ISO 27001 Certification: What It Requires and What to Ask an Outsourcing Partner

TL;DR

A certificate shows an auditor found a security system in place inside a declared scope, so read the scope and the Statement of Applicability before you trust the logo. A 2013 certificate is past its 31 October 2025 deadline, and Malaysia’s PDPA amendments add legal duties that no certificate covers.

Ask an outsourcing vendor how it protects data and the answer usually arrives as a logo and the words “ISO 27001 certified.” That is ISO 27001 certification doing its marketing job. If you are a CFO or CHRO about to hand payroll files or customer records to a team in Malaysia, the logo settles very little. The standard describes how a company should manage information security, and a certificate is an auditor saying the system existed, for a stated scope, on the audit dates.

Scope is where buyers get caught. A certificate can cover one floor of one office while your work is delivered from another building. It can also be a 2013 edition that the market was meant to leave behind on 31 October 2025.

Treat the certificate as the first document in your due diligence, not the last. And remember that Malaysia’s PDPA amendments add a legal layer that no certificate replaces. The sections below take the standard apart so you can test a vendor against it.

What does ISO 27001 certification prove?

ISO 27001 certification proves that an independent auditor found an information security management system in place at a named organisation, inside a declared scope, when the audit took place. It does not prove that the whole company is secure or that every site is covered, and it cannot promise that incidents will not happen. The standard is explicit that certification applies only within the declared scope and does not guarantee incidents are prevented, as the ISO/IEC 27001 overview records. The scope statement therefore decides what a certificate means. A certificate that names one delivery centre says nothing about a second centre or a subcontractor. For a buyer, the certificate is evidence that a disciplined process exists where your work will be done, but only if the scope matches your engagement and the certificate is still current.

Buyers over-read certificates in one predictable way. A procurement team sees the certificate on a vendor’s website, ticks the security box and moves on. Nobody opens the scope line. Nobody asks if the delivery site you will use is on it.

Inside the scope the vendor has identified its risks, chosen controls, and had an auditor test them. Outside it you have no audit evidence at all. Plenty of companies scope a certificate to the division that sells to security-sensitive clients, and that is a sensible call. It only hurts you when your work is delivered from a site the scope leaves out.

What does an information security management system have to include?

An information security management system (ISMS) sounds heavy. Underneath, it’s paperwork and habits: what gets protected, who answers for it, how the company checks its own work. Clauses 4 to 10 of ISO/IEC 27001 set the requirements, and they run like a management cycle:

• Clause 4, context: who has a stake in the company’s security, and where the boundary of the system sits. Scope starts here.
• Clause 5, leadership: senior management owns the policy and hands out roles. A system nobody senior owns tends to decay.
• Clause 6, planning: the risk assessment lives here, with the security objectives and a treatment plan for each risk.
• Clause 7, support: budget, people with the right skills, awareness training and the documents the system rests on.
• Clause 8, operation: carrying out the treatment plan, then redoing the assessment whenever something changes.
• Clause 9, performance evaluation: monitoring, internal audit and management review.
• Clause 10, improvement: fixing nonconformities and tightening the system.

That is why a certificate carries weight. Buying software will not get a vendor through the audit. Someone has to hold a named role, write the risk assessment, run internal audits and show that management read the results.

The same structure shows you where a weak programme hides, and clause 9 is the place to look. Internal audit and management review fade first when a delivery team is busy, yet they keep the other clauses honest. Ask the vendor what its last internal audit found. A real answer names a change that followed; a thin one reaches for the policy folder.

How do the risk assessment and the Statement of Applicability work?

Which controls a company applies comes out of its risk assessment, and the Statement of Applicability is where that decision gets written down. Under ISO/IEC 27001, the company assesses its information security risks, picks controls to treat them and records the picks in the Statement of Applicability, or SoA.

The SoA tells a buyer more than anything else in the pack. It lists the controls in the standard, ticks the ones the company applies and gives a reason for each one left out. An exclusion is not automatically a red flag: a vendor that writes no software has little use for secure coding controls. An exclusion that touches your data, such as media handling, remote working or supplier relationships, deserves a direct question.

Ask for the SoA’s version and date too. If it predates the current edition of the standard, the system has not been refreshed. Some vendors want a confidentiality agreement signed first because the document describes their security posture in detail, which is a normal request. A flat refusal to share it, or even to walk you through it on a call, is a worse sign.

Free consultation. If you are comparing outsourcing partners for Malaysia and want a second pair of eyes on a security questionnaire, book a free consultation with the SummitNext team to talk through the questions that matter for your engagement.

What changed in the 2022 edition?

The 2013 edition listed 114 controls. The 2022 edition lists 93, sorted into four themes: organizational, people, physical and technological. The TUV SUD transition guidance walks through the regrouping, and the standard’s overview page gives the same numbers.

Those themes line up with the questions you’d ask a vendor anyway:

• Organizational: policies, roles and how the vendor manages its own suppliers.
• People: how staff are screened and trained, how remote working is handled, and what happens on the day someone leaves.
• Physical: secure areas, visitor handling and equipment on the delivery floor.
• Technological: access rights, logging, protection of data and the tools your team uses.

The mapping is ours, not the standard’s. It still works as a checklist. If you’re buying a contact centre or a back-office team, spend your questions on the people and physical themes, since screening and floor security shape most of what happens to your data day to day.

A smaller number doesn’t mean a lighter standard. Controls were merged and reorganised, and every management clause still applies. If a vendor tells you the 2022 certificate is easier to get because there are fewer controls, be sceptical.

How does ISO 27001 certification work, and how long does it last?

A certification body runs the first audit in two stages. The certificate then lasts three years, with surveillance audits at least once in each calendar year except the years in which recertification takes place, per the ISO/IEC 27001 overview.

You can check this on paper. Look for an issue date, an expiry date and surveillance audits in between. A surveillance audit more than a year old, outside a recertification year? Ask why.

And get the certificate itself, not a screenshot of a logo. It names the certification body, the standard and edition, the scope and the dates. A marketing page rarely carries all of that.

Is a 2013 certificate still acceptable?

An ISO/IEC 27001:2013 certificate is past its transition deadline, which was 31 October 2025, so a vendor still quoting it should be asked for evidence of the 2022 edition. As the TUV SUD transition guidance explains, the 2022 edition replaced the 114 controls of the 2013 edition with 93 controls in four themes, so a Statement of Applicability built on the older list is also out of date. There may be an innocent reason, such as a website nobody updated. The vendor may hold a valid 2022 certificate. The fix is simple to request: ask for the current certificate, its edition, the scope statement and the date of the last audit. A vendor that cannot produce a 2022 certificate after the deadline has no certificate you can rely on under the current edition, as of this publication date.

Old 2013 certificates sit in vendor files because nobody has opened the folder in a while. If you find one, bad faith is unlikely. Ask for the replacement, and treat a slow answer as information.

What should you ask an outsourcing partner about ISO 27001?

Ask the partner to show you in writing that the certificate covers the site and service you will use. It should also cover the data your engagement will touch. Seven requests do most of the work:

• Certificate name and body: the exact standard and edition on the certificate, and the certification body that issued it. Ask for the full document, not a badge.
• Scope statement: the wording of the scope, checked against the delivery site and the service you will buy. The address and the activity both need to match.
• Statement of Applicability version: the version number and date, and a list of excluded controls with the reasoning. A version written for the 2013 edition is out of date.
• Expiry and last surveillance date: the certificate’s expiry date and the date of the most recent surveillance audit, read against the three-year cycle.
• Client data segregation: how your data is kept apart from other clients’ data, in systems and access roles as well as on the floor itself. Ask where that arrangement is described in the vendor’s documented controls.
• Subprocessors: every third party that touches your data, such as hosting or telephony. Ask if each sits inside the vendor’s scope or has its own assurance, and check what the contract says about changes to that list.
• Incident notification terms: how soon the vendor tells you about an incident, through which channel and with what detail. Match this against the notification duties you carry yourself.

None of these is a hostile question. A vendor with a working system answers from documents it already holds. Slow replies or general reassurances tell you something about the system behind the certificate.

For a wider view of vendor selection, see this framework for choosing a BPO partner, and for customer-facing operations the guidance on selecting a customer support outsourcing partner covers the operational side of the same decision. If you are still deciding what to outsource at all, what BPO means for your operations sets out the model.

Where does Malaysia’s PDPA fit alongside a certificate?

A certificate does not replace legal compliance. Malaysia’s Personal Data Protection Amendment Act 2024 (Act A1727) was phased in, and two of its stages matter for anyone outsourcing work that touches personal data. Per the Data Protection Report summary, processor obligations took effect on 1 April 2025, together with changes to cross-border transfers and higher penalties. Breach notification to the Commissioner and to affected individuals, plus data protection officer appointment and data portability, followed on 1 June 2025. Penalties can reach RM1,000,000 and/or three years’ imprisonment.

An ISO/IEC 27001 certificate speaks to how an organisation manages security risk. The PDPA speaks to what the law requires when personal data is processed, who must be told after a breach and how fast. The two overlap, since a good incident process helps with notification, but neither stands in for the other. A vendor can hold a valid certificate and still need contract terms that spell out processor duties and breach reporting to you.

That is why the incident notification question belongs in your list. If you have to notify the regulator or affected individuals, you depend on the vendor telling you promptly and with enough detail. Write that expectation into the agreement rather than assuming the certificate covers it. Take legal advice on how the amendments apply to your arrangement, because this article describes the duties and does not apply them to your facts.

For a Malaysian view of the operational side, the article on data privacy and compliance in Malaysian BPO and CRM operations goes deeper into how outsourced teams handle personal data.

Who owns access control when the team works for you?

Access control is an operational decision, and it stays with the client. Under SummitNext’s employer of record model, the split is clear: SummitNext owns HR responsibilities such as payroll, compliance and benefits. You keep operational management of the people doing the work. Deciding who gets access to which of your systems, and reviewing that list, falls on the operational side. Put it in the contract and in a named owner’s job description.

Where staff work also changes the scope question. SummitNext staff can work at your premises as well as at a delivery site. Work done inside your own building and network sits under your own controls, so the vendor’s scope statement matters less for the site and more for how it manages its people and their records. For the people side, HR outsourcing in Malaysia explains how the HR responsibilities are divided.

These points apply to SummitNext as they do to any provider. Ask any vendor to show its certificate, its scope and its Statement of Applicability in writing. For the buyer’s side of a security-first engagement, see how SummitNext approaches secure outsourcing for regulated enterprises, and for the wider service, security and compliance support within outsourced operations. The way delivery sites are distributed also shapes where your data lives, as the explainer on how delivery models split work between sites shows.

Frequently asked questions

What does ISO 27001 certification cover?

Only what the organisation put inside its declared scope, as an independent auditor found it on the audit dates. Sites and subcontractors outside the scope aren’t covered, and the certificate promises nothing about future incidents. Read the scope statement on the certificate itself before you rely on anything else.

How long is an ISO 27001 certificate valid?

Three years, with checks along the way. Surveillance audits happen at least once in each calendar year, except in the years when recertification takes place. So ask the vendor for the expiry date and the date of its latest surveillance audit, and see whether the two fit that cycle.

Is an ISO 27001:2013 certificate still valid?

No. After the transition deadline of 31 October 2025, an ISO 27001:2013 certificate shouldn’t be relied on. If a vendor still quotes one, ask for the 2022 certificate, the scope statement and a Statement of Applicability that reflects the 93 controls of the current edition.

Does an ISO 27001 certified vendor still have data breaches?

Yes, it can. Certification doesn’t guarantee that incidents won’t happen. What it shows is that a system exists for finding and ranking risks and responding to failures, which makes incidents easier to spot and explain. You still need contract terms on notification, cooperation and who is responsible when something goes wrong.

Does ISO 27001 certification satisfy Malaysia’s PDPA?

No. A certificate covers how a company manages security risk, while the PDPA sets legal duties, including processor obligations from 1 April 2025 and breach notification from 1 June 2025. Cover those duties in the contract, and take legal advice on how they apply to you.

What should I check in a vendor’s ISO 27001 scope statement?

Start with the delivery site and the service you’re buying. Both should appear in the scope, because the certificate applies only inside it. Match the address and the activity to your engagement. If your team will sit elsewhere or use subprocessors, ask in writing whether those are covered or separately assured.

Conclusion

ISO 27001 certification is a useful signal and a poor substitute for reading what sits behind it. An auditor found a management system in place, inside a scope, on certain dates, and that is all the certificate says. Whether the scope covers your delivery site, your data and whoever else touches it is a question only you can ask.

So match the certificate to the engagement, check the edition against the 31 October 2025 deadline, and read the Statement of Applicability. Then put incident notification into the contract next to your PDPA duties. If you’d like help applying these questions to a Malaysia outsourcing plan, speak with our team and book a free consultation.