Choosing an ISO 27001 certified software company: what to look for
By Yassine Seghrouchni, founderUpdated 6 min read
The short answer
An ISO 27001 certificate shows that a software company has set up information security as a management system and that a certification body audits it periodically. It doesn't mean every solution the company builds automatically meets your requirements. So check the certificate, the scope and the certification body, and make agreements per project about data, access and support.
About this guide: written by Your Tech Club, with no ranking and no names of other agencies. How we do it ourselves is set out separately under How Your Tech Club works.
What to look for in an ISO 27001 certified software company
The first four points are about the certificate itself. The other four are about what you actually want to know: how information security shows up in your project.
The certificate is genuine and valid
Ask for the certificate. It states the name of the certified organisation, the standard, the scope, the certification body and an expiry date.
Check that the name matches the company you are signing the contract with, and that the certificate is still valid.
Ask in the meetingCan we see the certificate, and was it issued to the organisation we are contracting with?The certification body is accredited
A certificate is only worth as much as the body that issues it. In the Netherlands, the Dutch Accreditation Council (Raad voor Accreditatie) accredits certification bodies; in other countries a comparable national body does the same.
A certificate from a body without accreditation gives far less assurance.
Ask in the meetingWhich body certified you, and under which accreditation?The scope covers the work you are buying
The scope describes which part of the organisation falls under the management system: which locations, services and processes.
If software development, hosting or support falls outside that scope, the certificate says little about the work you are commissioning.
Ask in the meetingDoes the work we are buying from you fall within the scope of the certificate?The company can explain the controls for your project
ISO 27001 comes with a Statement of Applicability: an overview of the controls the organisation applies, and why some don't apply.
You don't need to see everything, but a company should be able to explain which controls matter most for your project.
Ask in the meetingWhich controls matter most for our project, and how will we see them in practice?Security is built into the development process
A certificate is about the organisation. What you want to know is how it shows up in your project: who has access to code and environments, how code is reviewed before it goes live, how third-party packages are kept up to date and how vulnerabilities are fixed.
Ask in the meetingHow does a change get from code to production with you, and who reviews it?Agreements on data and suppliers are in writing
Software runs with hosting providers and uses third-party services. Ask where your data is stored, which sub-processors are involved and how that is set out in a data processing agreement.
For AI applications, add the question of which data goes to which model provider.
Ask in the meetingWhere is our data stored, which parties process it and where is that recorded?Incidents and continuity are covered
Ask what happens when things go wrong: how an incident is reported, who informs you and under which agreements.
Also ask what happens to your software if the partnership ends. Code and documentation that belong to you make that straightforward.
Ask in the meetingHow do you report a security incident, and what do we get if we stop working together?Quality is assured as well
ISO 27001 is about information security. ISO 9001 is about quality management: how an organisation keeps its commitments, deals with mistakes and keeps improving.
For software projects the two go together. A company with both certificates has also had its way of working audited externally.
Ask in the meetingHow do you record what has been agreed, and how do you deal with mistakes?
Questions to ask in the first meeting
Take this list to your first meetings. A partner that suits you gives a concrete answer to every question, even if that answer is that something can't be done.
- Can we see the certificate, and which organisation was it issued to?
- Which body certified you, and under which accreditation?
- Does our project fall within the scope of the certificate?
- Which controls matter most for our project?
- Who gets access to our code, environments and data?
- How does a change get from code to production?
- Where is our data stored, and which sub-processors are involved?
- How and when do you report a security incident?
- What do we get if we end the partnership?
- Are you also ISO 9001 certified?
What an ISO 27001 certificate doesn't tell you
A certificate is a good starting point. It doesn't replace the agreements in your own project. For example, it doesn't mean:
- that every solution the company builds meets your security requirements;
- that the company never has an incident;
- that work outside the scope falls under the same management system;
- that you no longer need your own agreements on data, access and hosting.
ISO 27001, NEN 7510 and the BIO
ISO 27001 is the international standard for information security. Some sectors in the Netherlands also have their own frameworks: NEN 7510 in healthcare, and the Baseline Informatiebeveiliging Overheid (BIO), the information security baseline for Dutch government. Both build on the same principles as ISO 27001.
If you work in one of these sectors, don't just ask about the certificate, but also how the company handles the requirements of your framework.
How Your Tech Club handles information security
This part is about us. The points above apply to any partner, including us: feel free to hold us to them.
Your Tech Club is certified for ISO 27001 and ISO 9001 by Kiwa. For us, information security and quality are part of the delivery, not something added afterwards. Feel free to ask for the certificate and its scope.
That doesn't mean every solution automatically meets your requirements. For each project we make agreements on data, access, hosting and support, and put them in writing. Code and documentation are yours.
We build custom software for processes that don't fit a standard package, and AI applications that work with your data. In both cases, information security is part of the design from the start.
- ISO 9001 and ISO 27001, certified by Kiwa
- 500 projects delivered
- 4.8 from 127 reviews
- 90% returning clients
- Office on Duivendrechtsekade in Amsterdam
- Founded by Joey van Vliet and Yassine Seghrouchni
Frequently asked questions
What does ISO 27001 mean for a software company?
The company has set up a management system for information security: it has mapped its risks, chosen and recorded controls, and has a process for continuing to improve. An accredited certification body audits this periodically.
How do I check whether an ISO 27001 certificate is genuine?
Ask for the certificate and check the name of the organisation, the scope, the certification body and the expiry date. You can often also look up the certificate or have it confirmed by the certification body.
Is ISO 27001 mandatory for a software supplier?
Not by law. But clients, especially government bodies and organisations in healthcare or financial services, regularly make it a procurement requirement. It also makes it easier to show that your supplier handles your data with care.
Does ISO 27001 guarantee there will be no data breach?
No. It shows that risks are managed systematically and that there is a process for reporting incidents and learning from them. A certificate is no guarantee against incidents.
What is the difference between ISO 27001 and ISO 9001?
ISO 27001 is about information security. ISO 9001 is about quality management: how an organisation works, keeps its commitments and improves. For a software company the two complement each other.
What is a Statement of Applicability?
An overview of the controls in the standard, stating for each control whether the organisation applies it and why. It shows how the organisation has translated the standard to its own situation.
What does ISO 27001 have to do with AI applications?
An AI application works with your data and sometimes sends it to a model provider. A company with ISO 27001 should be able to explain which data goes where, how that is recorded and which controls apply.
Is ISO 27001 enough for healthcare or government?
It's a good foundation. In Dutch healthcare NEN 7510 also applies, and for Dutch government the BIO. Ask how the company handles the requirements of your framework.
