What is ISO 27001 and how it helps you win deals

A contract with a larger customer, or a buyer in another country, is close. Then procurement routes you to a security review. The first line of the questionnaire asks whether you hold ISO 27001. If the answer is no, the deal does not die, but it stalls. You spend the next three weeks evidencing controls one by one to people who would rather have ticked a box and moved on.

That moment is where ISO 27001 earns its keep. It is the international standard enterprise and overseas buyers ask for before they sign, and holding it turns a slow security review into a short one. This guide explains what ISO 27001 is, who asks for it, and how the certificate opens deals that were previously closed to you.

What is ISO 27001

ISO 27001 is the international standard for an information security management system, a documented and risk-based way of protecting the information a business holds. It is published jointly by the International Organization for Standardization and the International Electrotechnical Commission. The current edition is ISO/IEC 27001:2022, and certification is issued by an independent accredited body and held by the organisation for three years.

The standard does not prescribe a fixed list of technologies. It asks an organisation to assess its information risks, decide which controls apply, and run a system that keeps those controls working over time. Annex A sets out 93 controls grouped into four themes: organisational, people, physical and technological (ISO/IEC 27002:2022). A business documents which of those controls it uses, and why, in a Statement of Applicability. That document is the artefact a serious buyer most often asks to see.

The 2022 edition replaced the older 2013 version. The migration window closed on 31 October 2025 under IAF MD 26, so any current certificate is to the 2022 edition. You do not need to track the older version.

Who asks for ISO 27001

Enterprise procurement teams ask for it as a default. When a large organisation onboards a new supplier, its third-party risk process treats a recognised certificate as the baseline, and its absence as a reason to dig deeper. The bigger the buyer, the harder the gate.

International buyers ask for it because the certificate travels. A UK certificate issued under a properly accredited body is recognised across the economies that belong to the International Accreditation Forum, so a buyer in Germany or the United States can trust a certificate issued in London without re-auditing you from scratch.

The accreditation chain matters here, and it is worth getting right. A credible certificate is issued by a certification body that is itself accredited by a national accreditation body. In the UK that is the United Kingdom Accreditation Service, the sole national body appointed by government (ukas.com). A self-issued or non-accredited certificate will not clear a careful buyer's review, so an accredited certificate is what actually counts.

The scale of adoption tells you how settled the expectation has become. Tens of thousands of organisations worldwide hold valid ISO/IEC 27001 certificates, and the count has grown year on year (ISO Survey). For a growing company selling into regulated or enterprise markets, the standard has become the security credential buyers expect to see.

How ISO 27001 helps you win deals

The most direct effect is speed through the security review. Enterprise buyers gate new suppliers behind a vendor security questionnaire that can run to several hundred questions, drawing on industry sets like the Shared Assessments SIG or the Cloud Security Alliance CAIQ. Holding ISO 27001 lets you answer a large share of those questions by pointing to your management system, your Statement of Applicability and your audit reports, rather than evidencing each control from a blank page. A review that used to take a month becomes a short exchange.

Market access is the second effect. Enterprise contracts that mandate a recognised certificate become reachable, and so do the public-sector supply chains that push security duties onto their vendors. International buyers who need a credential they can verify are in range too. The standard removes a precondition that was quietly costing you opportunities.

Trust compounds over time. Each cleared review makes the next one easier, references build, and a supplier that can evidence its security posture quickly earns larger contracts than one that cannot. Buyers extend more scope to suppliers they have already vetted.

Arnold Bouwman, Co-founder of Vormats, a SaaS platform for video-led employee storytelling, put the commercial effect plainly:

"Naq has been instrumental in achieving compliance and security, obtaining ISO27001 certification and shortening our sales-cycle by easily demonstrating compliance."

The certificate did the work buyers cared about, and the sales cycle got shorter as a result.

ISO 27001 vs SOC 2

The standard a buyer asks for often depends on where they sit. ISO 27001 is the international standard UK and EU buyers expect. SOC 2 is the de-facto expectation among US enterprise buyers. Many companies selling on both sides of the Atlantic carry both, and because the underlying security controls overlap heavily, much of the evidence gathered for one supports the other.

ISO 27001SOC 2TypeInternational standard with a certificateAttestation report by an auditorStrongest inUK, EU and international marketsUS enterprise marketWhat buyers receiveA three-year certificate plus the Statement of ApplicabilityAn auditor's report (Type I or Type II)RecognitionRecognised across IAF member economiesRecognised primarily in the US

If your growth is UK and European, ISO 27001 is the credential to lead with. If you are selling into US enterprise as well, plan for both, and reuse the shared control evidence across them.

What getting there involves

The path is well worn. You run a gap analysis against the 93 controls, build the management system and the Statement of Applicability, then pass two audits: a Stage 1 documentation review and a Stage 2 on-site review of how the system works in practice. A successful outcome gives you a three-year certificate, with annual surveillance audits to keep it valid and a full recertification at year three.

For a small or medium business, this typically takes somewhere between six and twelve months from gap analysis to certificate. It moves faster where existing frameworks already carry evidence over. A company that holds Cyber Essentials, for example, has already done work that counts towards ISO 27001, so the second standard costs less effort than the first.

That carry-over is the practical case for treating compliance as one connected system rather than a stack of separate projects. Naq runs ISO 27001 alongside the other standards buyers ask for, with the experts to get you there included, so evidence proven once is reused across every standard it maps to and a security review becomes an export rather than a project.

Frequently asked questions

What is ISO 27001?

ISO 27001 is the international standard for an information security management system, a risk-based way of protecting the information an organisation holds. It is published by ISO and IEC, the current edition is the 2022 version, and it covers 93 controls. An independent accredited body issues the certificate, which lasts three years.

How does ISO 27001 help you win deals?

It answers the vendor security questionnaire up front. Instead of evidencing each control from scratch, you point a buyer to your management system, your Statement of Applicability and your audit reports. That clears enterprise and international procurement gates faster and builds the buyer trust that turns into larger contracts.

What is the difference between ISO 27001 and SOC 2?

ISO 27001 is the international standard UK and EU buyers expect, issued as a certificate. SOC 2 is the de-facto expectation among US enterprise buyers, delivered as an auditor's report. Many companies selling across both markets hold both, and the heavy control overlap means much of the evidence is shared.

How long does ISO 27001 certification take?

For a small or medium business, certification typically takes six to twelve months from gap analysis to certificate. It is faster where existing frameworks such as Cyber Essentials already carry evidence over. This is a typical industry range rather than a fixed figure, and it varies with scope and readiness.