What ISO/IEC 27001 certification means when you hire a software company

When you hand a software company your business processes, your customer data and access to your systems, you are trusting them with more than code. Many vendors display an "ISO 27001 certified" badge to reassure you. But few buyers know what that badge actually promises, what it leaves out, or how to check it is real. This guide explains it in plain terms so you can use it properly when choosing a partner.

What ISO/IEC 27001 actually is

ISO/IEC 27001 is an international standard for an information security management system, usually shortened to ISMS. It is published jointly by ISO and the IEC. The current edition is ISO/IEC 27001:2022.

The key word is management system. The standard does not hand a company a fixed list of technical settings. Instead, it requires the company to run a repeatable process for protecting information:

• Define what information and systems are in scope.
• Identify the risks to that information.
• Decide how to treat each risk, usually by applying controls.
• Measure whether the controls work.
• Review and improve the system over time, with leadership involved.

Annex A controls

The standard includes Annex A, a reference set of security controls. In the 2022 edition these are grouped into four themes: organizational, people, physical and technological. They cover areas such as access control, secure development, supplier relationships, incident management, backups, encryption and logging. Detailed guidance on each control sits in a companion standard, ISO/IEC 27002.

A company does not have to apply every control. It records which ones apply, which do not, and why, in a document called the Statement of Applicability. That document is one of the most useful things you can ask a vendor about.

How certification works

A company can say it "follows" ISO 27001 without anyone checking. Certification is different. An independent certification body, ideally one accredited by a national accreditation body, audits the ISMS. The initial audit usually happens in two stages: a review of documentation and readiness, then an assessment of whether the system actually operates as described.

A certificate is typically valid for three years, with surveillance audits, usually annual, in between. Before expiry the company goes through a recertification audit. So a valid certificate means the ISMS has been checked recently, not just once years ago.

What certification tells you about a software company

For a buyer, an ISO 27001 certificate is evidence of habits, not a single feature. In a software company it usually means the following things are written down, owned by someone and audited:

• Access control. Who can reach client code, databases and servers, how access is granted, reviewed and removed when people leave a project.
• Secure development. Rules for coding, code review, separating development, test and production environments, and handling secrets such as passwords and API keys.
• Supplier management. How the vendor vets its own suppliers, such as cloud hosts and tools, that may touch your data.
• Incident management. A defined way to detect, report and respond to security incidents, including telling affected clients.
• People. Background checks where appropriate, confidentiality agreements, and security awareness training.
• Business continuity. Backups and plans so a project does not stop because a laptop is lost or a server fails.
• Data handling at project end. How client data is returned or securely deleted when the work is finished.

Without a framework like this, those things depend on individual developers remembering to do the right thing. With it, they are part of how the company works every day.

What certification does not tell you

The badge is useful, but it has limits. Knowing them stops you from over-relying on it.

How to verify a vendor’s certificate

Verification takes a few minutes and is worth doing for any vendor that will touch sensitive data.

1. Ask for a copy of the certificate. It should show the company's legal name, the standard and edition, the scope, the certificate number, the issue and expiry dates, and the certification body.
2. Check the legal name. Make sure it matches the entity you will sign the contract with, not a parent or sister company.
3. Read the scope. Does it include software development and the location where your project will be delivered?
4. Confirm the certification body. Look for an accreditation mark from a recognized accreditation body. Many certification bodies offer an online lookup, and the IAF CertSearch database lists many accredited certificates.
5. Check the edition and dates. The certificate should be current and reference the 2022 edition.
6. Ask how it applies to you. A good vendor can explain, without jargon, how access, environments and data handling will work on your project.

Questions to ask in your vendor evaluation

The certificate opens the conversation. These questions show whether the practices reach your project:

• Who on your team will have access to our production systems and data, and how is that access approved and removed?
• Where will our code and data be stored, and which third-party tools or cloud services will be used?
• Do you use real customer data in development or testing, or masked and sample data?
• How will you tell us about a security incident affecting our project, and how quickly?
• What happens to our data and credentials when the project ends?
• Will you sign an NDA and a data processing agreement where our regulations require one?
• Who owns the source code and intellectual property once the work is paid for?

Vague answers to these questions matter more than the presence of a badge. If you are comparing offshore partners, our guide to choosing a software development partner in India covers the other factors to weigh alongside security.

When ISO 27001 should be a hard requirement

Not every project needs a certified vendor. A small marketing website with no personal data carries little risk. But certification, or at least strong equivalent evidence, should be a firm requirement when:

• The software will hold personal data about customers, employees or patients.
• The vendor will have access to your production environment or live databases.
• The system runs core operations, such as an ERP that handles orders, inventory and accounts. Our custom ERP projects fall squarely in this category.
• Your own customers, auditors or regulators ask how you manage supplier security.
• You operate in a sector with security expectations, such as finance, healthcare or critical infrastructure.

In these cases, a certified partner makes your own audits and customer questionnaires easier, because you can point to an independently audited system rather than a vendor's promises.

Our take

innovatiq is ISO/IEC 27001 certified. For our clients, that means access to their systems, code and data follows a certified information security management process, from controlled access and secure storage to how data is handled when a project ends. It also sits alongside contract terms that matter just as much: clients own the source code and IP once paid, and we sign an NDA on request.

Our advice to any buyer is simple. Treat ISO 27001 as a strong signal, then verify it and ask how it applies to your work. A good partner will welcome the questions. If you want to see how we handle security on a project like yours, talk to our team and we'll walk you through it.

Frequently asked questions

Written by the innovatiq TeamWe design and build custom ERP, CRM and mobile apps for businesses worldwide, from Kalol and Ahmedabad, Gujarat.