Is ISO 27001 certification required by law?

No. ISO 27001 is voluntary. Customers, partners and tenders often ask for it, and it helps with legal duties such as NIS2.

Does Guardera issue the ISO 27001 certificate?

No. An independent certification body audits your organisation and issues the certificate. We prepare your security management system and your team for that audit.

What happens at the certification audit?

An independent auditor checks your documents first, then checks that your team follows them. If you pass, the certificate is valid for three years, with a check-up audit each year.

Can we certify one service rather than the whole company?

Yes. The boundary must make sense and include the teams, suppliers and systems the service depends on.

Does ISO 27001 cover GDPR?

Partly. GDPR is EU law on personal data, and ISO 27001 is a voluntary standard. An ISO 27001 security management system helps with GDPR’s security duties, but not with the whole law.

International standard

ISO 27001: information security management and certification

ISO 27001 is an international standard for an information security management system (ISMS), the way your company organises the protection of information. Certification comes through an independent audit. It is voluntary, but large customers and tenders often ask for it.

Plan ISO 27001 certification See our ISO 27001 preparation service

Type: International information security standard
Current version: ISO/IEC 27001:2022 (2013 certificates ended on 31 October 2025)
Who it suits: Organisations worldwide
Certificate cycle: Three years, with yearly check-up audits

Who it applies to

Businesses seeking independently checked security

Organisations whose customers or tenders ask for ISO 27001 certification.
Teams that want defined responsibilities and repeatable security routines.
Businesses preparing a whole organisation or a defined service for certification.

You can certify the whole company or one service, as long as you include what it relies on.

What it asks of you

Build a working security management system

Decide what to include
State which services, teams and systems your security rules cover.
Choose safeguards for your risks
List information risks, decide how to address them and explain which of the 93 safeguards in the standard’s Annex A you select.
Make security work repeatable
Assign owners, train people and keep dated access reviews, test results and training records.
Review and correct problems
Carry out internal audits and management reviews to assess how the management system works, then address the findings.

How we help

Prepare the system and your team

We build your security policies and routines around how you work. We help put safeguards in place and prepare the policies, security logs and test results the auditor will ask to see.

ISO 27001 Certification ConsultancyBuild a working information security management system and prepare for independent ISO 27001 certification. Cybersecurity Audit & Risk AssessmentAn independent assessment of security and compliance, with risk-based findings and practical recommendations. Security Awareness & Management TrainingPractical cybersecurity training that helps staff recognise threats and leaders manage security risks.

Common questions

Related regulations and standards

SOC 2
An independent auditor’s report on how you protect customer data. Much of the ISO 27001 work can be reused for it.
NIS2
The EU cybersecurity law for critical sectors. ISO 27001 helps with much of its work, but not with its national rules or incident reporting.

Free 30-minute call

Decide what your certificate will cover

Bring your customer’s requirements to a free 30-minute call and discuss what certification would cover.

Plan ISO 27001 certification hello@guardera.tech