Home / Voluntary standard
Voluntary standard
ISO 27001 mapping
ISO 27001 can help with mapping, but a certification alone does not satisfy every client commitment.
Effect of this requirement
This rule cannot be read in isolation.
- Transfers
- Bilateral relationship
- Country sources reviewed on
Assumptions, limitations and sources of this reading
Reading point
The certificate is one piece of evidence, not the whole file
Its scope and its limits remain visible against the client's exact requirement.
- Link client requirements to relevant controls
- Keep to the exact scope of the certificate
- Identify technical exceptions
- Do not turn a mapping into an attestation
Correspondence matrix
Use ISO 27001 as a framework without conflating control, certificate and client commitment.
Client requirement
The clause and its scope remain the reference point.
Relevant ISO control
Correspondence helps organise the search, not conclude it on its own.
Certified scope
Entities, sites, services and exclusions on the certificate are checked.
Additional evidence
Client-specific elements fill in what the certificate does not demonstrate.
Decision path
Using ISO 27001 without over-promising
The mapping organises the search for supporting evidence; it does not turn a neighbouring control or a limited certificate into a universal answer for the client.
01Client's phrase
Keep the requirement in its exact wording, its contractual context and the service scope to which it applies.
02Substantiated correspondence
Explain why a management system audit contributes to the response and which operational elements still need to be examined.
03Certificate scope
Verify entities, sites, activities, exclusions, standard version and validity before citing the certification.
04Additional evidence
Add configurations, samples, logs or decisions specific to the service where the certificate does not demonstrate the expected claim.
Using the standard with precision
What the mapping delivers, what still needs to be established, and the shortcuts to avoid.
Questions to address
- “Are you ISO 27001 certified?” — and if not, why
- The exact scope of the certificate, where one exists
- The correspondence between their requirements and your controls
- What the certification does not cover for you
Elements that support the response
- Certificate and statement of applicability up to date
- Scope set out in black and white (entities, sites, services)
- Client requirement-to-control mapping table
- Evidence that key controls are actually performed, not just described
Confusions to avoid
- Present the certificate as a universal answer to the questionnaire
- Giving the impression that the scope covers services it excludes
- Getting certified for a market that actually required operational evidence
- Overlooking that some clients require both: certificate and evidence
Assurance file, AU-041Demonstration example
Announced scopeDeparture management and privileged accountsFinding
Declared procedureDeactivation within 24 hours, validated by securityFinding
Repeat interview"We send the admin an email when we think of it"Finding
Divergence observedPractice contradicts the procedure that will be shownGap
ImpactFinding almost certain on the day of the auditGap
ActionRestore the HR→IT flow and brief interviewees on the actual situationDecision
Reading the coloursFactual observationGap or riskDecision or action
Demonstration
Use the certificate without having it demonstrate more than its scope.
The case starts from the client's statement, checks the match to the control and adds evidence specific to the service where the certificate remains too general.
Understanding how evidence is qualified →Apply this reading
Reconcile the certified scope with the client's exact requirement.
The client's exact request and the certificate with its scope make it possible to identify what is already supported and the additional evidence to gather.