←  All terms
I
Security & Compliance

ISO 27001

ISO/IEC 27001 is an international standard for establishing, operating, and continually improving an information security management system.

ISO/IEC 27001 is an international standard for establishing, operating, and continually improving an information security management system. The appropriate design depends on the data, risk, and jurisdiction and requires both technical and organizational review. The concept is closely related to SOC 2 and Governance.

Read more

SOC 2

Governance

Audit Log

GDPR

FAQ

ISO 27001

When does pursuing ISO 27001 certification pay off?
Certification pays off when customers, tenders, or regulation demand independent proof. Most of the effort lies not in the audit itself but in running the management system continuously, with risk analysis, documentation, and internal reviews. Small teams without a proof obligation can often start with documented baseline measures and decide on certification later.
Is ISO 27001 enough for GDPR compliance?
No, ISO 27001 does not replace a data protection review. The standard addresses information security, whereas the GDPR also covers legal bases, data subject rights, and processor agreements under Article 28. A certificate can support technical and organizational measures, but the legal assessment remains a separate task that depends on the individual case.
What does an ISO 27001 certificate tell about a service provider?
The certificate shows that an independent body has audited the information security management system within a defined scope. Products, sites, and systems outside that scope are not covered, and secure operations are not guaranteed. What matters is the scope statement, the validity date, and whether the services actually being purchased fall inside it.
How do ISO 27001 and SOC 2 differ?
ISO 27001 certifies a management system, while SOC 2 is an auditor's report on how well defined controls work. One follows an international standard, the other an attestation framework from the US accounting profession. Which one a buyer asks for depends on the buyer's requirements. Neither document replaces a buyer's own assessment of the vendor.