Security

A supplier's ISO 27001 certification: what to check before you trust them with your data

By Codevista InnovationsPublished 12 October 20268 min read

An ISO/IEC 27001 certificate proves that a supplier has put in place an information security management system (ISMS), audited by an independent certification body, within a defined scope. It does not prove that all of its activities are covered, nor that your data will be processed in line with Morocco's data protection law, law 09-08. Before you sign, check the scope, the validity, the issuing body and the Statement of Applicability, then question the supplier about how your data will be handled.

What is ISO/IEC 27001:2022?

ISO/IEC 27001 is the international standard that defines the requirements for an information security management system (ISMS). It does not prescribe any particular tool; it prescribes an approach. The organisation assesses the risks to the confidentiality, integrity and availability of its information, chooses controls to treat them, then audits and improves the system over time.

The current version dates from 2022. Clauses 4 to 10 set out the requirements for the system (context, leadership, planning, support, operation, performance evaluation, improvement), and Annex A lists 93 security controls, grouped into four themes:

• organisational controls: policies, access control, supplier relationships, incident management, continuity;
• people controls: screening, awareness, confidentiality agreements, remote working;
• physical controls: access to premises, protection of equipment;
• technological controls: authentication, access restriction, encryption, logging, backups, secure development.

The transition period from the 2013 version is over: any accredited certificate that is still valid refers to the 2022 version. If you are shown an "ISO 27001:2013" certificate, ask where its transition stands. The official summary of the standard is available on the ISO website.

What does an ISO 27001 certificate prove, and what does it not?

The certificate attests that an independent auditor found, on a given date, that the ISMS meets the requirements of the standard. Four elements determine what it is worth.

The scope is everything

Every certificate states a scope: the activities, sites and sometimes systems it covers. A company may be certified for its hosting but not for its software development. If the activity you are buying does not appear in the scope, the certificate gives you no assurance about it whatsoever.

The certification body

The certificate is issued by a certification body, which should itself be accredited for ISO/IEC 27001 by an accreditation body that is a signatory to the IAF (International Accreditation Forum) recognition arrangements. In Morocco as elsewhere, it is this accreditation that counts, not the body's nationality. A document issued by a non-accredited organisation is worth far less, however official it may look.

Validity and surveillance audits

A certificate has an issue date and an expiry date. In between, the certification body carries out surveillance audits, at least once a year, followed by a recertification audit before expiry. The certificate can be suspended or withdrawn if nonconformities are not corrected: a logo on a website tells you nothing about its current status.

The Statement of Applicability

The Statement of Applicability (SoA) goes through the 93 Annex A controls, states which ones have been selected and implemented, and justifies every exclusion. It is the document that shows what the supplier actually does; it is often confidential, but can be shared under a non-disclosure agreement.

Finally, ISO 27001 does not certify a product, a delivered piece of software, the absence of vulnerabilities or compliance with any law. The standard requires the supplier to identify its legal and contractual obligations; it does not attest that the supplier meets them, still less that you meet yours.

How do you verify a supplier's ISO 27001 certificate?

Five checks, none of which require technical expertise:

1. Ask for a copy of the certificate and note its number, the version of the standard (2022) and the issue and expiry dates.
2. Read the scope word for word and compare it with the service you are buying: development, hosting, support, training.
3. Identify the certification body, check its accreditation, then confirm the certificate's validity with that body, through its online register or in writing.
4. Ask for the date of the last surveillance audit and whether any major nonconformities are still being addressed.
5. Ask to see the Statement of Applicability, at least for the controls that affect your data: access control, encryption, suppliers, secure development.

These points complement the checklist in our article on choosing a software development company in Casablanca.

What questions should you ask a software or AI supplier?

The certificate opens the conversation; it does not close it.

For a software development project

• Who will have access to your production data, including at subcontractors, and how is that access revoked?
• Do the development and test environments use real, anonymised or synthetic data?
• Where are the code and the data hosted, and in which countries?
• How, and how quickly, will you be informed of a security incident?
• What happens to your data and your access rights when the contract ends?

For an artificial intelligence project

• Which model or API providers are used, and is your data sent to them?
• Is your data used to train or improve a model, either by the supplier or by a third party?
• Are prompts and responses logged, and how long are they kept?
• Does your data, or do your prompts, leave Morocco? Any transfer abroad is subject to the conditions of law 09-08, under the supervision of the CNDP.

See also the points to watch in our article on generative AI for businesses in Morocco. For a SaaS product, add data isolation between customers to the list (see our guide to custom SaaS development).

ISO 27001, law 09-08 and the CNDP: how do they fit together?

In Morocco, the processing of personal data is governed by law 09-08 (loi 09-08), under the supervision of the CNDP (Commission nationale de contrôle de la protection des données à caractère personnel, the national data protection authority). Among other things, the law requires prior formalities with the CNDP, appropriate security measures and safeguards for transfers of data abroad.

ISO 27001 and law 09-08 are complementary, not interchangeable:

• the law sets out what you must comply with as the data controller, and what your processor must guarantee;
• ISO 27001 provides a method for managing the security measures that make it possible to honour those commitments;
• a certificate replaces neither the formalities with the CNDP nor the data processing agreement.

A certified supplier makes it easier for you to demonstrate compliance, but responsibility for the processing remains yours. For formalities and up-to-date legislation, see the CNDP website.

ISO 9001 vs ISO 27001: what is the difference for a client?

ISO 9001 certifies a quality management system: controlled, customer-focused processes and continual improvement. ISO 27001 certifies an information security management system: structured management of risks to information. For a software or AI project that handles your data, ISO 9001 tells you how the work is carried out, and ISO 27001 tells you how your information is protected. An ISO 9001 certificate on its own therefore says nothing about the confidentiality of your data; together, the two cover both how a supplier delivers and how it protects.

How do you build data security into your requirements specification?

The right time to set these requirements is before you go out to tender, not when you are about to sign. Write your security expectations into your requirements specification: the certification expected and its scope, where hosting is located, access management, incident notification, reversibility. Then ask for point-by-point answers, backed by evidence, rather than a ticked "ISO 27001 certified" box.

Codevista Innovations is certified to ISO 27001:2022 (certificate CTX-2026-540336, valid until 31 December 2029) and DIN EN ISO 9001:2015 (certificate CTX-2026-488547, valid until 19 June 2028). To review these certificates and their scope before a software or AI project, contact our team in Casablanca.

Frequently asked questions

Is an ISO 27001-certified supplier automatically compliant with law 09-08?

No. ISO 27001 requires the supplier to identify the applicable legal obligations and to manage security risks, but it does not complete the formalities with the CNDP on your behalf, nor does it replace a data processing agreement. Compliance with law 09-08 is assessed separately and remains the responsibility of the data controller.

How many security controls are there in Annex A of ISO 27001:2022?

Annex A of the 2022 version contains 93 controls, divided into four themes: organisational, people, physical and technological. A certified company is not required to apply all of them: it selects those that treat its risks and justifies each exclusion in its Statement of Applicability, which the auditor reviews.

How can you tell whether a supplier's ISO 27001 certificate is still valid?

Note the certificate number, its issue and expiry dates and the name of the certification body, then verify it directly with that body. Also ask for the date of the last surveillance audit: a certificate can be suspended or withdrawn before it expires if the nonconformities found are not corrected.

Should you require ISO 27001 for an artificial intelligence project?

It is a relevant criterion as soon as the project handles sensitive or personal data, because it shows that the supplier manages its security risks in a structured way. Also ask which model providers are used, whether your data is used for training, where it is hosted and how long exchanges are retained.