Industries · Technology, SaaS & Data
ISO certification for technology, saas & data
ISO/IEC 27001, 20000-1, 42001 and ISO 22301 certification for software, SaaS, managed service and data businesses in the UK.
- ISO 27001 information security
- ISO/IEC 20000-1 it service
- ISO 22301 business continuity
- ISO/IEC 42001 artificial intelligence
Overview
Certification for software, cloud and data businesses
Technology businesses are regularly asked to demonstrate how they protect information and deliver reliable services. Enterprise customers, public sector buyers and partners commonly ask about ISO/IEC 27001 in security questionnaires and contract negotiations, and certification can reduce the time spent answering repeated questions about controls. For growing businesses, it can also bring structure to security practices that developed informally as the company scaled.
Information security is often only part of the picture. Managed service providers may use ISO/IEC 20000-1 to demonstrate service management, ISO 22301 addresses business continuity, and ISO/IEC 42001 provides a management system for organisations that develop, provide or use artificial intelligence. These standards share a common structure, which makes integrated audits practical. Organisations can start with one standard and add others as customer expectations develop.
Certification sits alongside other UK requirements. Cyber Essentials, run by the National Cyber Security Centre, certifies a set of basic technical controls and is complementary to ISO/IEC 27001. Data protection obligations under UK GDPR remain the responsibility of the organisation, and suppliers handling NHS data may also need to complete the NHS Data Security and Protection Toolkit. Hexa Certifications does not issue Cyber Essentials certificates.
Recommended
- ISO 27001
- ISO/IEC 20000-1
- ISO 22301
Sector challenges
Where certification makes the difference
The pressures organisations in technology, saas & data face most often, and how a certified management system helps answer them.
Customer security assurance
Enterprise and public sector customers expect evidence of information security controls, and ISO/IEC 27001 is widely recognised in procurement and due diligence.
Cloud and supplier dependencies
Reliance on hosting providers, SaaS tools and subcontractors means supplier security must be managed as part of the system.
Data protection
UK GDPR places obligations on controllers and processors. A security management system supports, but does not replace, data protection compliance.
Service availability
Customers rely on service levels and resilience, making service management and business continuity increasingly important.
Responsible use of AI
Organisations developing or deploying AI face questions on risk, transparency and oversight, which ISO/IEC 42001 is designed to address.
Rapid change
Frequent releases, new tools and changing teams require change management and risk assessment that keep pace with the business.
Recommended standards
Standards most requested in technology, saas & data
Choose a standard to see what it covers. Several can be combined into one integrated audit.
Information & Technology
ISO/IEC 27001:2022Information Security Management
ISO/IEC 27001:2022 specifies requirements for an information security management system (ISMS). It requires an organisation to assess information security risks to the confidentiality, integrity and availability of information, select controls to treat them and manage those controls through a continual cycle of monitoring and review. Annex A lists 93 reference controls in four themes: organisational, people, physical and technological. Each organisation compares its chosen controls against Annex A and records the outcome in a Statement of Applicability.
- Answer security questionnaires
- Risk-based security
- Supports data protection duties
- Management oversight
Information & Technology
ISO/IEC 20000-1:2018IT Service Management
ISO/IEC 20000-1:2018 specifies requirements for establishing, implementing, maintaining and continually improving a service management system (SMS). It covers the planning, design, transition, delivery and improvement of services to meet agreed requirements. Clause 8 sets out the operational processes, grouped into service portfolio, relationship and agreement, supply and demand, service design, build and transition, resolution and fulfilment, and service assurance. The 2018 edition follows the Harmonized Structure, which allows integration with ISO/IEC 27001 and ISO 9001.
- Procurement credibility
- Consistent service delivery
- Clear service agreements
- Controlled change
Resilience & Governance
ISO 22301:2019Business Continuity Management
ISO 22301:2019 specifies requirements for a business continuity management system (BCMS). It helps an organisation prepare for, respond to and recover from disruptive incidents when they occur. The core of the standard sits in clause 8, which requires a business impact analysis and risk assessment, business continuity strategies and solutions, documented plans and procedures, an exercise programme and evaluation of business continuity capability. It follows the Harmonized Structure and integrates with other management system standards.
- Evidence for customers
- Clear recovery priorities
- Tested plans
- Understanding dependencies
Information & Technology
ISO/IEC 42001:2023Artificial Intelligence Management
ISO/IEC 42001:2023 is the first international management system standard for artificial intelligence. It specifies requirements for establishing, implementing, maintaining and continually improving an AI management system (AIMS) within an organisation that develops, provides or uses AI systems. It requires AI risk assessment, AI risk treatment and AI system impact assessment, considering effects on individuals, groups and society. Annex A provides reference controls covering areas such as AI policy, resources, impact assessment, the AI system life cycle, data and third-party relationships.
- Evidence of responsible AI governance
- Structured risk and impact assessment
- Clear roles and accountability
- Life cycle controls
Quality
ISO 9001:2026Quality Management
ISO 9001:2026 sets out the requirements for a quality management system. Published in September 2026, it replaces ISO 9001:2015 and keeps the same core approach. It asks an organisation to understand its context and interested parties, plan its processes around risks and opportunities, and show that it consistently provides products and services that meet customer and applicable statutory and regulatory requirements. It is the most widely used management system standard and applies to organisations of any size or sector, from sole manufacturers to national service providers.
- Meet tender and supplier requirements
- Consistent processes
- Fewer errors and complaints
- Risk-based planning
How it works
Your route to certification
- 1
Application and quotation
You tell us your scope, sites, headcount and standards. We calculate audit duration using the accreditation rules and send a fixed quotation for the full three-year cycle.
- 2
Stage 1 audit
Your auditor reviews your documented information, scope, legal and regulatory awareness, internal audit and management review, and confirms you are ready for Stage 2.
- 3
Stage 2 audit
An on-site evaluation of how your management system works in practice. The auditor interviews people, observes activities and samples records against every requirement.
- 4
Certification decision
Any nonconformities are closed with evidence. A qualified reviewer who did not take part in the audit makes the certification decision and your certificate is issued.
- 5
Surveillance and recertification
Surveillance audits take place at least once a year to confirm continued conformity. A recertification audit before the third anniversary renews your certificate.
Certificate verification
Check a Hexa certificate
Need to know whether a supplier's certificate is current? Customers, buyers and other interested parties can ask us to confirm the details held in our records.
We confirm the organisation name, certificate number, ISO standard, certified scope, status, and issue and expiry dates.
FAQs
Technology, SaaS & Data: certification questions
What is the difference between Cyber Essentials and ISO/IEC 27001?
Cyber Essentials is a UK government-backed scheme that certifies a defined set of basic technical controls, such as firewalls, secure configuration and patching. ISO/IEC 27001 certifies an information security management system covering risk assessment, governance and a wide range of controls. They are complementary, and many organisations hold both. Hexa Certifications does not issue Cyber Essentials certificates.
Does ISO/IEC 27001 certification make us GDPR compliant?
No. ISO/IEC 27001 helps you manage information security risks, which supports the security obligations in UK GDPR. However, data protection law also covers lawful processing, transparency, data subject rights and other areas that are outside the scope of the standard. Compliance remains the responsibility of your organisation.
Is ISO/IEC 27001 accepted for the NHS DSPT?
The NHS Data Security and Protection Toolkit is a self-assessment for organisations that access NHS patient data and systems. ISO/IEC 27001 certification can provide useful supporting evidence for some assertions, but it does not replace the requirement to complete the toolkit. Check current DSPT guidance for how certification is treated.
Can our scope cover just our SaaS platform?
Yes. Many technology businesses certify the people, processes and technology that support a particular product or service. The scope must be clearly defined, including interfaces and dependencies with activities outside it, and the certificate will describe exactly what is covered so that customers are not misled.
We use public cloud hosting. Is that a problem?
Not at all. Most technology businesses rely on cloud providers. The standard expects you to understand which security responsibilities sit with you and which sit with the provider, and to manage suppliers accordingly. Auditors will look at how you assess, select and monitor cloud services within your risk assessment.
What is ISO/IEC 42001?
ISO/IEC 42001 is a management system standard for artificial intelligence. It sets requirements for organisations that develop, provide or use AI systems to manage risks and impacts, including transparency, accountability and human oversight. It follows the same structure as other ISO management system standards and can be integrated with ISO/IEC 27001.
When is ISO/IEC 20000-1 useful?
ISO/IEC 20000-1 specifies requirements for a service management system. It suits managed service providers, IT departments and organisations delivering technology services under service level agreements. It covers service planning, delivery, incident and change management and relationships with customers and suppliers.
Can a fully remote company be certified?
Yes. Organisations without a physical office can be certified, and much of the audit can be carried out remotely where appropriate under IAF guidance. Auditors will look at how you secure remote working, devices and collaboration tools, and the audit plan will set out how evidence will be gathered.
Other industries we audit
All industries
Start your certification
Get a fixed, three-year certification quote
Tell us about your organisation and the standards you need. We will confirm audit days, scope and dates in writing, with no obligation.
