A customer sends a supplier assessment form, and one question on it stands out: "Do you have an ISO 27001 certificate?" This article explains what ISO 27001 is, who issues the certificate and how a company can prepare for the process.
What is ISO 27001?
Officially named ISO/IEC 27001, it is the international standard for information security management systems (ISMS; BGYS in Turkish). By ISO's own description, it is the best-known standard in this field worldwide, and it sets out the requirements that an information security management system must meet.
The standard is aimed at companies of every size and in every sector. Its purpose is to provide a framework for a company to establish, implement, maintain and continually improve its information security management system.
A quick note on the abbreviation: in everyday speech the standard is called "ISO 27001." But because it is published jointly by ISO and the International Electrotechnical Commission (IEC), its official abbreviation is ISO/IEC 27001.
Which version is current?
According to ISO's standard page, the version currently in force is ISO/IEC 27001:2022. The third edition of the standard was published in October 2022. The previous 2013 version has been withdrawn. In 2024, an amendment introducing climate-action-related changes to the 2022 version was published (ISO/IEC 27001:2022/Amd 1:2024).
This detail matters because ISO recommends always citing the standard by its full reference: "certified to ISO/IEC 27001:2022" rather than "ISO 27001 certified." When reviewing a supplier's certificate, you need to check which version it was issued against.
The three things the standard sets out to protect
ISO explains the foundation of the standard through three principles of information security:
| Principle | ISO's description | Risk example (ISO) |
|---|---|---|
| Confidentiality | Only authorized people can access the information | Customers' login details being stolen and sold |
| Integrity | Data is stored reliably and is not deleted or corrupted | An employee accidentally deleting a row from a file during processing |
| Availability | Information can be accessed when needed | A database going offline because of a server problem and inadequate backups |
According to ISO, a system that meets the requirements of the standard protects these three properties by applying a risk management process, and gives interested parties confidence that risks are being adequately managed. The standard does this not through technology alone, but through a holistic approach that addresses people, policies and technology together.
Who issues the certificate?
This is the most commonly confused point. ISO's own explanation is clear: ISO does not carry out certification and does not issue certificates. Certification is performed by independent certification bodies. In other words, a company cannot be certified "by ISO."
ISO distinguishes between the two concepts as follows:
- Certification: An independent organization giving written assurance (a certificate) that a product, service or system meets specified requirements.
- Accreditation: An independent body (an accreditation body) formally recognizing that a certification body operates in line with international standards.
In Türkiye, the accreditation body is TÜRKAK (the Turkish Accreditation Agency). ISO notes that a certificate obtained from an accredited organization can provide an additional layer of confidence, because the certification body's competence has been independently verified. The same explanation also states that accreditation is not mandatory, and that not being accredited does not mean an organization is untrustworthy.
How do you choose a certification body?
ISO's recommendations come down to three points:
- Compare several organizations.
- Check whether the organization uses the relevant CASCO standard (the standards of ISO's committee on conformity assessment) in its certification process.
- Check whether it is accredited. To do this, you can contact the national accreditation body in your country or look at the international IAF CertSearch database.
How do you verify a certificate?
To verify a certificate presented by a supplier, ISO points to two routes: searching for the certificate in the IAF CertSearch database, or asking the certification body that issued the document, or the accreditation body, directly. In Türkiye, TÜRKAK's Belge Doğrulama Sistemi (Certificate Verification System) makes it possible to verify electronically the management system certificates issued by organizations accredited by TÜRKAK.
Preparing for certification: where do you start?
Because the standard itself is a list of requirements, preparation is the work of building a management system; it is not a one-off technical project. The sequence below is not the clauses of the standard but a general framework for planning your preparation:
- Define the scope. Will the system cover the whole company, or specific units or services?
- Inventory your information assets. Which data, systems and processes will be protected?
- Assess the risks. For each asset, write down what could go wrong in terms of confidentiality, integrity and availability, and what the impact would be.
- Select and implement controls. Put measures in place, in proportion to risk, in areas such as access rights, backup, supplier management and incident response.
- Involve your employees. As ISO emphasizes, information security is not only about technology; it is a matter of people and policy.
- Carry out an internal audit and a management review. Then apply for an audit by the certification body you have chosen.
Certification is voluntary. According to ISO, some companies apply the standard only to benefit from the good practices it contains, while others also obtain a certificate to give assurance to their customers.
How widespread is it?
According to the ISO Survey 2022 data cited by ISO, more than 70,000 ISO/IEC 27001 certificates were reported across 150 countries and in every economic sector, from agriculture and manufacturing to social services. According to the ISO Survey 2021, roughly one in five valid certificates was in the information technology sector.
Conclusion
ISO 27001 is a framework that turns information security from an IT topic into a part of company management. Before you start the certification journey, clarifying three questions will make your task easier: What will the scope be, which are your most critical information assets, and which accredited body will you get the certificate from?
Why logistics experience matters here. The preparation steps above will look familiar to anyone who has run a warehouse or a distribution network. Defining the scope is much like deciding which sites and flows belong in a network design; the information-asset inventory works like a stock count, because you cannot protect what you have not listed; and the internal audit and management review mirror the cycle-count-and-reconcile routine that keeps stock records accurate. Supplier management, one of the controls named in step 4, is likewise a daily discipline in an operation that runs on carriers and warehouse partners. One of our consultants brings more than 30 years in operations, logistics and supply chain: at a technology distribution company of roughly one billion dollars in scale, he ran logistics, warehousing, technical service and administrative operations end-to-end, building and leading teams of 100+ people and delivering lasting gains through KPI-driven programs. He has also managed nationwide warehouse and transport operations, large-scale distribution networks, and network and capacity planning at leading retail, logistics and distribution organizations. An industrial engineer, he now brings that supply-chain discipline to SMEs through AI and automation. Meet our consultants.
Related articles: Incident response in a cyber breach · Supplier-originated data breaches and KVKK (Türkiye's data-protection law)
#interimmanagement #forwarddeployedengineering