ISO 27001 is the international standard that sets out how a company should manage information security: understand which data it handles and what risks that data faces, choose measures to reduce those risks, check that the measures work and correct them over time. If you are asking what ISO 27001 is because a vendor highlights it in their proposal, here is the short answer: the certificate covers the way that company manages information, not the software it will deliver to you. It is worth something, as long as you read it carefully and turn it into contract clauses.
This guide is written for the person on the other side of the table: the owner or IT manager of a small or mid-sized business who has to choose a software vendor and hand over customer records, orders, price lists and employee data.
What is ISO 27001, in plain terms
The full name is ISO/IEC 27001. It describes the requirements for an information security management system, or ISMS (SGSI in Italian). The standard does not list products to buy. It asks the company to work with a written method: assess risks, decide how to treat them, apply the chosen measures, measure how effective they are, run internal audits and hold a periodic management review. It applies to any organisation, of any type and size, as stated in the standard's entry in the UNI catalogue.
The most practical part is Annex A, a list of 93 security controls grouped into four themes:
| Theme | Controls | Some examples |
|---|---|---|
| Organisational | 37 | policies, supplier relationships, incident management, business continuity |
| People | 8 | staff screening, training, remote working, confidentiality agreements |
| Physical | 14 | office entry, equipment protection, clear desk and clear screen |
| Technological | 34 | privileged access, backups, logging, cryptography, secure development |
The company does not have to apply all of them. It has to compare the measures it has chosen against that list and record, in a document called the Statement of Applicability, which controls it applies, which it excludes and why. A fifteen-person software house with no server room will have much lighter physical controls than a data centre, and the standard allows for that.
The detail of how each control is applied sits in another standard, ISO/IEC 27002, which is a guideline and cannot be certified against. The current edition of 27001 is the one ISO published on 25 October 2022, with a 2024 amendment that only adds a reference to climate change. In Italy it is adopted as UNI CEI EN ISO/IEC 27001:2024+A1:2024.
ISO 27001 certification: who issues it and how long it lasts
Anyone can adopt the standard without getting certified. ISO 27001 certification comes when an external certification body audits the system and, if everything checks out, issues a certificate. Who that body is matters a lot. In Italy, certification bodies are accredited by Accredia, the Italian national accreditation body, which belongs to the European and global networks of accreditation bodies and has signed the mutual recognition agreements. That is why a certificate issued by a body accredited in Italy is recognised as equivalent to those issued by accredited bodies in the other signatory countries. There are also certificates issued by non-accredited bodies. They may be issued in good faith, but in that case nobody checks the people who did the checking.
The certification cycle lasts three years, as set out in ISO/IEC 17021-1, the standard that governs certification bodies. After the initial audit the body comes back at least once per calendar year for a surveillance audit (European Accreditation note), and a recertification audit is needed before expiry. If the company stops maintaining the system, the certificate can be suspended or withdrawn.
There is one date worth remembering. The previous version of the standard, from 2013, is no longer valid: the IAF transition document, IAF MD 26, required all certifications based on ISO/IEC 27001:2013 to expire or be withdrawn by 31 October 2025. A valid certificate today shows the 2022 edition. If a vendor sends you an “ISO 27001:2013” certificate, they are showing you an expired document.
What a certified vendor guarantees, and what it doesn't
The certificate says that the company manages information security with a documented system and that an external body checks it every year. It does not say that the business software it delivers to you is free of vulnerabilities, and it does not promise that the company will never have an incident.
| The certificate tells you | The certificate does not tell you |
|---|---|
| that information risks are assessed and treated with a written method | that the software built for you has passed a security test |
| that security measures are chosen, documented and checked by an external body | how quickly you will be told about an incident: the contract sets that |
| which activities and sites are covered, in the scope | that activities outside the scope follow the same rules |
| that there is an audit at least once a year | that the vendor complies with GDPR in every processing activity it carries out for you |
GDPR deserves a few more lines. When a vendor processes personal data on your company's behalf (customers, employees, orders), Article 28 of the GDPR requires you to use only processors that provide sufficient guarantees on technical and organisational measures, and to govern the relationship with a contract or other legal act. An ISO 27001 certificate is good evidence of those guarantees. You still need the contract, with the appointment of the vendor as data processor: it answers questions the certificate does not touch, such as what the vendor may do with your data and what happens when the relationship ends.
Take a typical case. A distributor hires a software house to build its ordering portal. To try out a new feature, a developer copies the production database, with every customer record in it, onto their own laptop. The vendor is certified, yet nobody had asked where copies of the data used for testing would end up. The certificate alone does not tell you how the vendor handles test data. If you ask before signing and put the answer in the contract, you know.
How to check an ISO 27001 certificate in five minutes
Ask for the PDF of the certificate. A certified company will provide it without fuss and often publishes it on its website. Then check these points:
- The edition of the standard: it must be ISO/IEC 27001:2022.
- The company name and address: they must match the company you are signing with, not a parent company or a partner.
- The scope, meaning the sentence that describes the activities covered. If you are buying software development and the scope only mentions reselling licences, the service you care about is not covered.
- The certification body and the accreditation mark (in Italy, Accredia).
- The issue and expiry dates.
- The current status. Search for the certificate number or the VAT number in the Accredia certification database or on IAF CertSearch. The Accredia database can also list suspended certificates: look at the status shown, not just whether the name appears.
The database check is the one people skip most often, yet it is the only one that tells you whether the certificate is valid today: a suspended certificate looks exactly like a valid one.
Questions to ask a certified software house
After the certificate come the questions. They add to the ones in our checklist for choosing a software house, and it pays to ask them before signing and to ask for written answers:
- Does the service you are selling me fall within the scope of the certificate? Show me the exact sentence.
- Who on your team will have access to our production data, with what permissions, and how do you revoke access when someone moves to another project or leaves the company?
- Do you use real data or anonymised data for development and testing? Where are the copies kept?
- Where is the data hosted, and which of your own suppliers (cloud, hosting, email, support) can access it?
- If you have an incident involving our data, how quickly will you notify us and with what information?
- When did you last test restoring a backup, and how did it go?
- When the relationship ends, in what format will you return our data and how will you confirm that your copies have been deleted?
A certified vendor should already have these answers written down somewhere, because the management system requires it to document exactly these things. If the answers are vague or take weeks to arrive, the certificate is worth less than it looks. The last question also helps on the day you decide to switch vendor: migrating data to a new business system is much simpler if the return format is already written into the contract.
ISO 27001 for SMEs: do you need to get certified too?
Certification is voluntary, and no law generally requires it of a small business. If your company manufactures, distributes or installs things and does not sell IT services, in most cases getting certified is not worth it. The work of building and maintaining the system (risk analysis, procedures, training, internal audits, a certification body audit every year) weighs heavily on a small organisation. What you need instead is a handful of measures done well, such as two-factor authentication, tested backups, regular updates and reviewed access rights, plus vendors that work with a verified system. The basic measures are in our guide to cybersecurity for SMEs.
Things change in three situations: when you sell digital services or handle data on behalf of your customers, when larger customers send you ever longer security questionnaires, and when you bid for tenders where certification earns points or is required. In these cases ISO 27001 for SMEs becomes a sales tool as well as an organisational one, and it is worth planning calmly, starting from a narrow scope.
A word on NIS2. If your company falls within the scope of the Italian NIS decree (Legislative Decree 138/2024, Italy's transposition of the NIS2 Directive), it has legal obligations on cyber risk management and incident notification, described by Italy's National Cybersecurity Agency (ACN). ISO 27001 helps organise that work, but the certificate and compliance with the decree remain two separate assessments, with different rules.
The Selli case
Sellinnate S.r.l., the company behind Selli, has its information security management system certified to ISO/IEC 27001:2022 by Kiwa Cermet Italia S.p.A., a body accredited by Accredia. The certificate is no. 22621-L, valid from 5 August 2026 to 4 August 2029 and subject to annual surveillance. The scope is “produzione e sviluppo di software non connessi all'edizione” (production and development of software not connected with publishing) and “servizi di consulenza informatica” (IT consulting services), so it covers the work we do when we build custom software for our clients.
What we wrote above applies to us too. The certificate covers how we manage information inside the company, meaning processes, roles, controls and incident management, and it does not certify the individual pieces of software we develop. On the certifications page you will find the PDF of the certificate with its number, certification body and scope. On our projects we use a separate staging environment for testing, and the source code remains the client's property.
If your problem can be solved with ready-made standard software, do not pick the vendor for its certificate: pick it for the product, and check the certificate of whoever hosts your data.
Let's talk
Are you assessing a software vendor and want to work out which security requirements to put in the contract? Or would you like to see our certificate and its scope applied to a real project? Book a call with us: we start from the data your company handles and who needs to work with it, and we tell you what to ask, whether of us or of anyone else.