What is ISO 27001?
ISO/IEC 27001 sets requirements for an information security management system (ISMS). The current edition is ISO/IEC 27001:2022, with Amendment 1:2024 on climate action changes. It is published jointly by ISO and the IEC.
ISO does not certify organizations. Independent certification bodies audit against the standard and issue certificates, and accreditation of those bodies is handled separately through national accreditation bodies. A certificate has a scope statement, so it covers only the sites, activities and systems that it names.
Annex A lists information security controls aligned with ISO/IEC 27002:2022, which has 93 controls in four themes: organizational, people, physical and technological. An organization selects the controls that apply to its risks and records that choice.
Certificates to the 2013 edition had to be transitioned to the 2022 edition by 31 October 2025 under International Accreditation Forum rules. A certificate that still cites ISO/IEC 27001:2013 should be treated with caution and checked with the certification body.
How it touches on-site IT work
- Certificate scope: a certificate for a head office or a service desk may not cover the independent engineers who attend your site. Ask what the scope statement includes.
- Physical and supplier controls: the standard's control themes include physical security, supplier relationships, media handling, access control, logging and incident management, which are the same topics that matter during site visits.
- Your own ISMS: a customer with an ISMS has to manage supplier risk, so field providers often receive requests for NDAs, screening, access rules and incident reporting.
- Media and equipment: removed drives, retired devices and spares need handling records, which the customer's own audit may ask to see.
- Records: work notes, asset records and photos from a visit become part of the customer's evidence.
- No certificate does not mean no controls. A provider can agree and evidence specific controls in the written scope.
What you can agree in a written scope
- Access rules for the site: named engineers, ID checks, escorts, time windows and sign-in records.
- Confidentiality commitments for everyone who attends, including independent engineers.
- A rule on subcontractors: approval first, and the same terms passed down.
- Media and equipment handling: custody log, transport method, wipe or destruction method and evidence.
- Photo and records rules: what is captured, where it is stored and when it is deleted.
- Incident notification: route, time target and what counts as reportable.
- The customer's right to ask for the provider's certificate and scope statement, or to receive answers to a security questionnaire.
- Return or deletion of customer information at the end of the work.
Questions to ask any field services provider
- Are you certified to ISO/IEC 27001:2022, and which body issued the certificate?
- What is the exact scope on the certificate, and does it include the people who would visit our site?
- When does the certificate expire, and is the issuing body accredited?
- If you are not certified, how do you control access, suppliers, media and incident reporting?
- Which subcontractors work under your controls and which work under their own?
- Can you complete our supplier security questionnaire?
This page is general information and not legal advice. Deploris does not claim certification or compliance status here. Confirm what applies to you with your own counsel or compliance team.