When is an ISO 27001 certification required?

ISO standards are fundamentally an important part of our economy, as they ensure the quality and safety of both products and services in international trade. Companies can benefit from ISO standards because they can help reduce costs through improved systems and processes.

Likewise, they build consumer confidence - products and services that meet certain standards and reassure consumers that they are safe and of good quality.

What is ISO 27001?

An ISO 27001 certification shows your customers, business partners, and even your employees that you recognize risk, assess the impact, and implement and enforce systematized controls to best limit damage to the organization and all of its connections.

The increased security of systems and their information intuitively creates trust with customers and business partners.

In principle, any company with sensitive information can benefit from ISO 27001. Learn more here.

‍

When is an ISO 27001 certification mandatory?

Normally, companies need to do an ISO 27001 certification when they are required to enforce their technical security and introduce a seamless legally correct use of IT in the organization. This is especially true for critical infrastructures (KRITIS), which are organizations and facilities in Germany in the fields of State and Administration, Food, Finance and Insurances, Water, Media and Culture, Transport and Traffic, Information Technology and Telecommunication, Health and Energy.

KRITIS organizations must prove that their IT Security is state of the art according to §8a BSIG. This means that an Information Security Management System (ISMS) needs to be implemented according to ISO 27001 or IT Grundschutz by BSI.

‍‍

Why should other organizations besides KRITIS implement an ISMS?

‍
As a result of the Cybersecurity Act and other standards, this is not only a factual and liability law problem, but increasingly also a criminal law and existential problem for companies, because the number of cyber attacks is continuously increasing.

In order to organize operational IT in a legally compliant manner, one should follow recognized standards such as ISO 27001. The technical standards of DIN ISO 27001 provide the guidelines that regulate the handling of in-house IT, because there is a legal obligation to ensure IT compliance.    

This duty and responsibility of management to comply with the law or to ensure compliance arises not only from the Cybersecurity Act, but also from the Administrative Offenses Act, the Stock Corporation Act and the Limited Liability Companies Act. According to these, those responsible are obliged to avert economic damage to the company and therefore not to tolerate violations of the law.

Due to an increasingly networked society, there are ever larger and more piquant areas of attack, for example hydroelectric power plants, wind turbines, solar energy plants, biogas plants, coal-fired power plants and the super-gau, nuclear power plants. But cyberattacks can also put entire communities and swaths of land out of action, with attacks on local water and energy supplies or simply on traffic lights. This adds a new dimension to the concept of liability.
‍
As a result of the aforementioned Cybersecurity Act, the operators of these critical infrastructures, especially energy suppliers, but also e.g. hospitals, insurance, healthcare and financial companies, are obliged to take adequate protective measures. For this reason, stricter obligations, such as the implementation of contact points for reporting security incidents to the German Federal Office for Information Security (BSI), have been imposed on such socially significant supply apparatuses.

Although DIN ISO 27001 is based on the implementation of information security controls, none of these controls are generally binding for compliance with the standard. This is because the standard recognizes that each organization has its own requirements when developing an ISMS and that not all controls are appropriate in each case.

‍

Short explanation of "When does a company need ISO 27001"

If you would like to watch the video in German, click here.

‍

With an ISO 27001 certification, you become a globally recognized trustworthy company.

‍While KRITIS industries have been working on and off with security and certifications for the last decade, there is a new emerging trend. More and more B2B SaaS startups and scaleups get certified for ISO 27001 standard early on according to Forbes. Why?

Why ISO27001 certification for B2B SaaS startups and scaleups

B2B SaaS companies can build confidence in their product by demonstrating their early customers, partners and investors commitment to secure the customer data from the day one. In a data-driven society of today, having ISO27001 seal creates an enormous market advantage over non-certified competitors, leaving them in the dust.

SaaS business DNA - automate ISO27001 and SOC 2 fast using cloud-based tools

B2B SaaS companies are famous for using modern standardized cloud-based tools like Task Trackers (e.g. Jira and Notion), Identity Providers (e.g. Google Workspaces and Okta), Cloud Services (AWS, GCP, Azure) which if combined and automated can build a reliable, scalable and sustainable security and compliance machine. We call this machine Secfix Platform. Secfix Platform can save you up to 90% of time during implementation of security standards like ISO 27001 and SOC 2 and put your compliance on autopilot for years after the certification.

‍

Download our ISO 27001 guide to understand why ISO 27001 certification can help you with all your business needs!