CevroISO 27001 certification for companies selling globally
ISO/IEC 27001 is the international standard for an information security management system (ISMS). Unlike SOC 2, it results in a certificate issued by an accredited certification body, which is why it carries weight in procurement outside the United States.
What the standard requires
You define the scope of your ISMS, assess information security risks, choose and implement controls to treat them, and keep improving through internal audits and management review. The management system matters as much as the individual controls.
Annex A controls
The 2022 edition of Annex A lists 93 controls grouped into four themes. You document which apply to you and why in a Statement of Applicability.
- Organizational controls
- People controls
- Physical controls
- Technological controls
How certification works
A certification body audits in two stages: a documentation review, then an assessment of implementation. Certificates run for three years with annual surveillance audits. Organizations certified to the 2013 edition were required to transition to the 2022 edition by 31 October 2025.
Practical preparation
- Set a realistic scope before you map controls
- Keep a living risk register tied to owners and deadlines
- Collect evidence continuously instead of before the audit
- Run an internal audit and management review before the certification audit
How Cevro helps
- Cevro runs automated checks against 11 connected systems (cloud, source code, identity, people and payments) and maps each result to ISO 27001 and the other frameworks you track.
- Every failing control comes with a specific fix and a way to re-check it, so the gap list turns into a task list.
- Evidence collected for one framework is reused for the others, and anything a scan can't produce goes into the evidence vault.
- A live trust page and exportable evidence let you answer buyers and auditors without starting from a blank spreadsheet.
Frequently asked questions
Is ISO 27001 required by law?
No, it is voluntary. Customers, regulators or tenders may require it, particularly in Europe, the Middle East and Asia.
Can ISO 27001 and SOC 2 share evidence?
Largely yes. Access control, logging, change management and risk assessment evidence overlaps heavily, which is why mapping one body of evidence to both frameworks saves time.