ISO/IEC 27001

Saying a company is good at security is hard to prove. You can show how many servers you run or how long your password rules require, but no list of items like that adds up to evidence that the whole organization is managed. There is no baseline to judge what might be missing.

Cross a border and the problem multiplies. Every country has its own scheme, and every buyer's security questionnaire — the security document a customer sends before signing — asks in its own categories. What a German customer's form requires and what a domestic scheme requires overlap heavily, but the names and groupings differ, so the seller proves the same thing two or three times: once in the local format, once in the buyer's format, and once again in whatever audit tool the buyer happens to use.

ISO/IEC 27001 set that baseline once and made it international. Published jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC), it carries the same meaning regardless of country or industry. Its defining trait is that it does not hand out instructions item by item. The company identifies its own risks, chooses measures that fit them, and documents both what it chose and what it left out and why. That is how one standard can apply to a ten-person company and a ten-thousand-person company at the same time.

It removes the work of proving the same thing again in each market. One certificate finishes the conversation with a North American buyer and a European one alike. A domestic scheme reads poorly abroad and an American standard carries less weight in Europe; this one is read the same way everywhere. A company with revenue outside its home market that picks only one certification usually picks this.

Internally it works as the frame for building a management system. The standard comes in two parts.

1. The clauses — how to establish and run the management system. What leadership is accountable for, how risk gets assessed, how objectives are set and reviewed. Miss these and no certificate is issued; they are not optional.
2. The Annex A control list — roughly ninety controls grouped into organizational, people, physical and technological. Each is one line describing one measure that reduces one risk, such as revoking a departing employee's access or testing backup restores.

The two are joined by the Statement of Applicability. It is a table that records, for every control on the list, either that the company applies it or that it doesn't apply here, with a reason. A company without a server room excludes the server room access control. Excluding is not a fault; failing to write down why is.

The audit and its cycle run like this.

1. Set the scope. Decide which services and which parts of the organization sit inside the certification, and that line gets printed on the certificate itself.
2. Assess risks and select controls, arranging procedures so that evidence — the record proving things were done as written — accumulates on its own.
3. Run an internal audit and a management review. Both are required by the standard, not just good practice.
4. The certification body audits the documentation in stage 1 and the site in stage 2.
5. A surveillance audit follows each year, and a recertification audit in the third.

The deciding factor is which country the customers currently blocking a deal are in.

1. ISMS-P — South Korea's national scheme, which law requires above certain thresholds, so it comes first for a company whose revenue is mostly domestic. It also examines how personal data is handled.
2. SOC 2 — the format American enterprise buyers ask for. It arrives as a report written by an accounting firm rather than a pass, and it examines whether controls actually operated over a period.
3. Extension standards in the same family — to cover a specific area such as privacy or cloud services, a company adds a companion standard on top of ISO/IEC 27001. The extensions can't be certified on their own.
4. Answering questionnaires directly — still cheaper below roughly ten customers. Overseas buyers ask for a certificate more often, though, so the crossover arrives sooner than it does at home.

Plenty of companies end up holding two of these. Since well over half of what they ask overlaps, the second takes far less time than the first. Build a mapping between the two control lists once and the same evidence gets submitted in a different format.

"First check whether this service is inside the scope."

What matters is not that a certificate exists but what it covers.

"We marked that control as excluded and recorded the reason."

The item doesn't apply to our situation, and the justification is on file.

"In Europe this certificate clears most of it."

Contract review proceeds without going through an individual questionnaire.

At Pagedeck the subject opened with the first customer abroad. The review document Sofia brought back from a German company had a line for the certificate, and after she answered that there wasn't one, two months passed with no reply. Grace deferred it on cost until three deals had stalled for the same reason, then started preparing.

Half of that preparation turned out to be vendor assessment rather than paperwork. Pagedeck runs on nearly twenty outside tools, and because customer data flows into them, the audit looks there too. Theo spent three weeks just building the table of what data leaves for which tool.

A common reading is that every control on the list has to be applied. With ninety-odd items attached, it looks like a checklist. In practice the structure asks the company to select what matches its risks and exclude the rest with a stated reason. Insisting on applying all of them puts a server room policy into a company that has no server room, and a rule nobody follows sits in the documentation as something for an auditor to flag.

The second is reading a certificate as covering the whole company. The company's name is on the cover, so that is how it looks. But certification has a scope, and the scope is printed on the certificate. If the product a customer uses falls outside it, that certificate is worthless for that particular contract. This is why experienced buyers read the scope line before they read the company name.