ISO 27001: what it is, who needs it, and how certification works

What is ISO 27001?

ISO/IEC 27001:2022 is the international standard for an information security management system: the policies, risk assessment, controls and oversight an organisation runs to keep its information confidential, intact and available. An accredited certification body audits the system and issues the certificate, then returns every year to check it still runs as written.

The current edition is the third, published in 2022. The requirements the certification body audits are clauses 4 to 10, on the harmonised structure (Annex SL) that ISO 9001, ISO 27701, ISO 42001 and the other ISO management system standards written since 2012 share, and the Annex A controls the organisation selects and justifies in its Statement of Applicability.

Who needs ISO 27001?

Software vendors and AI companies in life sciences, whose pharma, biotech and device customers send the security questionnaire before the quality audit, and who hold the certificate beside 21 CFR Part 11, ISO 9001 and ISO 42001

CROs, labs and clinical software providers holding trial or patient data, where the sponsor's audit asks how it is secured

The standard becomes urgent when a security questionnaire asks for the certificate, when the surveillance audit lands and the risk assessment has not moved since the last one, or when a customer audit finds the policies still written to the 2013 Annex A.

ISO 27001 IN QUALIO

Qualio maps your security policies, risks and incidents to ISO 27001 and to ISO 9001, 27701 and 42001 beside it, so each shared clause is answered once

Qualio breaks ISO 27001 down clause by clause and maps your policies, training records, risk register, incidents and corrective actions to each one, in the same library as ISO 9001, ISO 27701 and ISO 42001. It reassesses when a record changes and recommends a fix on each gap. Copilot drafts the policy update and your team approves it. When the auditor's dates land, you export the audit pack by clause.

Security policies and procedures for clause 5.2 and Annex A 5.1 held as controlled documents, with training assigned on the effective date of every revision for clauses 7.2 and 7.3

The information security risk assessment and treatment for clause 6.1 held in the risk register, the same set of risks the quality and product teams work from, with the Statement of Applicability as a controlled document beside it

Internal audit for clause 9.2 and management review for clause 9.3 run as events, with the actions each one raises tracked as tasks on the event

Standards that apply alongside ISO 27001

Management systemsISO 27701: The privacy information management system standard, standalone since its 2025 edition and built on the same clauses, and the one a company holding patient or trial data certifies to next
Management systemsISO 42001: The artificial intelligence management system standard, on the same Annex SL clauses, which shares its policy control, internal audit and management review with an information security management system
Management systemsISO 9001: The quality management system standard on the same clauses, and the certificate most software vendors in life sciences hold first
Electronic records21 CFR Part 11: The FDA's rule for electronic records and electronic signatures in regulated systems, and the access control, logging and change management in Annex A answer much of what it asks a system to show
Pharma manufacturingEU GMP Annex 11: The European rule for computerised systems in GxP, whose supplier assessment, security and access requirements read the same controls a 27001 audit does

Cogstate

Cutting ISO audit prep in half while tripling compliance coverage. Cogstate cut ISO 9001 surveillance audit prep by 50%, predicted more than 70% of auditor findings in advance, and is now pursuing three more frameworks in parallel.

Read the Cogstate story

“Before Qualio, the level of manual effort required to pursue new certifications meant we could only take on one standard per year. Now, we’re managing multiple frameworks simultaneously and staying ahead of them.”

Allison IlesQuality Engineer, Cogstate

Guides and checklists for ISO 27001

Guide

Annex SL: the core of your ISO journey

Checklist

Audit readiness checklist: Be prepared to pass your next audit

Guide

The Life Sciences Guide to AI in Quality and Compliance

Questions about ISO 27001

What is ISO 27001?

ISO/IEC 27001:2022 is the international standard for an information security management system, the policies, risk assessment, controls and oversight an organisation runs to protect its information. An accredited certification body audits the system against clauses 4 to 10 and the Statement of Applicability and issues the certificate. It is the certificate a customer's security questionnaire asks a vendor for.

What changed in ISO 27001:2022?

Annex A. The 2013 edition's 114 controls in 14 domains became 93 controls in four themes, organisational, people, physical and technological, with eleven new controls, among them threat intelligence, cloud services, configuration management, data leakage prevention, monitoring and secure coding. Clauses 4 to 10 had small wording changes. Certificates to the 2013 edition were withdrawn on 31 October 2025.

Is ISO 27001 mandatory?

No law requires it. In life sciences a customer asks for it: a pharma procurement or security team in the vendor questionnaire, a hospital in a tender, a sponsor in a CRO audit, often beside SOC 2 for US customers. The certificate does not stand in for 21 CFR Part 11 or Annex 11, which the customer's quality team audits.

What does Qualio do for ISO 27001, and what does it not do?

Qualio holds the management system's records, policies and training, the risk assessment and Statement of Applicability, incidents, internal audits and management reviews, mapped to their clauses and exported by clause. Qualio is ISO 27001 certified; the certificate is available on request.

Can we add ISO 27001 to the standards we already run in Qualio?

Yes. Add it from the library and Qualio assesses the records you already hold against every clause and Annex A control, so the policy control, training, risk register, internal audit and management review that answer ISO 9001, ISO 27701 or ISO 42001 count towards 27001 without being re-filed. The first assessment lists the security-specific gaps on their own.

Which security questionnaire is open right now?

Bring it and the policies behind the answers. We will show you ISO 27001 assessed against them clause by clause, beside the standards you hold, gaps listed and the audit pack exported.

Book a demo Get started

Less time on audit prep. More time on quality.