A customer has asked for ISO 27001: what to do in the first two weeks
A customer has asked whether you have ISO 27001, and you don't. Don't panic and don't bluff. A certificate takes months, not two weeks, but the first two weeks decide whether the customer sees a supplier who is taking security seriously. This plan is written for a business owner or IT manager who has just been handed the job.
Days 1 to 3: find out what they actually want
"Do you have ISO 27001?" can mean several different things, so ask before you act:
- Do they need the certificate, or evidence that you work to the standard?
- Is it a condition of signing, or of renewing later in the year?
- Is there a date, and is it fixed or flexible?
- Would they accept a clear plan with dates, or a completed security questionnaire for now?
Many buyers are more flexible than the first email suggests, but ask rather than assume. Write down the answers and who gave them. That one conversation often changes the whole plan, and it shows the customer you are taking this seriously.
Days 3 to 7: take stock of what you already do
You almost certainly do more than you think: passwords, backups, who has access to what, how you onboard and remove staff, which suppliers hold your data. Start a simple list:
- the systems and information that matter most to your customers
- who is responsible for each one
- the suppliers that touch customer data
- the policies you already have, even if they are out of date
Don't aim for perfect. The point is to find out what is written down, what is only in someone's head, and what is missing. That last group is where the risk, and the dependency on one person, usually sits.
Days 7 to 10: agree scope, owner and a realistic plan
ISO 27001 is about running an information security management system (ISMS): you decide what is in scope, assess your risks, put controls in place and keep reviewing them. Two decisions matter this week:
- Scope. A narrower scope, such as the service this customer actually uses, is usually quicker to get running than "the whole company". Your certification body has the final say on whether a scope is acceptable.
- An owner. Someone senior has to be named, with real time. If it only ever happens "when there's a gap in the week", it won't happen.
Also decide if you need help. Some businesses use a consultant, some do it themselves with software. See can you get ISO 27001 without a consultant?
Days 10 to 14: reply to the customer
Send a short, honest reply. It should say that you don't hold ISO 27001 today, that you have started work towards it, who owns it, and when you will next update them. Attach what you can: your current policies, a completed questionnaire, or a one-page summary of how you protect their data. Never say you are certified, or "nearly there", unless an accredited certification body has told you so.
Two weeks in, you won't have a certificate. You should have a named owner, a list of what you already do, a scope, a plan and a customer who knows where you stand. That is a strong position, and it is worth more than a rushed claim that falls apart under questions.
What comes after the two weeks
Certification is awarded by a certification body after a two-stage audit, and they usually want your system to have been running for a while first. See how long ISO 27001 takes for realistic ranges. If the request came through a tender, read a tender asks for ISO 27001. Sector pages cover the particular questions buyers ask: public-sector suppliers, NHS suppliers and ISPs and altnets.
Questions people ask
Can we get certified in two weeks? No. A certification body decides, after an audit, and the audit comes after your system has been set up and running. Use the two weeks to build credibility, not to claim a result.
Should we tell the customer we are working towards it? Yes, if it is true and you can show real progress. Be specific about what is done and what is planned.
Do we have to do this ourselves? No, but someone in your business must own it. Advisers and software can do a lot of the drafting, but your people decide and approve.
How ClearIMS helps
ClearIMS is for businesses that need ISO 27001 but don't want to build a compliance team to get there. A step-by-step setup wizard gets you started, and once AI drafting is activated for your organisation the AI drafts your scope, risk register, Statement of Applicability and policies from a plain-English description of your business. A named person in your business approves every record; the AI never approves anything. The Recommended tasks list puts the work in order, whether you have 5 minutes or 5 hours.
We make the software. Your certification is yours, awarded by your certification body. The price is £300 a month, monthly with 30 days' notice, with unlimited users and no VAT charged.
Got a customer request in front of you? Book a 20-minute call and bring it, or try the demo company to see a fully set-up ISMS first.