A management system for information security
ISO/IEC 27001 sets requirements for an information security management system, including assessing and treating information security risks. It concerns the way security is managed within the certified scope. A certificate is not a promise that an incident can never occur or that every application has identical controls.
Ask questions specific to your application
A public website, employee portal and ERP integration have different information flows. Begin by identifying the data involved, who needs access and which other systems receive it. Discuss responsibilities for hosting, account management, updates and incident communication. These project-specific decisions help make security requirements usable during design and delivery.
Use independent verification in procurement
Follow the certificate link to IAF CertSearch and review the organisation, scope and current status. This gives your procurement or security team a starting point for due diligence. If your organisation uses a supplier questionnaire, share it early so the relevant evidence and project requirements can be discussed before implementation begins.
Plan beyond the first release
A software launch is followed by account changes, updates and new integrations. Discuss how those changes will be handled and who is responsible for ongoing support. Our infrastructure and maintenance services can be included in a project proposal, with the actual arrangements defined around your environment and operational needs.
Source and further reading: ISO/IEC 27001:2022