There is, generally, no direct legal requirement as such. Organisations choose whether or not to implement the requirements of ISO 27001 based upon the benefits that would be gained by doing so.
However, you should pay close attention to any contractual obligations you may have for protecting the information of clients and other stakeholders.
There is an increasing trend where customers require third party suppliers to implement or certify to ISO 27001, thus making it a legal requirement, by way of a contract.
We have just received the CE+ certificate and notification that we have passed; we wanted to thank our assessor for all his help with this. It is greatly appreciated. I know that our team is very grateful as they were expecting the process to be difficult. Instead of being difficult, URM’s assessor made it a smooth process and we have all learned a lot
Contact centre software provider
Thinking about ISO 27001 but unsure how your project should take shape?
We offer a free, no‑commitment call to help you clarify your certification pathway, understand the standard in the context of your business.
Find out more
related BLog
How do You Identify and Then Manage Your ISMS Scope?
Published on
28 Aug
2026
When managing the security of your organisation’s information assets, you will need to consider the scope of what you are doing.
Read more
Information Security
Published on
14/8/2026
ISO 27001 Clause 9.1: Monitoring, Measurement, Analysis and Evaluation ExplainedURM’s blog explores ISO 27001 Clause 9.1, what it requires and practical guidance on how to implement this Clause in full conformance with the Standard.
Read more
Information Security
Published on
7/8/2026
5 Must-Dos of Effective ISO 27001 Risk ManagementURM’s blog explores five key actions organisations can take to strengthen their ISO 27001 information risk management processes.
Read more
Information Security
Published on
7/8/2026
The Fundamentals of Risk Management in ISO 27001URM’s blog explains the risk management requirements in ISO 27001, including identifying ISMS risk, risk assessment and treatment, documentation and more
Read more
"
The consultant’s efforts in ensuring that our PCI compliance is audited correctly is highly appreciated, as it gives the company an accreditation that we can be proud of and that we can show off to existing and prospective customers as proof of our security posture. A huge thank you to URM for providing such a valuable service.
Open Banking Platform
contact US
Let us help you
Let us help you in your compliance journey by completing the form and letting us know how we can best support you.