There is, generally, no direct legal requirement as such. Organisations choose whether or not to implement the requirements of ISO 27001 based upon the benefits that would be gained by doing so.
However, you should pay close attention to any contractual obligations you may have for protecting the information of clients and other stakeholders.
There is an increasing trend where customers require third party suppliers to implement or certify to ISO 27001, thus making it a legal requirement, by way of a contract.
This was a good webinar, thank you. Having it as a webinar rather than face to face worked really well and much more convenient with the new standards for travel and cost being put in place etc. The information was useful and well paced. Would be great to get a copy of the slide deck sent out as well. I missed the first minute or so but it would of been good to see an image of who was presenting as well. And you answered my question as well. Thanks
Thinking about ISO 27001 but unsure how your project should take shape?
We offer a free, no‑commitment call to help you clarify your certification pathway, understand the standard in the context of your business.
Find out more
related BLog
ISO 27001 Clause 7.5: Documented Information Explained
Published on
27 Apr
2026
URM’s blog breaks down ISO 27001 Clause 7.5 requirements, with practical guidance on how to achieve conformance to this Clause & what external assessors expect.
Read more
Information Security
Published on
15/4/2026
ISO 27001 – Clause 6.3: The Importance of Planned ISMS Change ManagementURM’s blog explains the purpose & requirements of ISO 27001 Clause 6.3, types of ISMS change it covers, and key considerations when putting it into practice.
Read more
Information Security
Published on
2/4/2026
Transitioning to ISO 27001:2022If your organisation is looking to transition to ISO 27001:2022, URM’s blog provides practical and invaluable guidance on meeting the new requirements.
Read more
Information Security
Published on
2/4/2026
What is the CIA Security Triad? Confidentiality, Integrity and Availability ExplainedURM’s blog explains how the principles of confidentiality, integrity and availability (CIA) can help align your information security controls with best practice
Read more
"
Our experience with the QSA team has been fantastic over the last 3 years. Our QSA has enabled us to refine the PCI audit process, whilst also improving our security posture. His guidance also made the transition process from version 3.2.1 to 4.0 extremely smooth.
contact US
Let us help you
Let us help you in your compliance journey by completing the form and letting us know how we can best support you.