Step 1: What exactly is the customer asking for?
Read the requirement literally, because the wording decides your options. Is ISO 27001 named as a condition of contract, a scored tender question, or a preference?
Does it apply to your whole company or to the service you are supplying (that is the certification scope)? Is there a date, and is "certified" required by that date or is credible progress accepted?
If a customer asks the question in a security questionnaire instead of a contract, the honest answer plus evidence often suffices for now.
Step 2: How should you reply to the customer?
A short reply that procurement teams respect covers five points:
- Your current position, stated plainly (not certified; implementation under way).
- The scope you intend to certify, ideally the service the customer buys.
- What you have done so far: scope agreed, gap analysis completed, risk assessment under way.
- Who is doing the work, internally and externally, with named ownership.
- Your target: Stage 1 and Stage 2 windows, and when you expect the certificate.
Attach evidence where you can: a signed scope statement, a gap analysis summary, a programme plan. One page of dated fact outweighs three pages of commitment language.
Step 3: How do you get the programme moving in the right order?
Agree the scope the customer cares about first, and run a gap analysis against it. Book the certification body early, because its diary is usually the long pole.
Implement controls while the evidence clock runs, then internal audit and management review, then Stage 1 and Stage 2. My guide to how long ISO 27001 takes shows realistic durations, and what it costs helps you budget before the customer asks that question too.
What should you not do when a customer requires ISO 27001?
- Do not claim to be certified, "ISO compliant" in a way that implies certification, or display a certification mark. It is misrepresentation, and customers verify certificates with the issuing body.
- Do not accept a consultant's promised date without a scope conversation. Nobody can promise a certification decision that belongs to an independent body.
- Do not buy the cheapest fixed-fee package under time pressure without checking what it includes. Rebuilding a weak system costs more than building it once.
- Do not stay silent. Most contracts lost in this position are lost by suppliers who never replied. An honest reply keeps the conversation alive.
What if the deadline cannot be met?
Say so, with the earliest credible date and interim measures: completed Cyber Essentials where relevant, a current penetration test summary, your security policies and the dated certification programme. Customers with genuine risk concerns often accept a supplier who demonstrates control and momentum.
What they cannot accept is surprise.