ISO/IEC 27001 is the international standard for information security management systems. A vendor certified to it has shown an accredited auditor that it identifies information security risks, chooses controls to treat them, and runs a management process that keeps those controls working. For a buyer of speech AI it is useful evidence of disciplined security practice, but it certifies a management system with a stated scope, not a product, a retention policy or legal compliance.
Key takeaways
- The current edition is ISO/IEC 27001:2022. Its Annex A lists 93 controls in four themes: organisational, people, physical and technological.
- Certificates to the 2013 edition had to be transitioned by 31 October 2025, so a current certificate should reference the 2022 edition.
- Certification runs on a three-year cycle: an initial two-stage audit, annual surveillance audits, then recertification.
- Always check the scope on the certificate. It should cover the service, teams and locations that will handle your audio.
- ISO 27001 is not a GDPR certification and does not prove that a particular control, such as deletion, meets your requirements.
What the standard specifies#
ISO/IEC 27001 is published jointly by ISO and the IEC. The 2022 edition, Information security, cybersecurity and privacy protection: Information security management systems: Requirements, was published in October 2022, and an amendment in 2024 added a requirement to consider climate change as a relevant issue. The body of the standard, clauses 4 to 10, sets out requirements for the management system itself:
- Context and scope (4). Which parts of the organisation and which services the ISMS covers.
- Leadership (5). Management commitment, an information security policy and assigned responsibilities.
- Planning (6). A documented risk assessment and risk treatment process.
- Support and operation (7, 8). Resources, competence, documentation, and carrying out the risk treatment plan.
- Performance evaluation (9). Monitoring, internal audit and management review.
- Improvement (10). Handling nonconformities and continual improvement.
Annex A is a reference list of controls. An organisation does not have to implement all of them. It decides which apply based on its risk assessment and records the decision, with justifications for exclusions, in a Statement of Applicability. Implementation guidance for each control is in the companion standard ISO/IEC 27002:2022.
The 2022 control set#
The 2022 revision reorganised the 114 controls of the 2013 edition into 93, grouped in four themes: 37 organisational, 8 people, 14 physical and 34 technological. Eleven controls were new, and several are directly relevant to a speech service:
| Control | Title | Why it matters for speech |
|---|---|---|
| 5.23 | Information security for use of cloud services | GPU capacity and hosting are usually bought from cloud providers |
| 8.10 | Information deletion | Audio and transcripts should be deleted when no longer needed |
| 8.11 | Data masking | Relevant to redacting personal data in transcripts and logs |
| 8.12 | Data leakage prevention | Recordings are high-value data to exfiltrate |
| 8.16 | Monitoring activities | Detecting abnormal access to audio stores or inference hosts |
| 8.28 | Secure coding | Streaming endpoints parse untrusted audio and control messages |
Established controls matter as much: supplier relationships (5.19 to 5.22) for sub-processors, privacy and protection of personal data (5.34), access control and cryptography.
How certification works#
A certificate is issued by a certification body, which should itself be accredited by a national accreditation body, such as the RvA in the Netherlands, DAkkS in Germany or UKAS in the United Kingdom. Accredited bodies follow ISO/IEC 17021-1 and the ISMS-specific requirements of ISO/IEC 27006.
Stage 1 checks that the documented ISMS, scope, risk assessment and Statement of Applicability are in place. Stage 2 tests, through interviews, records and sampling, whether the system actually operates as documented. Nonconformities must be corrected before the certificate is issued. Surveillance audits in the following two years examine a subset of the system, and a full recertification audit takes place before the certificate expires.
What it does and does not prove#
A current ISO 27001 certificate shows that:
- the organisation has a documented, risk-based approach to information security with management ownership;
- an independent, accredited auditor found that approach operating in practice within the stated scope;
- the system is re-examined every year.
It does not show that:
- every control is strong. The organisation chooses its controls and their strength based on its own risk appetite. Two certified vendors can have very different practices.
- the service you buy is covered. The scope might cover one product, one office or one data centre.
- data is handled the way you need. The standard requires a deletion control where relevant but does not set a retention period. Questions such as zero retention, training use and processing location still need contractual answers.
- GDPR compliance. ISO 27001 is not a certification mechanism under GDPR Article 42. It supports the security obligations in Article 32, but lawful basis, transparency and data subject rights sit outside it.
Related standards and frameworks#
| Framework | What it covers | Output |
|---|---|---|
| ISO/IEC 27001 | Information security management system | Certificate, three-year cycle |
| ISO/IEC 27701 | Privacy information management, building on 27001 | Certificate |
| ISO/IEC 27017 / 27018 | Cloud security controls / protection of PII in public clouds | Guidance, often audited with 27001 |
| ISO/IEC 42001 | AI management system | Certificate |
| SOC 2 | AICPA Trust Services Criteria, common in the US market | Attestation report (Type I or II) |
A SOC 2 Type II report describes controls and the auditor's test results over a period, so it contains more detail than an ISO certificate, but it is an attestation rather than a certification and is usually shared under NDA. European buyers more often ask for ISO 27001. For AI-specific governance, ISO/IEC 42001:2023 applies a similar management-system structure to the development and use of AI systems.
How Reson8 approaches this#
Resonate Labs B.V., which builds Reson8, is ISO 27001 certified. Security documentation is available at trust.reson8.dev. The certification sits alongside contractual commitments that it does not itself cover: processing on EU GPUs, no retention of audio, no training on customer data, and a GDPR Article 28 DPA.
Common questions#
Is ISO 27001 a legal requirement?
Generally no. It is voluntary, although customers, tenders and some sector rules ask for it or accept it as evidence of appropriate security measures.
How long does a certificate last?
Three years, provided the annual surveillance audits are passed. It then needs a recertification audit.
Can a company be "ISO 27001 compliant" without being certified?
It can say it follows the standard, but without an accredited audit there is no independent evidence. Prefer a certificate you can verify.
Does ISO 27001 cover a vendor's cloud provider?
Only through the vendor's own supplier controls. The cloud provider needs its own certification, and the vendor should assess it as a supplier.
This article is general information, not legal advice.
References#
- ISO/IEC 27001:2022. Information security, cybersecurity and privacy protection: Information security management systems: Requirements. ISO.
- ISO/IEC 27002:2022. Information security, cybersecurity and privacy protection: Information security controls. ISO.
- ISO/IEC 42001:2023. Information technology: Artificial intelligence: Management system. ISO.
- ISO/IEC 17021-1:2015. Conformity assessment: Requirements for bodies providing audit and certification of management systems.
- Regulation (EU) 2016/679 (General Data Protection Regulation), Articles 32 and 42. EUR-Lex.
- IAF CertSearch. International Accreditation Forum.