ISO 27001
ISO/IEC 27001 — Information Security Management System
The international gold standard for information security
ISO 27001 is the world's most recognized information security management standard. It provides a systematic approach to managing sensitive information security through a risk-based ISMS. For Canadian businesses, ISO 27001 certification demonstrates security maturity to enterprise customers, investors, and regulators — and complements PIPEDA compliance significantly.
Who must comply with ISO 27001?
ISO 27001 is voluntary but widely expected by enterprise customers, SaaS procurement teams, and regulated-sector vendors. It is required or expected for government IT contracts, financial services vendors, healthcare technology providers, and any business seeking enterprise sales.
Not sure if ISO 27001 applies? Run a free assessment →
Key obligations under ISO 27001
ISMS Scope Definition
Define the boundaries of your information security management system — what information assets are in scope.
Risk Assessment
Identify information security risks, assess their likelihood and impact, and select appropriate controls from Annex A.
Annex A Controls
Implement applicable controls from ISO 27001 Annex A — 93 controls across 4 themes covering organizational, people, physical, and technical security.
Statement of Applicability
Document which Annex A controls are applicable, which are implemented, and justify any exclusions.
Internal Audit
Conduct regular internal audits of your ISMS. External certification requires annual surveillance audits.
Continual Improvement
Treat the ISMS as a living system — review and improve based on audit findings, incidents, and changing risk landscape.
Penalties & enforcement
Loss of ISO 27001 certification can trigger enterprise contract termination clauses
Run a free ISO 27001 gap assessment
Answer 47 questions, get a scored gap report, and see exactly what you need to do to comply with ISO 27001 — in under 3 hours. Free forever.
Start free assessment