--- title: "ISO 27001: what it is, who needs it, and how certification works | Qualio" canonical: "https://www.qualio.com/frameworks/iso-27001" updatedDate: "2026-11-02T11:35:42.000Z" description: "ISO 27001 is the international management system standard for information security. Who in life sciences needs the certificate, what changed in the 2022 edition, and how Qualio maps your policies, risks and incidents to every clause beside the standards you already hold." --- # ISO 27001: what it is, who needs it, and how certification works | Qualio ISO 27001 is the international management system standard for information security. Who in life sciences needs the certificate, what changed in the 2022 edition, and how Qualio maps your policies, risks and incidents to every clause beside the standards you already hold. ## ISO 27001 The international management system standard for information security. ## What is ISO 27001? ISO/IEC 27001:2022 is the international standard for an information security management system: the policies, risk assessment, controls and oversight an organisation runs to keep its information confidential, intact and available. An accredited certification body audits the system and issues the certificate, then returns every year to check it still runs as written. The current edition is the third, published in 2022. The requirements the certification body audits are clauses 4 to 10, on the harmonised structure (Annex SL) that ISO 9001, ISO 27701, ISO 42001 and the other ISO management system standards written since 2012 share, and the Annex A controls the organisation selects and justifies in its Statement of Applicability. ## Who needs ISO 27001? Software vendors and AI companies in life sciences, whose pharma, biotech and device customers send the security questionnaire before the quality audit, and who hold the certificate beside 21 CFR Part 11, ISO 9001 and ISO 42001 CROs, labs and clinical software providers holding trial or patient data, where the sponsor's audit asks how it is secured The standard becomes urgent when a security questionnaire asks for the certificate, when the surveillance audit lands and the risk assessment has not moved since the last one, or when a customer audit finds the policies still written to the 2013 Annex A. ## Qualio maps your security policies, risks and incidents to ISO 27001 and to ISO 9001, 27701 and 42001 beside it, so each shared clause is answered once Qualio breaks ISO 27001 down clause by clause and maps your policies, training records, risk register, incidents and corrective actions to each one, in the same library as ISO 9001, ISO 27701 and ISO 42001. It reassesses when a record changes and recommends a fix on each gap. Copilot drafts the policy update and your team approves it. When the auditor's dates land, you export the audit pack by clause. Security policies and procedures for clause 5.2 and Annex A 5.1 held as controlled documents, with training assigned on the effective date of every revision for clauses 7.2 and 7.3 The information security risk assessment and treatment for clause 6.1 held in the risk register, the same set of risks the quality and product teams work from, with the Statement of Applicability as a controlled document beside it Internal audit for clause 9.2 and management review for clause 9.3 run as events, with the actions each one raises tracked as tasks on the event ## Standards that apply alongside ISO 27001 ### ISO 27701 The privacy information management system standard, standalone since its 2025 edition and built on the same clauses, and the one a company holding patient or trial data certifies to next ### ISO 42001 The artificial intelligence management system standard, on the same Annex SL clauses, which shares its policy control, internal audit and management review with an information security management system ### ISO 9001 The quality management system standard on the same clauses, and the certificate most software vendors in life sciences hold first ### 21 CFR Part 11 The FDA's rule for electronic records and electronic signatures in regulated systems, and the access control, logging and change management in Annex A answer much of what it asks a system to show ### EU GMP Annex 11 The European rule for computerised systems in GxP, whose supplier assessment, security and access requirements read the same controls a 27001 audit does ## Cogstate Cutting ISO audit prep in half while tripling compliance coverage. Cogstate cut ISO 9001 surveillance audit prep by 50%, predicted more than 70% of auditor findings in advance, and is now pursuing three more frameworks in parallel. ## Guides and checklists for ISO 27001 ## Questions about ISO 27001 ### What is ISO 27001? ISO/IEC 27001:2022 is the international standard for an information security management system, the policies, risk assessment, controls and oversight an organisation runs to protect its information. An accredited certification body audits the system against clauses 4 to 10 and the Statement of Applicability and issues the certificate. It is the certificate a customer's security questionnaire asks a vendor for. ### What changed in ISO 27001:2022? Annex A. The 2013 edition's 114 controls in 14 domains became 93 controls in four themes, organisational, people, physical and technological, with eleven new controls, among them threat intelligence, cloud services, configuration management, data leakage prevention, monitoring and secure coding. Clauses 4 to 10 had small wording changes. Certificates to the 2013 edition were withdrawn on 31 October 2025. ### Is ISO 27001 mandatory? No law requires it. In life sciences a customer asks for it: a pharma procurement or security team in the vendor questionnaire, a hospital in a tender, a sponsor in a CRO audit, often beside SOC 2 for US customers. The certificate does not stand in for 21 CFR Part 11 or Annex 11, which the customer's quality team audits. ### What does Qualio do for ISO 27001, and what does it not do? Qualio holds the management system's records, policies and training, the risk assessment and Statement of Applicability, incidents, internal audits and management reviews, mapped to their clauses and exported by clause. Qualio is ISO 27001 certified; the certificate is available on request. ### Can we add ISO 27001 to the standards we already run in Qualio? Yes. Add it from the library and Qualio assesses the records you already hold against every clause and Annex A control, so the policy control, training, risk register, internal audit and management review that answer ISO 9001, ISO 27701 or ISO 42001 count towards 27001 without being re-filed. The first assessment lists the security-specific gaps on their own. ## Which security questionnaire is open right now? Bring it and the policies behind the answers. We will show you ISO 27001 assessed against them clause by clause, beside the standards you hold, gaps listed and the audit pack exported.