Drawing 1 · Interactive
Check a provider's ISO 27001 certificate
7/7
ticked
- Required
- 4 / 4
- Optional
- 3 / 3
Certificate checks passed: request the SoA and DPA next
Every item ticked.
Certificate checks passed: request the SoA and DPA next. 7 of 7 ticked.
What is ISO/IEC 27001?
ISO/IEC 27001 is the international standard, published jointly by ISO and IEC, that sets requirements for an information security management system (ISMS): the policies, processes, roles and records an organisation uses to identify information security risks and treat them. The current edition is ISO/IEC 27001:2022, amended in 2024 to add climate-change considerations to the clauses on organisational context.
The standard has two parts. Clauses 4 to 10 are mandatory management requirements: define the scope, secure leadership commitment, assess and treat risks, set objectives, run operations, measure, audit internally, review and improve. Annex A is a reference list of 93 controls grouped into four themes (37 organisational, 8 people, 14 physical and 34 technological), covering topics from access control and logging to secure development and supplier security. An organisation chooses controls based on its own risks and justifies each inclusion or exclusion in a Statement of Applicability.
Certification is carried out by an independent certification body, ideally one accredited by a national accreditation body. The certificate states its scope (the services, locations and teams covered) and lasts three years, with surveillance audits in the intervening years and a recertification audit before expiry. Unlike SOC 2, which produces an attestation report describing how controls operated, ISO/IEC 27001 results in a certificate against the standard. Neither replaces legal duties under the DPDP Act or sector rules such as PCI DSS for card data.
Key takeaways
- ISO/IEC 27001 specifies how to run an information security management system (ISMS) built on risk assessment and continual improvement.
- The 2022 edition's Annex A lists 93 controls in four themes: organisational, people, physical and technological.
- Certificates last three years with surveillance audits in between; 2013-edition certificates had to move to 2022 by 31 October 2025.
- Certification proves an audited management system for a stated scope, not that a provider cannot be breached.
- SOC 2 is an auditor's attestation report; ISO/IEC 27001 is a certification against a published standard.
Design intent
Why does ISO/IEC 27001 matter?
Choosing a WhatsApp provider means handing over customer phone numbers, conversations and API credentials. An ISO/IEC 27001 certificate whose scope covers the messaging platform tells you an independent auditor has checked that the provider runs a working risk-management system, with an audit log, access reviews and incident handling rather than policies on paper, and it shortens your own security review. Knowing what the certificate does not prove keeps you asking the right follow-up questions.
Operating sequence
How does ISO/IEC 27001 work?
Define the ISMS scope
The organisation decides which services, locations and teams are covered. For a messaging provider that should include the platform, its hosting and the support teams that touch customer data.
Assess and treat risks
It identifies threats to confidentiality, integrity and availability, rates them, chooses treatments, and records the selected Annex A controls in the Statement of Applicability.
Operate and measure
Controls run day to day (access reviews, logging, incident response, supplier checks), with internal audits and management reviews to find and fix gaps.
Pass the certification audit
An external certification body runs a Stage 1 review of the documentation and a Stage 2 audit of how the ISMS really operates, then issues a three-year certificate.
Keep it alive
Surveillance audits in years two and three and a full recertification at the end of the cycle check that the ISMS is maintained and improving.
Specifications
ISO/IEC 27001: key facts and limits
- Current edition
- ISO/IEC 27001:2022, with Amendment 1 (2024)
- Annex A controls
- 93, in 4 themes (37 · 8 · 14 · 34)
- Mandatory clauses
- 4 to 10 (context to improvement)
- Certificate validity
- 3 years
- Surveillance audits
- In years 2 and 3 of each cycle
- 2013 → 2022 transition deadline
- 31 October 2025
- Key document
- Statement of Applicability (SoA)
Example: Three certificates, one that counted
A Mumbai NBFC shortlists three WhatsApp providers for loan-status alerts, and all three say they are ISO 27001 certified. On review, the first certificate was issued against the 2013 edition and has lapsed; the second covers only the provider's sales office; the third is a 2022-edition certificate from an accredited certification body whose scope names the messaging platform, its hosting and support operations. The NBFC asks the third provider for its Statement of Applicability, a list of sub-processors and a data processing agreement with breach-notice terms, and moves ahead.
Failure modes
Common mistakes with ISO/IEC 27001
Not reading the scope
A certificate may cover only a head office or one product. Check that the scope names the messaging platform, hosting locations and teams that will handle your data.
Treating the certificate as proof of no breaches
ISO/IEC 27001 shows a managed risk process, not perfect security. Still ask about incidents, penetration tests and breach-notification terms.
Accepting expired or unaccredited certificates
Check the issue and expiry dates, that it is against the 2022 edition, and that the certification body is accredited by a recognised accreditation body.
Forgetting sub-processors
A provider's certificate does not cover Meta, cloud hosts or other suppliers. Ask how they are managed under the provider's supplier-security controls.
Confusing certification with legal compliance
Certification does not by itself make a provider compliant with the DPDP Act or the CERT-In Directions. Those are legal duties to check separately in your contract and DPA.
Recommended practice
Best practices for ISO/IEC 27001
- Ask for the certificate and the Statement of Applicability (often shared under NDA) at the same time.
- Check the certificate on the certification body's public register where one exists.
- Map your security questionnaire to the four Annex A themes so answers can be reused across vendors.
- If you seek certification yourself, start with a tight scope and widen it in later cycles.