standard

ISO 27001

A voluntary standard for running security as a management system. No law requires it. Customers often do, and it gives the laws a structure to hang on.

last checked 2 November 2026not legal advice
what it is
An international standard, ISO/IEC 27001:2022, with one amendment listed by ISO.
who it covers
Whoever chooses it, or whose customer contract requires it.
who checks
A certification body, against a scope you define.
penalties
None under law. You can lose the certificate or the contract.
legal weight
NIS2 says to take standards into account. That does not make a certificate proof of compliance.

basis NIS2 Art. 21(1)

01

what it is for

Laws say what must be true. The standard says how to keep it true next year. For a first-time company that loop is the main value.

what the standard adds: a loop

  1. 1scopewhat is in, what is out
  2. 2risk assessmentand how you treat each risk
  3. 3controlschosen from annex A, exclusions explained
  4. 4internal auditdoes it run?
  5. 5management reviewwhat changes

every year, with a certification body checking the cycle

basis ISO/IEC 27001:2022, structure as commonly published. Not re-read at source.

basis ISO/IEC 27001:2022, structure as commonly published and not re-read at source

02

the board decision

Probably not for the law. No EU rule on this site requires the certificate. NIS2 mentions standards as something to take into account, and the implementing regulation asks you to assess effectiveness without naming a certificate. Ask your lawyer and your supervisor how your country treats it.

Possibly for sales. Customers ask for it in questionnaires. Before you commit a year to it, find out who would accept something less.

basis NIS2 Art. 21(1); IR 2024/2690 Annex 7

03

how it relates to the work here

do the work once, and buy the proof you are asked for

  1. 1do the control workthe nine rows of the map
  2. 2keep the evidencedated, owned, filed

the same file feeds

  • ISO 27001a certificate for a scope
  • SOC 2an auditor's report on a period
  • your own answerto a regulator or a customer

basis working practice. No legal text sets this.

A company doing the work on this site has done much of the annex A work and produced much of what an auditor will ask for. Scope, internal audit and management review are what you add.

basis working practice. No legal text sets this.

04

a certificate has limits

A certificate covers the scope you chose, so one on a product does not cover your HR system. When a regulator asks about something outside the scope, the certificate does not answer the question. The standard is paid and was not re-read in full for this page, so check clause and control numbers against your licensed copy.

basis working practice. No legal text sets this.

check it yourself

fyi Last checked 2 November 2026. This is not legal advice. It is a plain reading of the texts listed on this page, and national law can add to them. Before you rely on it in front of a regulator, an auditor or your board, have a lawyer confirm it for your company. What this means.

your next step

Before you scope anything, ask your three largest customers whether they require a certificate or would accept your evidence.

see the map