In plain words

Think of ISO 27001 as a driving licence for how a company looks after information. It does not prove you will never have an accident. It proves you know the rules, check your mirrors as a habit, and that an examiner watched you do it.

ISO/IEC 27001 is an international standard, published by ISO and the IEC, for running an information security management system, or ISMS. An ISMS is the set of policies, people, processes and technology a company uses to find its security risks, decide what to do about them, and keep checking that it works. The current version is ISO/IEC 27001:2022. 1

A company can be certified against the standard by an independent certification body. In fintech, the certificate is one of the first things a bank partner, card programme or enterprise customer asks to see, because it shows security is managed as a system rather than left to one engineer.

How it works

How ISO 27001 certification works

The standard asks you to manage risk in a loop, then an auditor confirms the loop is real.

  1. 1

    Set the scope and assess risk

    Decide which parts of the business the ISMS covers, list what could go wrong with your information, and rate each risk.

  2. 2

    Choose controls

    Pick controls from Annex A to treat the risks, and record which apply and why in a Statement of Applicability.

  3. 3

    Run, measure and review

    Operate the controls, run an internal audit and a management review, and fix what they find. This loop is the heart of the standard.

  4. 4

    Certification audit

    An accredited certification body reviews your documents (stage 1), then tests that the ISMS works in practice (stage 2), and issues the certificate.

What the 93 Annex A controls cover

The 2022 version groups its 93 reference controls into four themes. You do not have to apply all of them, but you must justify every one you leave out. 1

37

Organisational

Policies, roles, supplier security, incident management, business continuity, legal and regulatory requirements.

8

People

Screening, terms of employment, security awareness training, and what happens when people join, move or leave.

14

Physical

Offices, secure areas, equipment, clear desks and screens, and disposal of devices and media.

34

Technological

Access control, encryption, logging and monitoring, secure development, backups, vulnerability management and network security.

The 2022 version also added controls that matter a lot to fintech teams, such as threat intelligence, security for cloud services, secure coding and data leakage prevention.

The three-year certification cycle

A certificate is not a one-off. It lasts three years, and the certification body keeps checking in between.

  1. Year 1: initial auditStage 1 checks your documents and readiness. Stage 2 tests that the controls run in practice. Any major nonconformities must be fixed before the certificate is issued.
  2. Year 2: surveillance auditA shorter audit, usually once a year, that samples part of the ISMS and checks that earlier findings were closed.
  3. Year 3: surveillance auditAnother sample. Changes to scope, systems or suppliers get particular attention.
  4. RecertificationA full audit before the certificate expires starts the next three-year cycle.

Check that the certification body is accredited. In the UK, that means accreditation by UKAS; other countries have their own national accreditation bodies. A certificate from an unaccredited body carries far less weight with partners. 2

The move from the 2013 version to the 2022 version ended in October 2025. A certificate against ISO/IEC 27001:2013 is no longer valid, so a supplier quoting one is out of date.

ISO 27001 vs SOC 2

ISO 27001SOC 2
What you getA certificateAn attestation report
FocusThe whole management system and its risk processSpecific controls against five Trust Services Criteria
Who issues itAn accredited certification bodyA licensed CPA firm
Where it is most commonUK, EU, Gulf and internationallyUnited States
CycleThree years, with yearly surveillance auditsNew report every year

ISO 27001 in the UK, EU and Gulf

ISO 27001 is voluntary everywhere, but in practice it is the common language of security due diligence across all three regions.

  • United Kingdom. Banks, card programmes and enterprise buyers commonly ask for it, sometimes alongside Cyber Essentials. It also gives a regulated firm evidence for its own operational resilience and outsourcing oversight.
  • European Union. DORA does not require ISO 27001, but an ISMS built to the standard covers much of what DORA expects from ICT risk management, and financial firms use suppliers’ certificates in their third-party assessments.
  • Gulf. Local rules come first: the SAMA Cyber Security Framework and the NCA Essential Cybersecurity Controls in Saudi Arabia, and Central Bank rules in the UAE. ISO 27001 does not replace them, but it is a widely recognised base to map them onto.

Example: a wallet startup asked for a certificate

Sara is launching a business wallet. Her prospective BaaS partner says it will onboard her, but wants ISO 27001 within a year.

  1. Scope. Sara scopes the ISMS to the product, its cloud hosting and the support team, not the whole group.
  2. Risk assessment. The team lists risks such as stolen admin credentials, a supplier outage and a bad deployment, and picks controls for each.
  3. Evidence. Access reviews, change approvals and incident logs start being recorded. A penetration test checks the app.
  4. Internal audit. An internal audit finds that leavers keep access for days. It is fixed and re-checked.
  5. Certification. Stage 1 and stage 2 pass with two minor findings, and the partner receives the certificate and scope statement.

Common misconceptions

“Our hosting provider is ISO 27001 certified, so we are too.”

Their certificate covers their scope. Your company, your product and your people need their own ISMS and their own certificate.

“ISO 27001 is a pile of policies.”

Policies are the start. Auditors test that the controls actually run, with records to show it.

“Once certified, we are done for three years.”

Surveillance audits happen in between, and the ISMS must keep improving. Certificates can be suspended.

FAQ

What is ISO 27001 certification?

It is independent confirmation, by an accredited certification body, that a company runs an information security management system that meets the ISO/IEC 27001 standard. The certificate states exactly which parts of the business it covers.

How long does ISO 27001 certification take?

For a small fintech that starts from scratch, preparation typically takes several months, followed by a two-stage certification audit. The timeline depends mostly on how many controls are already working and how long you need to show they run.

How long is an ISO 27001 certificate valid?

Three years. The certification body runs surveillance audits in the years between, usually once a year, and a full recertification audit before the certificate expires.

What is Annex A in ISO 27001?

Annex A is the list of reference security controls. The 2022 version has 93 controls in four themes: organisational, people, physical and technological. You decide which apply to you and explain your choices in a Statement of Applicability.

Is ISO 27001:2013 still valid?

No. The transition period to ISO/IEC 27001:2022 ended in October 2025, so certificates against the 2013 version are no longer valid. Ask any supplier quoting a 2013 certificate when they moved to the 2022 version.

Is ISO 27001 better than SOC 2?

Neither is better; they answer different needs. ISO 27001 certifies your whole security management system and is widely recognised internationally, while SOC 2 is a detailed US attestation report on specific controls. Choose the one your partners ask for.

Related terms

SOC 2Penetration testingISO 22301Cyber EssentialsPCI DSSDORAOperational resilienceSAMA CSFNCA ECCGDPR

Sources

  1. 1 I

    ISO ISO/IEC 27001:2022 Information security management systems

    https://www.iso.org/standard/27001
  2. 2 U

    UKAS United Kingdom Accreditation Service

    https://www.ukas.com/