Security questionnaire answers › Governance
Are you ISO 27001 certified? How to answer it in a security questionnaire
Why buyers ask this
ISO 27001 is an internationally recognised certification of an information security management system.
What a strong answer includes
- State whether you are certified, by which accredited certification body, scope and expiry.
- If not certified, say whether you align to the standard and your plans.
- Distinguish certification from 'alignment' clearly.
Sample answer to adapt
Replace the bracketed parts with your own facts. Only state what is true for your environment.
[Yes. Our ISMS is certified to ISO/IEC 27001:2022 by [certification body], certificate no. [X], scope [Y], valid until [date].] OR [We are not certified. Our controls are aligned to ISO 27001 Annex A, and certification is planned for [date].]
Evidence to attach
- Certificate and statement of applicability
- Scope document
Common mistakes
- Claiming ISO compliance with no certificate.
- Scope that excludes the product the customer is buying.
Answer questionnaires from your own documents
Korrali Trust drafts answers from your policies and evidence so every response traces back to its source, and a person reviews it before it goes out.