ISO/IEC 27001 · Information securityISO certification

ISO/IEC 27001: information security, demonstrated.

ISO/IEC 27001 asks you to assess the risks to information, choose the controls to treat them and prove that they work. Clients ask for it, Italy’s public administration requires it for cloud, and it helps those who must answer for NIS2.

Join the list for ISO/IEC 27001 All standards

What it is

Risks assessed, controls chosen, evidence collected.

The standard requires a management system that protects the confidentiality, integrity and availability of information through a risk management process. It applies to every sector; IT is the one with the most certificates. Certificates to the 2013 edition are no longer valid since 31/10/2025.

Who needs it

Companies that develop software or manage data on behalf of clients
Companies offering cloud services to Italy’s public administration
Entities in scope of NIS2 that want a recognised method for security measures
Companies that receive security questionnaires from clients and want to answer with a certificate

What it brings you

To qualify a cloud service for the public administration at level QC1, ACN, Italy’s National Cybersecurity Agency, requires ISO/IEC 27001 with the 27017 and 27018 extensions, or CSA STAR level 2.
ACN, measures for cloud services, level QC1
If you are certified, you have a bridge to the NIS baseline measures: UNI/PdR 174:2025, developed with ACN’s support.
ACN, UNI/PdR 174:2025
In Italian tenders that provide for it, the guarantee is reduced by up to 20%: ISO/IEC 27001 is among the certifications in Annex II.13.
D.Lgs. 36/2023, art. 106 c. 8 and allegato II.13

The path

From analysis to certificate, in four steps.

1
Scope and risks
You decide what to protect — sites, systems, processes — and assess the risks to information.
2
Controls and applicability
You choose the controls, write down why each one is applied or excluded, and put them into operation.
3
Internal audit and review
Before calling in the certification body, an internal audit and the management review show whether the system holds up.
4
Certification audit
The accredited body carries it out in two stages, the second at the company’s premises. The certificate lasts three years, with a surveillance audit every year.

10ISO

How 10ISO will help you

The agents will do the work that repeats itself; decisions stay with you and whoever supports you. 10ISO is coming soon: this is what we’re building.

The risk assessment and the chosen controls, kept aligned when something changesComing soon
Evidence of the controls collected where it arises: access, backups, training, suppliersComing soon
The NIS measures that 27001 already covers, and those that are missingComing soon
One more standard, 22301 or 9001, on the same clausesComing soon

Read alongside

Questions

The first questions people ask about ISO/IEC 27001.

Is ISO/IEC 27001 enough to comply with NIS2?

No. ACN measures compliance on the implementation of all the requirements of its baseline measures, not on a certificate. If you are certified you start ahead, and UNI/PdR 174:2025 helps you see what’s missing.

Does 27001 make me GDPR compliant?

No. Accredia says it clearly: a management system certificate does not guarantee legal compliance. For the GDPR, the only certifications are those provided for by Article 42.

I still have an ISO/IEC 27001:2013 certificate: is it valid?

No. Certificates to the 2013 edition expired or were withdrawn on 31/10/2025: you need a certification to the 2022 edition.

Sources

Every reference on this fact sheet comes from one of these sources, checked on 28/09/2026. If a law or a standard changes, the fact sheet is updated.

Waiting list

We’ll write to you when 10ISO opens.

One minute: who you are, your email and the standard you’re interested in. It’s not a subscription and we don’t ask for a card.