ISO 27001 Certification Support, Start to
AUDIT

ISO/IEC 27001 is the international standard for information security management, published by the International Organization for Standardization. It does not hand you a list of technology to buy. It requires you to run aninformation security management system, an ISMS: a defined scope, a risk assessment, controls chosen and justified, internal audits, and management review. Certification means an accredited certification body has audited that system and found it conforms. The certificate is issued by that body, not by your IT provider and not by your consultant.

Source: ITS, "What Does the ISO 27001 Update Mean for Your Business?", published 2023-02-07.

Ask them for the wording, because they are different deliverables. ISO 27001 is an international certificate awarded by an accredited body for a management system. SOC 2 is an American attestation report written by a CPA firm about a window of time. Buyers in Europe usually ask for ISO 27001; buyers in the United States usually ask for SOC 2. If both are being asked for, the control work overlaps heavily and the evidence can be collected once. The audits cannot. If you want the detail of what a SOC 2 report contains, we have written it up.

No, and no managed service provider can. Certification has to come from an accredited certification body that is independent of the people running your controls, which is the whole point of it being worth something to your buyer. What ITS does is the rest: scope the system, run the gap assessment, build the ISMS, operate the day to day controls, prepare the evidence, and coordinate with your auditor through the audit. Anyone who tells you they will certify you has misunderstood the standard, or is hoping you have.

The management system clauses barely moved. Annex A was rebuilt: 114 controls became 93, reorganized from fourteen groupings into four themes, Organizational, People, Physical and Technology. Eleven controls are new, and they are the modern ones: threat intelligence, cloud services, data masking, information deletion, data leakage prevention, monitoring activities, web filtering, secure coding, configuration management, ICT readiness for continuity, and physical security monitoring. If you are starting now, you start on the current version and none of this is migration work.The full breakdownis on our blog.

Source: same ITS post. Note that post attributes Annex A to ISO 27002; the controls are published in ISO/IEC 27001 Annex A with implementation guidance in ISO/IEC 27002, and this answer uses the correct attribution.

They overlap and they are not interchangeable. ISO 27001 certifies an information security management system for any organization in any sector. TISAX is the automotive industry's own assessment and exchange mechanism, built on an information security questionnaire derived from ISO 27001 and required by many manufacturers of their suppliers. If an original equipment manufacturer asked you for TISAX, ISO 27001 alone will not satisfy them. We have written the comparison up in full.

On its own, no. ISO 27001 is a voluntary standard, and nobody fines you for not holding it. What makes it feel mandatory is commercial: an enterprise customer, an international partner, a procurement questionnaire or an insurer asks for it, and the deal waits. That is a real deadline, but it is your customer's, not a regulator's. Worth knowing before you budget for it, because it changes who inside your business owns the project and how it gets justified.