Why do regulated firms certify to ISO 27001?
- Regulatory evidence: SYSC systems-and-controls expectations, PRA operational resilience and outsourcing rules all demand documented, tested arrangements. The ISMS is where they live.
- Market access: brokers and MGAs face insurer security reviews under delegated authority; financial services suppliers and fintech firms face client and platform vendor-risk assessments. A certificate answers most of both.
- Data sensitivity: claims, health and financial data raise the impact of a breach, with ICO enforcement and notification duties to match.
- Board assurance: an independently audited system gives the board and SM&CR accountable executives something stronger than an internal assertion.
What is different about ISO 27001 in this sector?
Scope follows the regulated activity: for an insurer that usually means underwriting, claims and the platforms and data flows beneath them; for a broker or MGA, the broking operation and its insurer integrations; for a services firm, the regulated client's work, isolated credibly from the rest. Scope decisions made casually at Stage 1 are expensive to revisit.
Suppliers are the audit's centre of gravity: software houses, coverholders, third-party administrators, claims handlers and cloud providers all sit in the chain. Annex A supplier controls (5.19 to 5.23) have to reflect SS2/21-style oversight: due diligence, contractual security terms, monitoring proportionate to criticality, and exit arrangements.
If your supplier register is a spreadsheet nobody owns, that is where I start.
Incident management has three clocks. A security incident can trigger FCA, PRA and ICO notifications on different timelines, alongside insurer or client notification clauses. The ISMS incident process must encode those duties explicitly, with pre-agreed escalation to accountable executives.
Resilience evidence is shared across both regimes. Important business services, impact tolerances and scenario testing under the operational resilience framework overlap heavily with ISMS continuity controls (5.29, 5.30, 8.13). One evidence set, mapped to both, keeps two audit regimes from becoming two jobs.
What is the route to certification for a regulated firm?
- Scope against the regulated activities and data, confirmed with leadership.
- Gap analysis mapped to both ISO 27001 and your existing regulatory control set, so remediation is done once.
- Risk assessment and Statement of Applicability, with supplier oversight rebuilt where needed.
- Evidence period with incident, access-review and supplier-monitoring routines operating for real.
- Internal audit and management review with accountable-executive involvement an auditor can see.
- Stage 1 and Stage 2 with a UKAS-accredited certification body; then surveillance aligned to your regulatory calendar.
Timescales and fees follow the same shape as elsewhere (see how long ISO 27001 takes and what it costs in the UK), with the caveat that regulated scopes rarely sit in the smallest band. After certification, many firms keep the system under senior oversight through virtual CISO services rather than adding a full-time appointment.
For how this ran inside one regulated group, I have written up my implementation of ISO 27001 at Chaucer, the Lloyd’s specialty insurer.