ISO 27001 for SaaS companies
As a SaaS company, sooner or later you run into this: a potential enterprise client makes ISO 27001 a condition, or you receive a security questionnaire with 150 questions. ISO 27001 is the international standard for information security, available through NEN . It is the proof that shows your clients you take their data seriously. For small and medium-sized SaaS companies, the certificate is achievable: expect €11,000 to €30,000 in the first year.
If your SaaS company is just starting with security, ISO 27001 for small businesses is the best starting page.
Why enterprise clients require ISO 27001
Enterprise clients do not buy software. They buy trust. Your SaaS platform processes their customer data, their financial data or their business information. If you have a data breach, they pay the price, including the reputational damage.
An ISO 27001 certificate gives them three things:
- Independent verification. An accredited auditor has checked that your information security management system (ISMS) works. That is different from your own whitepaper on “enterprise-grade security”.
- Demonstrable compliance. Many enterprise buyers are ISO 27001 certified themselves or fall under NIS2. They are required to check their suppliers.
- Less due diligence. A certificate replaces hundreds of questions in a security questionnaire.
Large companies use platforms such as OneTrust or Vanta to assess suppliers. An ISO 27001 certificate is entered automatically as evidence. Without a certificate, you answer every question by hand, again and again, for each new client.
Security questionnaires: what they ask and how ISO 27001 helps
Security questionnaires are standard documents that buyers use to assess a supplier’s security position. The most widely used are the CAIQ (Consensus Assessments Initiative Questionnaire) from the Cloud Security Alliance and the SIG (Standard Information Gathering) from Shared Assessments.
A typical questionnaire covers:
| Category | Example questions | Covered by ISO 27001? |
|---|---|---|
| Access control | Do you use MFA? How do you manage access rights? | Yes: A.5.15-5.18, A.8.5 |
| Encryption | Do you encrypt data in transit and at rest? | Yes: A.8.24 |
| Incident response | How do you report data breaches? What is your SLA? | Yes: A.5.24-5.28 |
| Supplier management | How do you assess sub-processors? | Yes: A.5.19-5.23 |
| Continuity | Do you have a business continuity plan (BCP)? What are your RTO and RPO? | Partly: A.5.29-5.30 |
| Penetration testing | How often do you test your environment? | Partly: depends on your Statement of Applicability (SoA) |
| Compliance certification | Are you ISO 27001 or SOC 2 certified? | Yes: direct question |
With an ISO 27001 certificate, you can answer most questions by referring to your certificate and your SoA. That saves hours per client per year.
ISO 27001 or SOC 2, or both?
This is the most common question among SaaS companies. The answer depends on your target market.
| Feature | ISO 27001 | SOC 2 |
|---|---|---|
| Standard from | ISO/IEC (international) | AICPA (American) |
| Most often requested in | Europe, government, enterprise | US, technology, venture-backed companies |
| Certification possible | Yes | Type 1 and Type 2 |
| Scope | Broad (the ISMS as a whole) | Specific Trust Services Criteria |
| Auditor | Accredited certification body (CB) | CPA firm |
Do you supply mainly to European clients? ISO 27001 is the standard. Almost every enterprise client and government body in the Netherlands and Europe accepts it.
Do you supply to US clients or to companies in the SaaS supply chain? Then you will come across SOC 2 as an additional requirement. Some clients want both.
Do you want both? The overlap is large. With a well-run ISMS for ISO 27001, you have already done most of the work for SOC 2. Many compliance platforms such as Vanta or Drata support both frameworks at once, which makes combining them much less work.
Some SaaS companies start with SOC 2 for the US market and then achieve ISO 27001. Others do it the other way round. If you are unsure, ask your three largest potential clients what they expect. That will settle it.
Scope for a SaaS company
You define the scope of your ISMS yourself. For a SaaS company, the logical scope is the development, delivery and support of the SaaS platform, including the production infrastructure.
Typical elements in scope:
- Production environment (AWS, Azure, GCP or your own hosting)
- Software development process (CI/CD, code review, security testing)
- Customer support and access to customer data
- Identity and access management
Typically out of scope (but easy to justify):
- Internal HR and finance systems, provided they are strictly separated from the platform
- Marketing activities without access to customer data
Read more about defining the scope on the defining the scope page.
If your platform runs in the cloud, clients sometimes also ask about two extensions to ISO 27001. ISO 27017 sets out what you and your client each manage for cloud security. ISO 27018 covers personal data that you store in the public cloud as a processor.
Approach: from zero to certificate as a SaaS company
- Define the scope. Decide which platform will be certified. Start narrow; you can expand later.
- Carry out a baseline measurement. What do you already have? Many SaaS companies have informal security measures that only need to be documented. See baseline measurement and gap analysis.
- Risk assessment. Focus on the risks to customer data: access, continuity, data breaches.
- Write the SoA. Select the relevant controls and justify your choices.
- Implement what is missing. MFA, logging, change management, incident response.
- Run the system for three months. Collect evidence that the system works.
- Internal audit, management review, certification audit.
A detailed plan is in the step-by-step guide. For a SaaS company with 5 to 25 employees, costs are typically in the range of €11,000 to €30,000 for the first year.
More information
- ISO 27001 for a small business: Costs and approach for SMEs
- ISO 27001 vs SOC 2: Which should you choose for which market?
- Costs and timeline: Complete cost overview
- Defining the scope: How do you define the scope?
- Annex A: The 93 control measures