A customer has asked for ISO 27001 in a security questionnaire: how to respond

Supplier security questionnaires often include a direct question about ISO/IEC 27001, the international standard that sets out requirements for an Information Security Management System (ISMS). The current edition is ISO/IEC 27001:2022 [1]. For a supplier without a certificate, the question can feel decisive. In practice, how you answer it, and what you offer alongside the answer, usually matters as much as the answer itself.

What the question is asking

A buyer asking about ISO/IEC 27001 is normally trying to establish whether your organisation manages information security in a systematic way: whether risks are identified and treated, whether controls are chosen for a reason, and whether someone is accountable for keeping the system working. Certification is one way of evidencing that. ISO itself does not certify organisations. Certificates are issued by independent certification bodies, and in many countries those bodies are accredited by a national accreditation body [2].

Guidance from the UK National Cyber Security Centre (NCSC) encourages customers to gain confidence in a supplier's security through questions covering governance, incident management, data protection, personnel security and independent testing, among other areas [4]. The NCSC's wider supply chain guidance frames this as an ongoing relationship rather than a single checkpoint [5]. A questionnaire is therefore often the start of a conversation, even where the procurement team has a firm policy on certification.

Answer accurately

The most damaging response is an inaccurate one. Phrases such as "ISO 27001 in progress" or "aligned with ISO 27001" are vague, invite follow-up questions and may later be relied on in a contract. Accredited certificates can be checked by buyers through IAF CertSearch, a database of certifications issued by certification bodies accredited under the International Accreditation Forum arrangements [3]. A claim that cannot be verified tends to reduce trust rather than build it.

A precise answer states your current position and, where relevant, what is under way. Depending on your circumstances, that might be one of the following:

• We do not hold ISO/IEC 27001 certification. Our information security controls are documented and we can provide evidence under a non-disclosure agreement.
• We do not currently hold certification. We have begun implementing an ISMS against ISO/IEC 27001:2022 and can share our scope, risk assessment approach and progress.
• We do not currently hold certification. We have engaged a certification body and can share the planned audit arrangements once confirmed.

Evidence you can offer without a certificate

Many questions in a supplier questionnaire can be answered on their merits regardless of certification status. Access control, encryption, backup, incident response and personnel security are all matters of fact about how you operate. Where you process personal data on behalf of a UK customer, the Information Commissioner's Office (ICO) expects controllers to choose processors that can demonstrate appropriate security, which gives the buyer a legitimate reason to ask detailed questions [6].

Evidence that buyers commonly accept, subject to their own policies, includes:

• Current information security policies, with owners and review dates.
• A risk register and a record of how significant risks are being treated.
• A recent independent penetration test summary and evidence of remediation.
• An incident response plan and the date it was last exercised.
• A sub-processor list showing locations and the categories of data shared.
• Cyber Essentials or Cyber Essentials Plus certification, for UK buyers who recognise the scheme [7].

Cyber Essentials is a UK government-backed scheme covering five technical controls, and the NCSC's supply chain guidance points to it as a way of gaining assurance that suppliers have fundamental controls in place [5] [7]. It is narrower than ISO/IEC 27001 and does not substitute for it where a buyer specifically requires an ISMS certificate, but it can support a response while other work is in progress.

Deciding whether to pursue certification

A single questionnaire is rarely a sufficient reason on its own to begin an ISO/IEC 27001 programme. The decision is better made against the pattern of demand. Relevant questions include how many current and prospective customers ask for certification, whether it is a mandatory procurement criterion or a preference, how much senior time each questionnaire currently consumes, and whether the scope a customer cares about can be defined sensibly as an ISMS scope.

Where buyers do not require certification, its absence often leads to a longer security review instead, with requests for architecture and data flow diagrams, continuity arrangements and test reports. That review can be manageable if the underlying evidence exists. Organisations that sell mainly to consumers or to small businesses without formal procurement may reasonably decide that certification is not yet warranted, and revisit the question as their customer base changes.

What to tell the customer about timing

If you decide to pursue certification, avoid committing to an audit date or certificate date that depends on others. The certification body sets its own audit schedule and makes the certification decision independently [2]. How long preparation takes depends on your starting position, the scope you choose and how long your controls need to operate before they can be evidenced. It is more credible to share the steps you have taken, the scope you are working to and the evidence available now, and to update the customer as dates are confirmed.

Support is available for organisations assessing their readiness against ISO/IEC 27001:2022 and preparing evidence for customer questionnaires.