, teams and systems covered by the certification.
- Assess your risks and decide how to treat each one.
- Write the policies you need, then apply them.
- Measure, audit internally and correct.
- Have management review the whole system at regular intervals.
Annex A is the standard's catalogue of security controls. The 2022 version lists 93, grouped into four themes. A few examples for each:
- Organizational: policies, supplier management, incident response, business continuity, etc.
- People: awareness, onboarding and offboarding, confidentiality agreements, etc.
- Physical: access to premises, equipment protection, etc.
- Technological: access management, encryption, backups, logging, secure development, etc.
You don't apply everything blindly. You justify each choice in the Statement of Applicability: the document that lists every control, says whether it applies and why.
What ISO 27001 is not:
- Not a penetration test. The auditor assesses your organization, not just your code.
- Not a pile of binders. The auditor wants to see rules in use, not documents gathering dust.
- Not a project for large groups only. The standard adapts to your size and your risks.
- Not a general legal obligation in France. It is first and foremost a requirement from your customers.
How long does ISO 27001 certification take?
- Getting compliant is the work. Scoping, assessing risks, writing, rolling out controls, collecting evidence. This is where time is won or lost.
- The ISO 27001 audit is the validation. An independent certification body runs it in two steps. The stage 1 audit checks your documentation and readiness. The stage 2 audit checks that the controls actually work. ouwba prepares you for both. The certification body decides on the certification.
The length of the audit depends on your headcount and your scope. The certification body calculates it using a method set by the ISO/IEC 27006 standard.
Why so many projects slip:
- A scope that is too broad from the start.
- Evidence collected by hand, in spreadsheets, at the last minute.
- Nobody has dedicated time. The project always comes after the product.
- Policies copied from a template that the team does not follow. The auditor notices.
- A forgotten internal audit and management review. The standard requires both before certification.
ISO 27001, SOC 2, HDS, NIS 2: which one do you need?
It all depends on your customers and your data.
- You sell in Europe, to large companies or to the public sector: ISO 27001 is the expected reference.
- Your customers are American: they often ask for a SOC 2 report (System and Organization Controls 2). It is an attestation issued by an audit firm, not a certification. Discover our SOC 2 support.
- You host health data on behalf of others: HDS certification (French health data hosting) is mandatory in France. Its framework builds on ISO 27001. See our HDS certification support.
- You operate in a regulated sector: the European NIS 2 directive (security of network and information systems) may apply to you. An ISO 27001 ISMS is a solid foundation for it. See our NIS 2 compliance support.
The requirements overlap: the work done for ISO 27001 can be reused.
Torn between ISO 27001 and SOC 2?
Ask an expertYour questions about ISO 27001 certification
What is ISO 27001 certification?
It is recognition, by an independent body, that your company manages the security of its information properly. It is based on the international standard ISO/IEC 27001. The body checks that you have set up an ISMS, meaning an Information Security Management System, and that it actually works. The certificate reassures your customers, partners and investors that their data is protected.
Is ISO 27001 certification mandatory?
No, no French law requires it in general. In practice, it becomes mandatory as soon as a customer demands it: a tender, an enterprise contract, a vendor listing. Some regulations come close. The HDS framework, for health data, builds on ISO 27001. The NIS 2 directive imposes measures that an ISO 27001 ISMS helps to cover.
How long does it take to get ISO 27001 certified?
It depends mostly on getting compliant, not on the audit. With ouwba, plan for a few weeks, depending on your scope and your teams' availability. The audit then runs in two steps: stage 1 for the documentation, stage 2 for the effectiveness of the controls. Projects mostly slip when the scope is too broad or nobody has dedicated time.
What is the difference between ISO 27001 and SOC 2?
ISO 27001 is an international standard. It leads to a certificate issued by an accredited body, recognized mainly in Europe. SOC 2 (System and Organization Controls 2) is an American framework. It leads to an attestation report written by an audit firm. If your customers are European, aim for ISO 27001. If they are American, they will often ask for SOC 2. The two share many requirements.
Do you need an in-house CISO to get certified?
No. The standard requires clear roles and responsibilities, not a full-time CISO (Chief Information Security Officer). In a startup, the CTO or the COO often takes on this role. ouwba's experts bring the security expertise you lack in-house. You keep the decisions, they prepare the work and check every item before the audit.
Does ISO 27001 certification expire?
Yes. The certificate is valid for three years. During this cycle, the certification body runs a surveillance audit every year to check that your ISMS keeps working. After three years, a recertification audit starts a new cycle. Compliance is therefore not a one-off project. Evidence collected automatically makes the audits of the following years much easier.
What happens during the certification audit?
The audit runs in two steps. During the stage 1 audit, the auditor reviews your documentation and checks that you are ready. During the stage 2 audit, they interview your teams, review your evidence and check that the controls actually work. They note any nonconformities, which you fix within a set deadline. The certification body then decides whether to issue the certificate.
Can a 10-person startup get ISO 27001 certified?
Yes. The standard adapts to the size and risks of the company. A small company has fewer systems, fewer suppliers and fewer people to train. The scope is therefore simpler to cover. The real difficulty is time: with ten people, nobody is dedicated to compliance. That is exactly the workload ouwba takes on with its experts.
Where should you start?
Start by framing your need. Which customer requires the certification? By what deadline? Which activities must be in scope? The ouwba assessment answers these questions in 30 minutes with an expert. You leave with a proposed scope, your priorities and a first estimate of the timeline. If your deadline is tight, you will also know whether it is realistic.