ISO 27001 in public sector tenders

What ISO/IEC 27001 is

ISO/IEC 27001 sets the requirements for an information security management system: the policies, risk assessments and controls an organisation uses to keep information confidential, accurate and available, and to keep improving how it does so. The current edition is ISO/IEC 27001:2022, published in October 2022, with an amendment in 2024 adding climate action changes. The 2013 edition has been withdrawn.

The move to the 2022 edition had a deadline. UKAS set 31 October 2025 as the date by which certification bodies had to complete the transition of all their certified clients. A certificate that still says 2013 will prompt questions from any buyer who looks closely.

ISO writes the standard but does not certify anyone. Certification is done by independent certification bodies, and in the UK those bodies are checked by UKAS, the government-appointed national accreditation body. That chain matters when a buyer tests your certificate.

ISO 27001 or Cyber Essentials?

They are different things, and buyers ask for them for different reasons. Cyber Essentials is a government scheme covering five basic technical controls. Central government departments, their executive agencies and non-departmental public bodies, and NHS bodies must require it, or equivalent controls, for contracts that handle personal data or certain government systems and information (PPN 014). ISO 27001 is a management system for information security risk across whatever scope you choose to certify. No equivalent policy note makes it mandatory, so whether it appears is up to the buyer and the risk in the work.

One does not stand in for the other. PPN 014 says holding ISO 27001 will not automatically meet Cyber Essentials, because an ISO 27001 scope often leaves out some of its controls, so most holders will also need Cyber Essentials or must show equivalent controls. If a tender asks for both, answer both.

Certified, or "aligned with"

ISO says an organisation can choose to implement the standard without being certified. Plenty do. But "aligned with ISO 27001" is your own claim; nobody independent has checked it. The Procurement Act lets a buyer ask for evidence that can be verified by someone other than the supplier (section 22(6)), so where a tender asks for certification, alignment alone will not meet the condition. Where it asks how you manage information security, alignment can be a fair answer if you show the evidence behind it.

ISO also asks that certificates are referred to by their full reference, such as "certified to ISO/IEC 27001:2022" rather than "ISO 27001 certified". Use the full reference in bids: it answers the edition question before anyone asks.

How a buyer checks your certificate

UKAS CertCheck is a free, public database for checking claims of UKAS accredited management system certification, and buyers can set alerts if a certificate's status changes. To verify accredited certificates worldwide, ISO points to IAF CertSearch, which gathers data from accreditation and certification bodies in one place. UKAS also publishes warnings about counterfeit certificates and bodies falsely claiming UKAS accreditation, so expect a careful buyer to check where your certificate came from.

For a sense of what a careful public buyer checks, the UK Health Security Agency's data security standards ask for the certificate number, registration and expiry dates, the certified organisation's name and address, the scope and the Statement of Applicability, and confirmation that the certificate covers the locations where the data will be processed. It must be issued by a UKAS accredited body, and expired certificates are refused.

Why the scope matters

A certificate covers only what its scope statement says: particular services, sites or systems. The NHS data access request service, for example, asks organisations to confirm that their scope and Statement of Applicability are aligned to their role in the work. A certificate for the wrong part of your business proves little about the part the buyer is paying for.

The Statement of Applicability

The Statement of Applicability is the document in which you record which security controls you apply, why, and why you have left any out. Some buyers ask to see it, or ask you to confirm that it covers the work, as the UKHSA and NHS examples above do. It can reveal a lot about your defences, so it is reasonable to offer it under the buyer's confidentiality terms or to provide the relevant extract rather than the whole document.

What to submit

• A copy of the current certificate, showing the edition (2022), issue and expiry dates and the certificate number.
• The name of the certification body, and that it is UKAS accredited (or accredited by another recognised body).
• The scope statement, word for word, and a sentence on how it relates to this contract.
• The Statement of Applicability, or the relevant extract, if the tender asks for it.
• Cyber Essentials or Cyber Essentials Plus as well, if the tender asks for it separately.

If you are not certified

Under the Procurement Act 2023, which governs most public buyers in England, Wales and Northern Ireland, every condition of participation must be a proportionate way of checking that you can do the work, having regard to the nature, complexity and cost of the contract (section 22). A condition cannot require particular qualifications without allowing for their equivalents, and cannot break the rules on technical specifications in section 56.

Be precise about what section 56 says, because it is often overstated. Where tender documents refer to a UK standard (one set by the British Standards Institution or developed mainly for UK use), they must say that an equivalent will be accepted, and the buyer may ask for certification or other evidence of equivalence. ISO 27001 is an international standard, so whether the buyer must accept an alternative depends on how the requirement is worded. For Cyber Essentials, the government is clear: PPN 014 tells in-scope buyers they must accept equivalents.

For smaller contracts below the thresholds, a buyer cannot restrict who may submit a tender by assessing suitability first (section 85, with an exception for larger works contracts), so a certificate cannot be used as a gate to bidding.

What to do

• Read whether it is a pass or fail condition or a scored question. A scored question lets you earn marks without the certificate.
• If it is pass or fail on a small, low-risk contract, ask a clarification question before the deadline: does the buyer accept equivalent evidence, and what would satisfy it?
• Show evidence someone else has checked: Cyber Essentials Plus, an independent penetration test, or a client's security audit.

Only write what is true, and keep the dates realistic: a buyer can check later. For more on structuring answers like this, see writing a tender response, and weigh up whether the contract is worth the effort with the bid or no bid decision.

ISO 9001 and ISO 14001

The same logic applies to the other management system standards buyers ask about: ISO 9001 for quality management and ISO 14001 for environmental management. Both are certified by independent bodies, both carry a scope, and both can be checked on UKAS CertCheck. None is a legal requirement for bidding, and what you need before you bid covers when they are worth getting. Search live tenders that mention any of them with the tender finder.

Need help? See specialists for ISO certification, including ISO 27001, ISO 9001 and ISO 14001.