Software agencies & IT providers
Enterprise security reviews, DORA and NIS2 supplier clauses and tenders that require ISO 27001 all land on the agency that builds or runs the software. We build the ISMS around how an agency actually works - many clients, their environments, your pipeline - so you answer with evidence instead of promises.
Where it comes from
Agencies rarely choose ISO 27001 in the abstract. It arrives through a client - and increasingly through a client's regulator.
A 200-question security review arrives with a new contract or a renewal. Without a management system behind the answers, every questionnaire is written from scratch, and every one is a little different.
Banks, payment and e-money institutions, insurers and investment firms must manage ICT third-party risk and put specific terms into their ICT contracts. If you build or run software for one, those terms - audit rights, incident assistance, security measures, exit arrangements - are now in your contract.
Essential and important entities must address supply-chain security, including their relationships with direct suppliers and service providers. You are not in scope of NIS2 because your client is, but you will be asked to show the controls their obligation depends on.
Public and enterprise tenders increasingly list ISO 27001 certification as a qualifying requirement. Without it you do not reach the scoring stage, however good the proposal.
On DORA from the financial entity's side, see DORA readiness; on whether NIS2 reaches you at all, see NIS2 scope.
What we focus on
The controls are the same standard. Where they bite is different: you work inside other people's systems, for many clients at once, often with people who are not your staff.
Repositories, cloud accounts, staging and production belonging to your clients - granted per engagement, reviewed while it runs and revoked when it ends, with a record of each step.
Code, data, credentials and documentation for one client never reachable from another engagement. Auditors and client security teams both look for this first.
Secure development lifecycle, secure coding, security testing, outsourced development and change management - Annex A 8.25 to 8.32 - evidenced from the pipeline you already use, not a separate paper process.
The people who are not on your payroll but are in your clients' code. Onboarding, confidentiality terms, access and offboarding treated with the same discipline as staff.
Your contracts promise notification within hours. The ISMS has to make that true: detection, triage, a named owner and a way to tell each affected client what they need to know.
The DORA and NIS2 clauses in your client contracts mapped onto controls you already operate, so the next questionnaire is answered from evidence rather than drafted from scratch.
Free checklist
18 checks covering everything above, scored Yes / Partly / No, each with what a pass looks like and how agencies most often fail it - plus a map from your clients' security clauses to your controls. An editable Excel workbook.
How it runs
Our auditors hold ISO/IEC 27001 Lead Auditor, ISO 9001 Lead Auditor and ISO/IEC 42001 Lead Auditor certification. Readiness is judged the way your certification body will judge it, and once you are certified we run the independent internal audit the standard requires every year.
Three ways to work with us
Every option ends in the same place: ready for your certification body's Stage 1 and Stage 2 audits. The difference is who does the writing, the evidence-gathering and the running.
You do the work, we lead it
Agencies with someone in-house who can own the ISMS and has the time to build it.
You provide: An internal owner who writes the documents and gathers the evidence, with our review.
Ask for a fixed quoteWe build it with you
Most agencies: a busy delivery team that needs the management system built, not explained.
You provide: People who run the controls day to day and a few hours a week for workshops and reviews.
Ask for a fixed quoteWe act as your ISMS lead
Agencies with no one to spare, or a client or tender deadline that cannot move.
You provide: Your team still operates the controls and answers the auditor's questions - no one can be certified on your behalf.
Ask for a fixed quoteEach option is quoted as a fixed price after a short scoping call, based on team size, the number of client engagements in scope and how much already runs. Certification body audit fees are separate and paid to the certification body directly. Not sure where you stand? Start with a Mini Gap Review.
Questions
Usually not. DORA applies to financial entities, and to ICT third-party providers only if they are designated as critical by the European Supervisory Authorities - a small number of large providers. NIS2 applies to entity types listed in its annexes above a size threshold. What does apply to most agencies is the contract: your regulated client has to impose terms on its ICT suppliers, and those terms become your obligations.
It covers most of what a client will ask to see - supplier controls, access, incident management, business continuity, secure development - and it gives you one evidence base to answer from. It is not a substitute for the specific contractual terms DORA requires, such as audit and access rights or exit arrangements. We map your client's clauses to your controls and show where something extra is needed.
Normally the services you deliver to clients and the people, tools and environments behind them - including access into client systems. A scope that leaves out the delivery teams is easy to certify and useless in a client security review, because that is exactly what the client is asking about.
It adds questions about training data, model providers and inference logging that ISO 27001 only partly answers. ISO 42001 is the AI management system standard and shares the same structure as ISO 27001, so it can be added to the same management system later rather than built separately.
It depends on the size of the scope and how much already operates. A Mini Gap Review typically takes one to two working days, subject to scope, and tells you where you stand; a readiness assessment takes 5-10 days. The certification timeline after that is set mostly by how quickly the remaining gaps are closed and evidenced.
Each of the three options is quoted as a fixed price after a short scoping call. What moves the price is the size of the team in scope, how many client engagements the ISMS has to cover and how much already operates with evidence behind it. Certification body audit fees are separate and paid to the certification body directly.
No. Certification is issued by an accredited certification body after Stage 1 and Stage 2 audits. We are an independent advisory practice: we get you ready, run your internal audit and keep the system working. Our auditors hold ISO/IEC 27001 Lead Auditor certification, so readiness is judged the way the certification body will judge it.
Tell us who is asking - a client, a tender, a regulator behind a client - and what you have today. We will tell you honestly what stands between you and a certificate.