Blog Why Cloud Software providers are Embracing ISO27001

The increasing demand for proof

In a recent conversation with a hosting provider in the UK who is trying to expand by hiring more sales staff, they explained that many of the interviewees became less interested in the job once they realized that the company wasn’t certified. The general feeling was that the lack of certification would hamper the sales process so much that the job would be an uphill struggle and presumably therefore not be as lucrative as it otherwise would. Based on their recruitment experience this company is now on the verge of achieving certification to ISO27001 and sees it as essential to competing in their marketplace.

And it’s not just customers that are showing an interest in the ISO27001 standard; we are increasingly hearing of various regulatory bodies who are now mandating certification to all, or at least major parts, of it too. Certainly the gambling commissions of many countries now require a long list of ISO27001 controls to be in place and the trend could well be towards full certification before too long. Similarly, the national bodies that oversee internet domain registrations are also going heavily down this route. We would expect more of this to happen as these regulatory bodies try to ensure they fulfil their brief to oversee their industry to the best of their ability.

ISO27001 is now an essential part of business strategy

Given these pressures to adopt the standard and certify to it, many cloud providers are now coming to the conclusion that it is an essential part of their business strategy. They are also realizing that it saves a lot of time in responding to the security sections of invitations to tender if they can simply state that they are ISO27001 certified. Add to that the fact that they are very visible and obvious targets for criminal gangs, hacktivists and even state-sponsored groups and the argument for putting in place a recognized way of managing their information security risks becomes even stronger.

The international appeal of a cloud-based solution means that most vendors have customers spread throughout the world and the fact that ISO27001 is an international standard, created by representatives from almost all countries and recognized as best practice worldwide, means that it is the clear choice.

Adoption is becoming widespread

ISO27001 adoption is increasing and, according to the ISO survey 2020 (the latest available at the moment) there are now over 44,000 certified organizations worldwide, with China and Japan leading the way. If we compare this with the number of organizations certified to the more general ISO9001 quality standard, which now stands at over nine hundred thousand, there is probably plenty of appetite remaining for greater adoption of ISO27001, particularly given the fact that the ISO has recently harmonized these standards together to make them easier to adopt as a pair.

So if you’re in the cloud business, ISO27001 is worth starting to read up about and consider adding it to your management and business agenda very soon, because it’s likely that the competition certainly is already.

More ISO27001 resources

CertiKit is a provider of ISO toolkits, consultancy and internal auditing services, and has helped more than 4000 organizations worldwide with their compliance.

For more guidance on implementing the ISO27001:2022 standard, we’ve put together a list of our best free resources including video guides, blogs and downloadable documents.

Free ISO27001 Resources