--- title: "ISO 27001 for Insurance and Financial Services (UK)" description: "ISO 27001 for UK insurers, brokers, MGAs and fintechs: how certification maps to FCA/PRA expectations, operational resilience and insurer due diligence." canonical: https://www.isosecurity.co.uk/resources/iso-27001-for-insurance-and-financial-services updated: 2026-11-10 --- # ISO 27001 for insurance and financial services Regulated firms buy ISO 27001 for an audited management system that evidences the governance, supplier oversight and incident discipline the FCA and PRA already expect, and that answers insurer, client and partner due diligence in one pass. I implemented the ISMS at Chaucer, the Lloyd's specialty insurer, and now head its IT security GRC function, which shapes how I scope this work. ## Why do regulated firms certify to ISO 27001? - **Regulatory evidence:** SYSC systems-and-controls expectations, PRA operational resilience and outsourcing rules all demand documented, tested arrangements. The ISMS is where they live. - **Market access:** brokers and MGAs face insurer security reviews under delegated authority; financial services suppliers and fintech firms face client and platform vendor-risk assessments. A certificate answers most of both. - **Data sensitivity:** claims, health and financial data raise the impact of a breach, with ICO enforcement and notification duties to match. - **Board assurance:** an independently audited system gives the board and SM&CR accountable executives something stronger than an internal assertion. ## What is different about ISO 27001 in this sector? **Scope follows the regulated activity:** for an insurer that usually means underwriting, claims and the platforms and data flows beneath them; for a broker or MGA, the broking operation and its insurer integrations; for a services firm, the regulated client's work, isolated credibly from the rest. Scope decisions made casually at Stage 1 are expensive to revisit. **Suppliers are the audit's centre of gravity:** software houses, coverholders, third-party administrators, claims handlers and cloud providers all sit in the chain. Annex A supplier controls (5.19 to 5.23) have to reflect SS2/21-style oversight: due diligence, contractual security terms, monitoring proportionate to criticality, and exit arrangements. If your supplier register is a spreadsheet nobody owns, that is where I start. **Incident management has three clocks.** A security incident can trigger FCA, PRA and ICO notifications on different timelines, alongside insurer or client notification clauses. The ISMS incident process must encode those duties explicitly, with pre-agreed escalation to accountable executives. **Resilience evidence is shared across both regimes.** Important business services, impact tolerances and scenario testing under the operational resilience framework overlap heavily with ISMS continuity controls (5.29, 5.30, 8.13). One evidence set, mapped to both, keeps two audit regimes from becoming two jobs. ## What is the route to certification for a regulated firm? 1. Scope against the regulated activities and data, confirmed with leadership. 2. Gap analysis mapped to both ISO 27001 and your existing regulatory control set, so remediation is done once. 3. Risk assessment and Statement of Applicability, with supplier oversight rebuilt where needed. 4. Evidence period with incident, access-review and supplier-monitoring routines operating for real. 5. Internal audit and management review with accountable-executive involvement an auditor can see. 6. Stage 1 and Stage 2 with a UKAS-accredited certification body; then surveillance aligned to your regulatory calendar. Timescales and fees follow the same shape as elsewhere (see [how long ISO 27001 takes](/resources/how-long-does-iso-27001-take) and [what it costs in the UK](/resources/iso-27001-cost-uk)), with the caveat that regulated scopes rarely sit in the smallest band. After certification, many firms keep the system under senior oversight through [virtual CISO services](/virtual-ciso-services) rather than adding a full-time appointment. For how this ran inside one regulated group, I have written up [my implementation of ISO 27001 at Chaucer](/case-studies/chaucer-iso-27001), the Lloyd's specialty insurer. ## Frequently asked questions about ISO 27001 for insurance and financial services ### Does the FCA or PRA require ISO 27001? Neither regulator mandates a particular standard, and their expectations (FCA SYSC requirements on systems and controls, and for dual-regulated firms the PRA's operational resilience (SS1/21) and outsourcing (SS2/21) rules) are principles-based. ISO 27001 certification is a recognised, independently audited way to structure and evidence much of what those rules expect (governance, risk assessment, supplier oversight, incident management and recovery), and it supports regulatory compliance alongside your regulatory duties. ### Does ISO 27001 certification satisfy DORA? The EU's Digital Operational Resilience Act applies directly to in-scope EU financial entities and carries its own requirements, including registers of ICT third-party providers and incident classification and reporting. A well-run ISMS provides much of the underlying evidence (risk management, supplier controls, incident processes, resilience testing), and DORA compliance still has to be assessed against DORA itself, article by article. ### We are a broker or MGA, not an insurer. Is ISO 27001 proportionate for us? Often yes, and increasingly it is insurers and capacity providers who make the decision for you: delegated authority arrangements, binder oversight and insurer security questionnaires now routinely ask how you protect policyholder data. Scoping the ISMS to your broking or underwriting support operation (rather than the whole group by default) keeps it proportionate, and at 50 to 150 staff implementation support typically falls in my published £16,000 to £24,000 band, excluding certification-body fees. ### How does ISO 27001 interact with our existing regulatory reporting? Build your regulatory reporting into the ISMS, with incident processes mapped explicitly onto your FCA, PRA and ICO notification timelines so a single incident runs one process with regulator-specific outputs. Auditors look for exactly that join-up: one incident register, clear escalation, and evidence that lessons changed controls. ## Contact Regulated, and being asked for the certificate? Arrange a readiness discussion: [contact ISO Security](/contact) or email info@isosecurity.co.uk.