ISO/IEC 27001:2022 at an IT provider: proof of process, not a brochure claim

Executive summary: how do you verify that IT outsourcing really follows ISO 27001?

ISO 27001 matters because an IT outsourcing provider touches accounts, devices, networks, backups, incidents and customer data. The certificate does not replace due diligence, but it gives a structured management system for risks, controls, audits, responsibilities and evidence. The certificate creates value only when its scope covers the delivered service and the provider can show current evidence of control, response and improvement.

• Check that the certificate covers the services, locations, teams and systems processing customer data.
• Agree the frequency and format of reports covering SLAs, recovery tests, permissions, incidents and implementation of recommendations.
• Name the decision-makers on both the customer and provider sides.
• Review exception and corrective-action registers, deadlines and reporting to risk owners.
• Define responsibilities, SLAs, escalation, subcontractors, audit rights and exception reporting in the contract.

What should a customer verify beyond the cer­tifi­cate and include in the contract?

The most useful review connects the ISO 27001 certificate with real outsourcing operations: who has access, how incidents are escalated, where logs are stored, how backups are tested and how changes are approved. The document itself does not replace an assessment of scope, accountability and daily operating evidence.

• Define security scope, systems, locations and data covered by the outsourced service.
• Specify access approvals, privileged accounts, subcontractors and notification of material changes.
• Set SLA, incident escalation, backup testing, reporting, audit rights and exit responsibilities.
• Confirm how administrator, service-account, VPN and cloud-panel access is granted, reviewed and revoked.
• Ask for a sample service report covering SLA, incidents, changes, backup, risks and open corrective actions.
• Agree who communicates during an incident, how evidence is preserved and when the customer receives an impact update.

How does ISO 27001 change outsourcing con­ver­sa­tions and which metrics show quality?

Measure response and resolution times, recurring incidents, backup status, open risks, access reviews and implementation of recommendations. These results connect certificate scope and responsibilities with actual service quality.

• Ask for scope, audit dates, exclusions and responsibilities shared with the customer.
• Connect SLA, incident response, backup and access reviews with measurable evidence.
• Review whether provider reports help the customer meet NIS2, DORA, ISO 27001 or internal policy needs.
• Treat the certificate as a starting point for governance, not as a substitute for service quality.

What ISO 27001 really is

ISO/IEC 27001 describes the information security management system, i.e. the way an organisation recognises risks, assigns responsibility, selects security measures, responds to incidents and maintains business continuity. This is not an application or a one-off audit exercise. The certificate is valuable because it is issued by an independent entity after checking the management system and its continued operation is checked through surveillance audits. For the IT outsourcing client, this means that the supplier should have a process, evidence and regular security review, not just a commercial declaration.

• ISMS includes policies, roles, risks, assets, access, incidents, business continuity and supplier relationships.
• The certificate should have a clear scope, expiration date, certification body and link to the services the customer is purchasing.
• Surveillance audits require keeping the system in operation, rather than one-time preparation of documents before the sale.
• The standard organises questions about security, but does not replace due diligence of a specific service and a specific customer environment.

What the certificate does NOT do

An ISO 27001 certificate concerns an assessed management system within a defined scope. It does not guarantee an absence of incidents or the security of every customer system. Check the current certificate scope and actual control, recovery-test and incident-handling records when selecting a provider.

• Don't assume that each certification covers the exact service and team that will support your business.
• Don't skip backup testing, administrative account review, and reporting requirements just because a vendor is certified.
• Don't accept general answers if you're asking about incidents, remote access, subcontractors, or removing permissions at the end of the relationship.

Comparison of supplier risks with and without ISO

In IT outsourcing, the certificate should not be the only criterion, but it significantly changes the conversation about risk. A supplier without an audited ISMS may still perform well, but the client must independently check processes, evidence, decision owners and subcontractor control. A supplier with ISO 27001 should show more quickly how it manages access, incidents, backup, business continuity and documentation.

• Administrator access: Require MFA, account registry, activity trail, and a process for revoking privileges when a team changes.
• Backup and recovery: compare the evidence, not just the statement that backups exist: check the date of the last test, RPO, RTO and the owner of the recovery decision.
• Incidents: Check if the vendor has roles, notification times, escalation path and post-incident reporting.
• SLA: enter the response time, workaround time, repair time, exclusions and communication rules with the management separately in the contract.
• Cost of risk: lack of evidence is usually more expensive in the event of an audit, ransomware, administrator departure or liability dispute.

What evidence should a mature IT partner show?

A mature supplier does not rely solely on a certificate. It can show how security is managed in daily operations and what records and review results the client receives during cooperation.

The most common mistakes when assessing ISO 27001

Mistakes occur when certification replaces due diligence. ISO is a strong signal of maturity, but the client should still check the scope, contract, liability and reporting.

• Treating the certificate as a guarantee that an incident will never happen.
• Failure to check the scope of the certificate, validity date and certification body.
• Omission of privileged accounts, subcontractors and remote access in the contract.
• No requirements for reports, periodic reviews and evidence of work completion.
• The conversation is only about the subscription price, without the cost of downtime, data loss and audit risk.

What exactly does ISO 27001 cover?

In ISO 27001, the certificate itself matters less than a security system tailored to the organisation's risks. Annex A groups the controls into organisational, people, physical and technological areas. In IT outsourcing, access control, asset management, training, confidentiality, backup, logging, incident response, supplier security and business continuity are particularly important. A certified supplier should be able to explain which controls it applies to customer service and what evidence the customer receives.

What does certification look like in practice?

ISO 27001 certification begins with preparing an information security management system, analysing risks, implementing the required controls and collecting evidence. Then, an independent entity conducts a certification audit. After obtaining the certificate, the organisation undergoes surveillance audits and, after a cycle of several years, recertification. For the customer, this means that the supplier cannot pass the exam once and forget about the topic. Procedures, records and evidence must be kept up to date.

• The auditor checks not only the documents, but also the operation of the process, responsibilities and selected records of completed work.
• Surveillance audits help detect negligence before it becomes a regular practice in the organisation.
• Recertification requires confirmation that the system still responds to current risks, services and changes in the organisation.
• The customer should ask how certification affects onboarding, reporting, incidents and security reviews for their service.

Example: why it matters

Imagine an incident at an IT provider: an encrypted server, a suspicious login to an administrator account or an error in the backup configuration. In a company without a process, improvisation begins: roles are unclear, and no one knows who decides, whom to notify, how to preserve evidence or when to recover the service. A supplier operating an ISO 27001-compliant ISMS should have defined roles, an escalation path, a decision log, a customer-communication process and a post-incident procedure. The incident remains serious, but it is managed through a traceable process instead of being obscured by unsupported reassurance.

• The customer receives information faster about the impact of the incident, the scope of risk and next steps.
• The technical team works according to agreed response instructions, which reduces chaos and shortens response time.
• After the event, there is evidence, recommendations and corrective tasks that can be shown to the management board or the auditor.

Phased action plan for safe outsourcing

Before service handover, agree scope, responsibilities and secure administrator access with required MFA, and verify backup and recovery of critical services. Address urgent gaps according to risk, with change controls and emergency access. The following 30/60/90-day points are example service progress reviews, not a waiting period for basic safeguards.

• 30-day review: confirm the inventory, accounts, contracts, owners and treatment of risks found during handover.
• 60-day review: assess the effectiveness of access controls, MFA, ticket handling, SLAs, monitoring and reporting.
• 90-day review: assess repeated recovery tests, incidents, budget and change scheduling; critical tests must have happened earlier according to risk.

Supporting evidence after the first 90 days of cooperation

If the ISO 27001 certificate is to truly support IT outsourcing, the client should receive specific records and test results after the first quarter. They show whether the supplier works in a process-oriented manner and maintains information security in everyday operations rather than merely describing it in the proposal.

• Current inventory of systems, administrative accounts, critical services, suppliers and data storage locations.
• Report covering SLA, incidents, changes, service availability, outstanding tasks and security recommendations.
• Evidence of MFA review, privileged accounts, backup, recovery testing, and permission changes.
• Risk register with owners, decisions, deadlines and information which risks the client accepts.
• An agreed handover package for contract exit: documentation, configurations, licences, ticket history, secure access transfer and replacement of passwords or keys.

How Virtline translates ISO into customer service

Virtline combines ongoing IT support, cybersecurity, backup and audit experience. Virtline’s PN-EN ISO/IEC 27001:2023-08 certificate issued by TÜV NORD strengthens this model, because the conversation about outsourcing ends with a list of controls, responsibilities and evidence that can be shown to the management board, the client or the auditor.

Services that help verify an IT provider

These services turn supplier declarations into evidence, decisions and an actionable improvement plan.

Contact

Let us define the provider assessment scope, required evidence and the first measurable step.