In brief
Vietnamese outsourcing firms lose Japan contracts despite ISO 27001 when the scope misses the project or they can't show recent evidence that controls run.
Outsourcing companies end up losing Japan contracts despite ISO 27001 for two common reasons: the certificate's scope does not cover the project the client is buying, or the team cannot show recent evidence that controls still operate. The certificate gets you into due diligence. Evidence from the last few months is what keeps you there.
What do Japanese clients check beyond the certificate?
Japanese enterprise clients commonly treat ISO 27001 as an entry condition and then ask how it applies to their project. Typical questions are what the certificate covers, when the last surveillance audit took place, and whether you can show that specific controls ran over a recent period. They can confirm a certificate with the issuing certification body; in Japan, the ISMS Accreditation Center (ISMS-AC) publishes lists of accredited certification bodies and certified organizations. Why clients ask for ISO 27001 in the first place is covered in ISO 27001 for IT outsourcing companies.
| What the client asks | What they are testing | Evidence to have ready |
|---|---|---|
| What does the certificate scope cover? | Whether their project, data and sites fall inside the ISMS | Scope statement, Statement of Applicability, list of sites and services |
| When was your last surveillance audit? | Whether the certificate is maintained, not just issued | Surveillance audit report date, nonconformities and how they were closed |
| Show access reviews for the last six months | Whether controls run between audits | Dated review records with the reviewer and approver |
| Has your incident response plan been tested this year? | Whether the plan works in practice | Exercise record, findings, follow-up actions |
| Are subcontractors on our project assessed? | Supply-chain risk | Vendor register, assessments, signed NDAs or data processing agreements |
| What happens if your security lead leaves? | Key-person dependency | Named owners per control, documented procedures, handover record |
Why is the certificate scope a common gap?
An ISO 27001 certificate covers the scope defined for the ISMS, not the whole company by default. A firm certified for internal IT management may later win a development project whose environments, repositories or client data sit outside that scope. A client that reads the scope statement during due diligence will notice. Each time a new project changes where client data lives or who touches it, assess whether the scope needs to extend, and record that decision.
What happens to controls between surveillance audits?
An ISO/IEC 27001 certificate runs for three years, with surveillance audits in between, but it does not show how controls are operating today. Control drift is the gap that opens when controls were right at audit time and slip during normal work, usually because nothing tracks them, not because anyone cut corners. Typical examples in outsourcing:
- A contractor is given write access to a client repository; the contract ends, the contractor is off-boarded in HR, but repository access stays because nobody links the two events.
- A project moves to a new cloud provider, and the old security baseline is never applied to the new environment.
- A system upgrade resets a password or MFA setting to its default, and nobody notices until a client's technical review finds it.
A client's off-cycle security review finds these through technical checks, not through the certificate. Keeping controls running after certification is covered in maintaining compliance after certification.
How do you show compliance at any time, not only at audit time?
Make evidence part of the work rather than an audit project:
- Give each recurring control (access review, backup restore test, vendor review, incident exercise) an owner, a frequency and a review date.
- Keep the evidence with its date and approver, so any period can be shown on request.
- Review the ISMS scope when a new project or client starts.
- Prepare a standard pack you can share under NDA (certificate, scope, key policies, recent evidence summaries) instead of assembling it per request.
- Document procedures well enough that a new owner can continue them.
The ISO 27001 implementation checklist for outsourcing companies lists which controls matter most in delivery work.
When a Japanese client sends its own vendor questionnaire, the security questionnaire guide shows how to scope it, assign owners and answer with evidence.
Where does pTrackly fit?
In pTrackly, each evidence task has an owner, a frequency (daily to yearly) and a review date, and every status change, assignment and review decision is kept in the task history, so you can show what was done in a given period and who approved it. Recurring tasks reopen automatically when their review period passes. The Trust Portal lets clients see your frameworks and controls and request policies and certificates under an NDA they sign online. pTrackly does not decide your ISMS scope, run your controls or issue certificates; your team and your certification body do. See pTrackly for IT outsourcing and the ISO 27001 framework page.
Frequently asked questions
Is ISO 27001 enough to win Japanese outsourcing contracts?
It is usually necessary but not sufficient. Japanese clients commonly go on to check the certificate scope, the latest surveillance audit and recent evidence that controls run on their project.
How can a Japanese client check our ISO 27001 certificate?
They can confirm it with the issuing certification body. For certificates issued by bodies accredited in Japan, ISMS-AC publishes lists of accredited certification bodies and certified organizations.
How long is an ISO 27001 certificate valid?
Three years, with surveillance audits during the cycle and a recertification audit at the end. The certificate does not show how controls operate between those audits.
What evidence should we prepare before a client security review?
Scope statement and Statement of Applicability, the latest audit reports, dated access reviews, incident exercise records, the vendor register with assessments, and named owners for key controls.
The ISO 27001 certificate opens the door; evidence from the last few months keeps it open.
