There’s no exam you have to pass to call yourself a managed IT provider. Anyone with a laptop and a business card can start one, and from the outside the good ones and the risky ones look alike. They use the same words: proactive, secure, 24/7. That’s a problem for a business owner, because handing over your IT means handing over the keys to everything.
ISO 27001 is one of the few ways to look past the words. It’s also widely misunderstood, partly because the people selling it don’t always use the terms carefully.
What ISO 27001 is
ISO/IEC 27001 is an international standard for running an information security management system. In plain terms, it describes how an organization should decide what its security risks are, choose controls to deal with them, write down what it does, check that it’s actually doing it, and improve when something goes wrong. The current version, from 2022, comes with a list of 93 controls covering people, processes, physical security and technology.
It doesn’t tell you which antivirus to buy. It’s about whether security is run as a managed, documented process or left to the judgment of whoever happens to be on shift.
Compliant, certified, accredited
These three words get used as if they mean the same thing. They don’t, and the difference matters when you’re comparing providers.
Compliant
It means the organization follows the standard. How well that’s checked depends on who is doing the checking: it can mean anything from a self-assessment to a structured program with outside reviews.
Certified
It means an independent certification body has audited the organization against the standard and issued a certificate, with a defined scope, an expiry date and surveillance audits in between.
Accredited certification
It means the certification body itself has been assessed by a national accreditation body (in the US, that’s usually ANAB). When a large customer’s contract asks for ISO 27001, this is normally what it means.
None of these is a scam. They’re different levels of proof, and it’s fair to ask which one you’re being offered.
Where we stand
We follow ISO 27001 through a compliance program run by Technology Assurance Group (TAG), a national organization of managed technology providers we belong to. That’s what the badge at the bottom of our site refers to. It means our security practices are documented, structured around the standard and checked against it. It doesn’t mean we hold a certificate from an accredited certification body, and we’d rather you hear that from us than find it in the fine print.
Seven questions for any IT provider, us included
A certificate or a badge is a starting point. These questions tell you more about how a provider actually works:
- What exactly do you hold, and can I see it? Compliant or certified, by whom, and covering which parts of the business.
- Do you use multi-factor authentication on your own admin accounts? A provider’s tools can reach every one of its clients. If its own logins are weak, so is your security.
- How do you handle updates and patches, and how would I know they’re done?
- Who looks at security alerts, and what happens at 2 a.m. on a Sunday?
- When did you last test restoring a client’s backup?
- What happens to my data and passwords if we stop working together?
- Is any of this written down? If the process lives only in one technician’s head, it leaves when they do.
A good provider answers these without getting defensive. A provider whose security is a one-time antivirus install and a promise is worth knowing about before you sign.
If the process lives only in one technician’s head, it leaves when they do.
What it doesn’t do for you
Your provider’s ISO 27001 status covers how the provider runs itself. It doesn’t make your business compliant with anything. If an insurer, a customer or a regulator is asking how you protect data, that’s about your own controls and your own policies.
That’s the part our compliance support is for. For our Managed IT customers, we work out which requirements apply, close the technical gaps and keep the evidence ready, and we’re plain about what we don’t cover. If you’d like an outside look at where your own setup stands, our free technology review gives you a written report you can use with us or with anyone else.