A tender asks for ISO 27001 and you don't have it yet: what to do
A tender or a big customer's supplier form asks for ISO 27001, and you don't hold it. You can't get a certificate in time for a deadline a few weeks away: a certification body awards it after a two-stage audit, and most want to see your information security management system (ISMS) running for a few months first. But that doesn't always mean you can't bid. What decides it is how the requirement is worded, what you ask the buyer, and how much real, checkable progress you can show.
This guide walks through those three things, with wording you can adapt.
Step 1: read the requirement properly
Before deciding anything, find out exactly what kind of requirement it is. The same words, "ISO 27001", can mean very different things.
| How it's worded | What it usually means | What you can do |
|---|---|---|
| "Must hold ISO 27001 certification" in a pass/fail or mandatory section | No certificate, no bid | Ask whether a plan with dates is acceptable; if not, start now for the next one |
| "ISO 27001 or equivalent" | The buyer cares about the controls, not the badge | Show an equivalent: a documented ISMS, Cyber Essentials, evidence |
| A scored question about information security | Certification earns marks, but it's not the only way | Answer with a specific, evidenced description of what you do |
| "Required before contract start" or "within X months of award" | You have until then, not until the bid deadline | Give a dated plan that lands before that point |
| A supplier questionnaire: "Do you hold ISO 27001?" | Often one input into a wider security assessment | Answer honestly, then show what you do have |
Check two more details while you're there:
- Scope. A certificate only counts if its scope covers the services you're bidding for. The same applies to your plan: make sure the ISMS you describe covers this work.
- Accreditation. Many buyers expect a certificate from a UKAS-accredited certification body (or one accredited by another national body). If you're about to choose a certification body, check this first.
Step 2: ask the buyer before you decide
Most tenders have a clarification period, and most customers will answer a direct question. Ask before you rule yourself in or out. Keep it short and factual:
We don't currently hold ISO 27001 certification. We have begun implementing an ISMS to ISO/IEC 27001:2022, and we can provide our scope, risk assessment, Statement of Applicability and information security policy, with a dated plan to certification. Would the authority accept this, with certification required by [contract start / a date you set], in place of a current certificate at the point of bid?
You'll get one of three answers, and each is useful:
- "Yes, with evidence." Now you know exactly what to put in the bid.
- "Yes, if you're certified by [date]." You have a real deadline to plan backwards from.
- "No." You haven't wasted a week writing a bid that would fail at the first gate, and you know to start now so you're ready for the next one.
If you're bidding through public procurement, ask through the portal so the answer is on record. For a private customer, an email to your contact is usually enough.
Step 3: show real progress, not promises
"We're working towards ISO 27001" on its own is easy to write and easy to ignore. Buyers take it seriously when it comes with documents they could check. If you can, have these ready before the deadline:
- A defined scope. Which services, systems, sites and people the ISMS covers.
- An information security policy, approved by top management. Signed and dated, not a draft.
- A risk assessment and treatment plan. Your information assets, what could go wrong, and what you're doing about each risk.
- A Statement of Applicability (SoA). Each of the 93 Annex A controls, whether it applies, why, and whether it's in place.
- A dated plan. Internal audit, management review, stage 1 and stage 2, with months against each. See how long ISO 27001 takes for a realistic sequence.
- A booked certification body, if you can. A confirmed stage 1 date with a named certification body is the most concrete commitment you can make.
- Cyber Essentials, if you don't have it. It typically takes days to a few weeks and shows the basic technical controls are in place. It doesn't replace ISO 27001 where a buyer asks for ISO 27001, but it often matters in UK public-sector work. See Cyber Essentials vs ISO 27001.
You don't have to attach all of it. Offer it: "available on request" with a list of the documents shows you have them, and keeps sensitive detail out of a bid that many people will read.
What to write in the response
Be specific and dated. Vague answers lose marks; honest, specific ones often don't. Something like this, adapted to what's actually true for you:
We are implementing an information security management system to ISO/IEC 27001:2022, covering [the services in scope]. Our scope, risk assessment, Statement of Applicability and information security policy (approved by our managing director on [date]) are in place and available on request. Our ISMS has been operating since [month]. We plan an internal audit in [month] and a management review in [month], and we have [booked / are booking] stage 1 with [certification body, if booked] for [month]. We hold Cyber Essentials [certificate number, if you have it].
Then answer the rest of the security section on its own merits. If the buyer asks how you manage access, backups, suppliers or incidents, describe what you do and how you know it happens. That earns marks whether or not you hold a certificate.
What never to write
- "Certified" or "compliant" before you are. A buyer can check a certificate with the certification body. A false claim can lose you the contract after award, and your reputation with it.
- "Certification guaranteed by [date]." Nobody can guarantee it. The decision belongs to your certification body after the stage 2 audit. Say "planned" or "targeted".
- "Aligned with ISO 27001" with nothing behind it. Buyers read it as "not started".
- A certificate that doesn't cover this work. If your group or a sister company holds ISO 27001 but the scope doesn't include the services you're bidding for, say so plainly.
If the answer is no this time
If the buyer needs a certificate at the bid deadline and won't move, this tender has gone. The next one won't have, if you start now:
- Note the date of the next likely tender, or the renewal of this contract, and plan backwards from it.
- Get quotes from two or three UKAS-accredited certification bodies and pencil in dates. A date in the diary keeps the work moving.
- Name one owner who runs the ISMS week to week, with top management behind them.
- Start running the system early. The months of operation a certification body wants to see only start counting once you're actually doing the work.
Many teams find that, once they start, the same work answers customer security questionnaires faster too, because the answers come from records you already keep. See customer security questionnaires.
Frequently asked questions
Can we bid without ISO 27001 if the tender asks for it? It depends on the wording. If it's a mandatory pass/fail requirement, usually not. If it says "or equivalent", or it's scored, or it's required by contract start rather than at bid, often yes, with evidence. Ask the buyer.
Is Cyber Essentials an equivalent to ISO 27001? No. Cyber Essentials checks five technical controls. ISO 27001 is a management system covering risks, policies, people, suppliers and continual improvement. Some buyers accept Cyber Essentials for lower-risk work, but don't present it as ISO 27001.
How soon can we be certified? Usually several months from starting, mainly because the ISMS has to run before stage 2 and the certification body has to fit you in. See how long ISO 27001 takes.
Should we use a consultant to hit the date? A consultant can help with a hard deadline, but the running time before stage 2 still applies. See can you get ISO 27001 without a consultant?
How ClearIMS helps
ClearIMS is for businesses that need ISO 27001 but don't want to build a compliance team to get there. A step-by-step setup wizard gets you started, and on a paid plan the AI drafts your scope, risk register, Statement of Applicability and policies from a plain-English description of your business. A named person in your business approves every record; the AI never approves anything. Policies are versioned and export to PDF, and the Recommended tasks list puts the rest of the work in order, whether you've got 5 minutes or 5 hours.
We make the software. Your certification is yours, awarded by your certification body. The price is £300 a month, monthly with 30 days' notice, with unlimited users and no VAT charged.
Got a tender in front of you? Book a 20-minute call and bring the requirement, or try the demo company to see a fully set-up ISMS first.