概要
ISO 27001 for IT outsourcing companies: why clients require it, which controls matter for multi-client delivery, how long it takes and how to keep it.
ISO 27001 for IT outsourcing companies is the certified information security management system (ISMS) that international clients ask for before they share systems or data. An accredited certification body issues the certificate for three years, with surveillance audits in between. For an outsourcer, the hard parts are client data segregation, remote delivery and the many tools engineers use.
Why do IT outsourcing clients require ISO 27001?
Clients in Europe, Japan and regulated industries treat ISO/IEC 27001 as the baseline proof that a vendor manages information security systematically. It appears in RFPs, vendor security questionnaires and master service agreements, and a certificate can replace dozens of individual questionnaire answers. An outsourcer without it often loses to certified competitors before the technical evaluation starts, or faces a longer vendor assessment. The certificate is issued by an accredited certification body after a two-stage audit; it is not issued by a consultant or a software platform. For the Japanese market specifically, see why outsourcers lose Japanese contracts despite having ISO 27001.
What does ISO 27001:2022 require?
ISO/IEC 27001:2022 requires an ISMS: a defined scope, a risk assessment and treatment process, leadership commitment, internal audit and management review (clauses 4 to 10). Annex A lists 93 reference controls in four themes; you decide which apply and justify the choice in the Statement of Applicability (SoA).
| Annex A theme | Controls | Key areas |
|---|---|---|
| Organizational (A.5) | 37 | Policies, roles, asset management, suppliers, incidents |
| People (A.6) | 8 | Screening, terms of employment, awareness training, remote working |
| Physical (A.7) | 14 | Secure areas, equipment, clear desk |
| Technological (A.8) | 34 | Access control, cryptography, logging, secure development |
Core documented information includes the ISMS scope, information security policy, risk assessment methodology, SoA, risk treatment plan and security objectives. The Annex A controls guide explains each theme, and the risk assessment guide covers the process every control decision depends on.
Which controls matter most for IT outsourcing?
The standard is the same for every organization, but outsourcing delivery puts weight on specific controls. These are the gaps auditors most often find in software and IT service companies:
| Outsourcing risk | Annex A control | What auditors expect to see |
|---|---|---|
| Engineers access many client environments | A.5.15, A.5.18 (access control, access rights) | Access granted per client project and reviewed on a schedule, with removals recorded |
| No complete list of systems in scope | A.5.9 (inventory of assets) | An asset inventory with owners, including client-provided systems |
| Client data in mixed environments | A.8.24 (use of cryptography), A.8.31 (separation of environments) | Encryption at rest and in transit; separated client and environment data |
| Distributed or remote team | A.6.7 (remote working), A.8.1 (user endpoint devices) | Remote work rules and managed, encrypted devices |
| Many SaaS tools (GitHub, Jira, Slack, cloud) | A.5.19–A.5.23 (supplier relationships, cloud services) | Supplier security reviews and agreements for tools that touch client data |
| Security awareness | A.6.3 (awareness, education and training) | A training program with completion records |
Client-specific contracts often add requirements of their own, such as separate incident notification timelines. Record them in the ISMS scope and risk assessment so they are tested in the internal audit.
How long does ISO 27001 certification take for an outsourcer?
Readiness time depends on scope, existing controls and how much is already documented; the certification audit then runs in two stages (documentation review, then implementation review) before the certification body decides. A small, well-scoped outsourcer can move quickly: in pTrackly's own ISO 27001 project, readiness took 3 weeks, followed by a 4-week independent audit through to certification. Scope and starting conditions change this, so treat it as one example, not a promise. The step-by-step timeline is in how long ISO 27001 certification takes, and that project is described in how pTrackly reached ISO 27001 in 7 weeks.
A practical sequence:
- Define the ISMS scope: which offices, teams, client projects and systems are in.
- Run a gap analysis against clauses 4–10 and Annex A, and record existing controls.
- Complete the risk assessment and write the SoA.
- Implement missing controls and collect evidence that they operate.
- Run an internal audit and a management review.
- Book Stage 1 and Stage 2 audits with an accredited certification body.
The ISO 27001 implementation checklist for Vietnam IT outsourcing companies breaks these steps into tasks.
What does ISO 27001 cost an outsourcer?
Plan three separate budgets: the certification body's audit fees (Stage 1, Stage 2, then annual surveillance and a recertification audit in year three), internal time for ISMS owners and engineers, and tools or consulting. Audit fees depend on headcount, sites and scope, so request a written quote from accredited certification bodies after you define the scope. Internal time is usually the largest and least visible cost; it drops when evidence collection is automated rather than gathered by screenshot before each audit.
How do you keep ISO 27001 after certification?
The certificate is valid for three years, with surveillance audits at least once a year and a recertification audit before expiry, as required of certification bodies under ISO/IEC 17021-1. Certificates issued against ISO/IEC 27001:2013 had to transition to the 2022 version by 31 October 2025 under the IAF transition requirements. Between audits you keep running the ISMS: risk reviews when clients, systems or teams change, access reviews, training, supplier reviews, internal audit and management review. Most surveillance findings come from controls that worked at certification and then lapsed; if you also hold PCI DSS, see maintaining ISO 27001 and PCI DSS for a shared calendar. The internal audit guide covers the yearly check.
Clients often follow the certificate with a vendor questionnaire; the security questionnaire guide covers how to answer it consistently.
How does pTrackly help outsourcers with ISO 27001?
pTrackly includes ISO 27001:2022 with its controls, policy templates and evidence tasks, and tailors the policies to your company when you add the framework. Access reviews route each account to a reviewer and file the result as evidence, and the People, Devices and Assets pages keep the inventory auditors ask for. Controls are shared, so adding SOC 2 later reuses the overlapping work. pTrackly prepares controls and evidence; your team owns scope and control operation, and the accredited certification body runs the audit and issues the certificate. See ISO 27001 on pTrackly and the IT outsourcing solution.
Frequently asked questions
Do IT outsourcing companies need ISO 27001 to win international clients?
It is not legally required, but many clients in Europe, Japan and regulated industries require it in RFPs or vendor assessments, and an outsourcer without it often loses to certified competitors.
How many controls are in ISO 27001:2022 Annex A?
Annex A of ISO/IEC 27001:2022 has 93 controls in four themes: 37 organizational, 8 people, 14 physical and 34 technological. You justify which apply in the Statement of Applicability.
Who issues the ISO 27001 certificate?
An accredited certification body issues it after a Stage 1 and Stage 2 audit. Consultants and compliance platforms help you prepare but cannot certify you.
How often are surveillance audits after ISO 27001 certification?
At least once a year during the three-year certificate cycle, followed by a recertification audit before the certificate expires.
Should an outsourcer do ISO 27001 or SOC 2 first?
Clients in Europe and Asia usually ask for ISO 27001; US SaaS buyers often ask for a SOC 2 report. See ISO 27001 vs SOC 2 for the decision.
Preparing for ISO 27001? Book a demo to see how pTrackly organizes controls, evidence and audit work for IT outsourcing teams.
