--- title: "ISO 27001 for Satellite, Telecoms and Technology (UK)" description: "ISO 27001 for satellite, telecoms and tech operators: scoping network and ground operations, the Telecoms Security Act, ISO 27011 and customer assurance." canonical: https://www.isosecurity.co.uk/resources/iso-27001-for-satellite-and-telecoms updated: 2026-11-10 --- # ISO 27001 for satellite, telecoms and technology Operators in this sector secure two estates at once: the corporate business, and the network, ground or platform infrastructure customers depend on. ISO 27001 brings both under one audited management system, and I was Inmarsat's implementation consultant from 2017 to 2021 (England, Holland and North America), where exactly that scoping discipline was the heart of the work. ## Why do satellite and telecoms operators certify? - **Customer assurance:** enterprise, government and wholesale customers audit their connectivity and space-services suppliers hard; a certificate with the right scope answers most of it once. - **Regulatory structure:** telecoms security duties, and the expectations of sophisticated space-sector customers, both demand demonstrable risk management, and the ISMS is the framework that holds it. - **Supply-chain position:** primes and larger operators flow security requirements down their chains; certification is increasingly the entry ticket. - **Operational discipline:** change, access and incident control across network and ground systems benefit from being run as one system. ## What is different about ISO 27001 in this sector? **The scope decision dominates everything.** Corporate IT, network operations, ground segment, customer platforms: each candidate sits somewhere relative to the boundary. What sits inside that boundary determines audit cost, evidence burden and whether the certificate persuades the customers it was bought for. I settle this first, in writing, against your customer contracts; my [implementation guide](/resources/iso-27001-implementation-guide) shows how scoping works. **Engineering evidence replaces paperwork.** Auditors in this sector test change records, privileged access to operational systems, network segregation, logging and monitoring, and vulnerability management (Annex A 8.8, 8.15, 8.16, 8.20 to 8.22). If your NOC and engineering tools already produce that evidence, the ISMS should consume it directly. **Availability is a security property here.** Continuity and ICT readiness controls (5.29, 5.30) and tested backup (8.13) carry unusual weight when customers buy uptime, so expect auditors to probe failover claims against test records. **Suppliers include the exotic.** Launch, ground-station, transponder, cloud and network-equipment suppliers sit alongside ordinary IT vendors in the supplier register, with assurance proportionate to what each can do to you. The same register discipline described in my [security questionnaires guide](/resources/customer-security-questionnaires) applies, with higher stakes. ## What is the route to certification for an operator? 1. Scope workshop covering corporate, network and ground estates, tested against customer requirements. 2. Gap analysis with engineering leads, using ISO/IEC 27011 guidance where it sharpens control design. 3. Risk assessment that treats operational and corporate risks in one register with different owners. 4. Statement of Applicability; control gaps closed inside existing engineering processes. 5. Evidence period, internal audit (including operational sampling) and management review. 6. Stage 1 and Stage 2 with a certification body that has genuine sector competence, so ask who will audit you. Fees follow scope and headcount in the usual way, and my [UK cost guide](/resources/iso-27001-cost-uk) sets out the bands. Operators with multiple sites or 24-hour operations should expect the upper-middle of the range. Post-certification, surveillance audits land more comfortably when the system is owned day-to-day. My guide to [surveillance audit preparation](/resources/iso-27001-surveillance-audit) explains what auditors sample each year. For how this ran in practice, I have written up [my implementation of ISO 27001 for a major satellite communications company](/case-studies/inmarsat-iso-27001) across operations in England, Holland and North America. ## Frequently asked questions about ISO 27001 for satellite and telecoms ### Does ISO 27001 certification satisfy the Telecoms Security Act? Certification does not evidence compliance with the Telecommunications (Security) Act 2021 and its 2022 Security Measures Regulations, enforced by Ofcom. What ISO 27001 provides is the management system (risk assessment, governance, supplier control, incident process, audit) inside which those duties can be run and evidenced consistently. ### What is ISO/IEC 27011, and do we need it? ISO/IEC 27011 is telecommunications-specific guidance built on ISO/IEC 27002, interpreting the Annex A controls for telecoms operators. You certify against ISO 27001 and use ISO 27011 to shape control design in a network environment, and sector-familiar auditors will recognise its fingerprints in your Statement of Applicability justifications. ### How does ISO 27001 relate to NIS2 for operators with EU customers? The EU's NIS2 Directive imposes its own security and incident-reporting duties on in-scope entities, including many digital and telecoms providers, and EU customers increasingly flow its expectations down their supply chains. A working ISMS supplies much of the underlying machinery (risk management, supplier controls, incident handling and evidence), so map the two once, in one register. ### Should our network or ground operations be inside the ISMS scope? That is the defining scoping question in this sector, and your customer and regulatory requirements should answer it. If enterprise or public-sector customers buy network services from you, they will read the certificate schedule expecting those services inside; corporate IT can sometimes form a defensible separate scope, while the operational estate your customers rely on belongs inside. ### We are a small ISP or altnet. Is ISO 27001 realistic at our size? Yes, with proportionate expectations: the telecoms security framework tiers its own expectations by provider size, and an ISMS scaled to a small operator (a tight scope, a risk register your engineers recognise, evidence from your existing monitoring and change tools) is achievable without a compliance department. Many small providers start because a wholesale or public-sector opportunity requires it, and the management system then also disciplines the security duties they already carry. ## Contact Operating infrastructure your customers audit? Arrange a readiness discussion: [contact ISO Security](/contact) or email info@isosecurity.co.uk.