The security standard most recognized in the world
ISO/IEC 27001 is a voluntary international standard for managing information security; the current version is from 2022. It’s not a law — it’s a certification that demonstrates your security posture to clients and auditors. At Kardu it’s the backbone: one piece of evidence satisfies ISO 27001 and automatically maps to the other frameworks.
This guide summarizes the standard in plain language and does not replace advice from an accredited auditor.
What ISO 27001 is
It applies to any organization that wants to demonstrate its security posture in a verifiable way, and rests on three pillars.
A management system
It’s not just technical controls — it’s how your organization identifies risks, decides what measures to take, and reviews them over time.
93 controls in 4 themes
Organizational, people, physical and technological — you choose the ones that apply to your organization based on your risk analysis.
External certification
An accredited auditor verifies your management system meets the standard — it’s not a self-assessment.
Certification cycle
01 / Initial audit
Stage 1 and Stage 2
In Stage 1 the auditor reviews your documentation and whether you’re ready; in Stage 2 they verify the controls actually work in practice.
02 / Certification
Valid for 3 years
If you pass the audit, you get the ISO 27001 certificate, valid for three years.
03 / Surveillance and recertification
Annual audit, recertification every 3 years
Annual surveillance audits keep the certificate active; the full audit repeats every three years.
93
Controls
4
Themes
3 years
Certificate validity
12 months
Surveillance audit
What you risk without certification
ISO 27001 is voluntary — there’s no authority that fines you for not having it. The risk is commercial and reputational, not legal.
| Area | What you lose | Detail |
|---|---|---|
| Commercial | You lose RFPs and contracts that require it | More and more large clients require ISO 27001 as a condition to sign or renew a contract. |
| Trust | You can’t demonstrate your security posture in a verifiable way | Without certification, you depend on answering security questionnaires manually, one for every client that asks. |
The base for everything else
ISO 27001 is the base: its security measures are reused across the other frameworks, so you don’t duplicate work. Each framework adds what its law specifically requires, such as deadlines for reporting incidents or registers of its own.
What it means for your SME
Even though no law forces you, more large clients ask for ISO 27001 before signing a contract. It’s also the most efficient starting point if NIS2, DORA, ENS or GDPR apply to you.
6 minimum requirements
- A defined management system scope
- An information security policy
- Risk analysis and treatment
- Statement of Applicability: which controls you apply and why you rule out the rest
- An internal audit plan
- Management review
Official sources
This guide is a summary. For the standard’s detail, consult ISO directly.
ISO 27001 on iso.org →ISO 27001 is your starting point
Kardu builds your management system on ISO 27001 and automatically maps every piece of evidence to NIS2, DORA, ENS and GDPR, so you upload each document only once.
Kardu is not a certification body and does not issue ISO 27001 certificates: it prepares your documentation and evidence for the external audit.