Customer Drivers

The ISO Survey counts 96,709 valid ISO/IEC 27001 certificates and 179,877 sites as of 31 December 2024. That count includes the 2013 and 2022 editions. It is fourth among the sixteen management system standards in that survey. It counts certificates reported by accredited certification bodies. It is not every company in the world, and it is not a growth rate.

Sources: ISO Survey and IAF CertSearch.

Some choose it. Some are asked. Companies start this work for different reasons. Here are five of them.

Percentages are from the UK ISO Standards Survey, Summer 2024 (Statius). They come from UK businesses talking about ISO registration in general, not only ISO/IEC 27001. People could pick more than one reason, so the numbers do not add to 100. They are not a Trygg forecast. Open the source (PDF).

What that survey measured about winning business is on Return on Investment. This page does not repeat it.

• You choose it. Leadership wants the company protected before anyone asks. 68.4% wanted to improve internal processes and practices.
• You need a certificate. A customer, a board, or your leadership team wants an independent certification body to look at the program. An ISO/IEC 27001 certificate. The independent certification body decides.
• A customer requests. A questionnaire, a contract, or a security review. 61.4% said existing clients demanded it. 56.1% wanted it to win new clients.
• A trade body respects your position. A trade body or a similar rule sets the requirement. 40.4% needed it to meet a trade body requirement.
• A vendor partners with you. The partnership rests on your security position, and it works both ways. You know the specifics to ask for, and they provide an in-kind, reciprocal certificate and data protection approach. The survey gives no vendor figure, so we do not show one.

The business stays aimed at the customer. Revenue and livelihood are not a pile of money for an attacker to spend. With the mission surrounded, leadership works on customers, not on reacting to attackers all year.

• You choose it.
• You need a certificate.
• A customer requests.
• A trade body respects your position.
• A vendor partners with you.

Whoever is asking, they look for the same three things. Each request asks for proof in its own way. Underneath, every row comes out the same.

The question is not which request to answer. It is whether one program answers all five.

This is how we read the requests. It is not a survey result.

• You choose it. A named owner. Evidence that is current. Reviewed on a schedule.
• You need a certificate. A named owner. Evidence that is current. Reviewed on a schedule.
• A customer requests. A named owner. Evidence that is current. Reviewed on a schedule.
• A trade body respects your position. A named owner. Evidence that is current. Reviewed on a schedule.
• A vendor partners with you. A named owner. Evidence that is current. Reviewed on a schedule.

The certificate is three years. The work is every year. Getting certified is one event. Keeping the certificate is a program that runs every year.

A certificate is typically granted for three years. A surveillance audit comes at least once a year, and recertification comes before the three years end. ISO/IEC 27001 asks top management to review the system at planned intervals (Clause 9.3) and to keep improving it (Clause 10). This part is a requirement, not a survey result. Certification is where we describe how an independent certification body fits.

The human side, from the same UK survey: 62.5% said the hardest part of keeping a standard was the time to administer it, 55.4% said keeping documents current, and 50% said making the system match how the business works. Most said it takes more than a day a month. Open the source (PDF).

• Year 1. Certification audit. An independent certification body decides.
• Year 2. Surveillance audit. At least once a year.
• Year 3. Surveillance audit. At least once a year.
• Before year 3 ends. Recertification. Then the three year cycle starts again.
• What a visit looks for. A program still running. Internal audit, management review (Clause 9.3), open findings, objectives, changes, and progress on improvement (Clause 10).

This is the leadership job Trygg is built to support. Everyone on the leadership team is in it, before the incident, not only after it.

Trygg keeps the record. It does not attack an intruder on the network.

• Map. Name the threat, the weakness it would use, who owns the response, and where the evidence sits.
• Disrupt. Break the easy path. A control with an owner, a date, and a result that is still current.
• Disable. Close the weakness the threat depends on, and keep the closure visible.
• Dismantle. Take apart the habit that would let it return. An old account. A shared mailbox nobody owns. A vendor still connected. A written rule the daily work no longer follows.

These are the tests and meetings leadership runs. Trygg gives each one a home in the program.

A penetration test. A specialist performs the internal and external tests. In Trygg, that record lives with BC/DR Assessments. Penetration tests shine a light where gaps exist. The portal tracks the evidence.

A phishing campaign. The campaign tests for spam and impersonation. It gives employees a chance to self-identify attacks. In Trygg, that record lives with Security Insights. Trygg partners with KnowBe4, along with other programs, to track the results.

A change review board meets regularly to make sure changes are approved and prioritized. A project review board meets regularly so initiatives are prioritized and approved before they are implemented. A quarterly review is where leaders take part in the overall solution, based on their own areas of expertise and responsibility. In Trygg, those records live with Management Reviews.

Trygg gives every event a record, an owner, and a place in the program.

Trygg does not run the penetration test, send the phishing campaign, or decide certification. Trygg does not promise that an attack will fail, that a contract will close, or that you will be certified. The independent certification body decides.

Book a demo