--- title: "A Customer Requires ISO 27001: What To Do Next" description: "A customer or tender requires ISO 27001? How to reply credibly today, what evidence to offer, what never to claim, and a realistic route to certification." canonical: https://www.isosecurity.co.uk/resources/customer-requires-iso-27001 updated: 2026-11-10 --- # A customer requires ISO 27001: what to do next Reply to the customer with an accurate position, evidence of a dated implementation programme, and a realistic certification window. That combination keeps most contracts and tenders alive while you do the work, and it starts with claiming only the certification you actually have. ## Step 1: What exactly is the customer asking for? Read the requirement literally, because the wording decides your options. Is ISO 27001 named as a condition of contract, a scored tender question, or a preference? Does it apply to your whole company or to the service you are supplying (that is the certification scope)? Is there a date, and is "certified" required by that date or is credible progress accepted? If a customer asks the question in a security questionnaire instead of a contract, the honest answer plus evidence often suffices for now. ## Step 2: How should you reply to the customer? A short reply that procurement teams respect covers five points: 1. Your current position, stated plainly (not certified; implementation under way). 2. The scope you intend to certify, ideally the service the customer buys. 3. What you have done so far: scope agreed, gap analysis completed, risk assessment under way. 4. Who is doing the work, internally and externally, with named ownership. 5. Your target: Stage 1 and Stage 2 windows, and when you expect the certificate. Attach evidence where you can: a signed scope statement, a gap analysis summary, a programme plan. One page of dated fact outweighs three pages of commitment language. ## Step 3: How do you get the programme moving in the right order? Agree the scope the customer cares about first, and run a gap analysis against it. Book the certification body early, because its diary is usually the long pole. Implement controls while the evidence clock runs, then internal audit and management review, then Stage 1 and Stage 2. My guide to [how long ISO 27001 takes](/resources/how-long-does-iso-27001-take) shows realistic durations, and [what it costs](/resources/iso-27001-cost-uk) helps you budget before the customer asks that question too. ## What should you not do when a customer requires ISO 27001? - **Do not claim to be certified, "ISO compliant" in a way that implies certification, or display a certification mark.** It is misrepresentation, and customers verify certificates with the issuing body. - **Do not accept a consultant's promised date without a scope conversation.** Nobody can promise a certification decision that belongs to an independent body. - **Do not buy the cheapest fixed-fee package under time pressure without checking what it includes.** Rebuilding a weak system costs more than building it once. - **Do not stay silent.** Most contracts lost in this position are lost by suppliers who never replied. An honest reply keeps the conversation alive. ## What if the deadline cannot be met? Say so, with the earliest credible date and interim measures: completed Cyber Essentials where relevant, a current penetration test summary, your security policies and the dated certification programme. Customers with genuine risk concerns often accept a supplier who demonstrates control and momentum. What they cannot accept is surprise. ## Frequently asked questions about customer ISO 27001 requirements ### Can we say we are 'working towards ISO 27001' in a tender? Yes, if it is true and you describe it accurately: implementation under way, the stage you have reached (for example, scope agreed and gap analysis complete), who is supporting it, your target certification window, and no certificate number or certification-body logo until the certificate exists. Tender evaluators see through inflated claims, and misrepresentation can cost more than the contract. ### Will Cyber Essentials satisfy a customer asking for ISO 27001? Only if the customer agrees. Cyber Essentials is a UK baseline covering five technical control areas and ISO 27001 is an audited management system, so where a tender names ISO 27001 a different certificate rarely substitutes; where the requirement reads 'ISO 27001 or equivalent assurance', ask the customer in writing what they will accept before assuming. ### Our customer gave us 90 days. Is that realistic? For a small, single-site organisation with reasonable controls already in place, being audit-ready in about three months is occasionally possible, but certification itself also depends on the certification body's diary, and the system needs a period of operating evidence. The credible response is a dated programme: scope, gap analysis, implementation milestones and booked audit stages. ### Should we tell the customer we are not certified yet? Yes, plainly and early. Procurement teams deal with suppliers at every stage of certification, and a clear position with evidence of progress usually keeps the conversation alive; late surprises at contract stage do the damage. ## Contact A customer is waiting on your answer? Arrange a readiness discussion: [contact ISO Security](/contact) or email info@isosecurity.co.uk.