We hire some developing company to build software for us and we agree with them that they follow the ( International Standard ISO/IEC 27001 and 27018 ) I would like to ask how can I be sure that they follow the standard and apply all the security roll? Is there any software can help me with this? or is there any certificate that I should look for before we hire someone to do this task? or is there any recommendation company can do this task

Best Salem

1 Answer 1


Meeting standards such as ISO 27001 and 27018 are usually confirmed by performing audits. The organizing providing the product or service would need to be audited, and there are companies that can be hired to perform an audit and confirm compliance. The results of these audits are generally provided to customers and partners as proof of compliance. If the company you are hiring to provide the product or service has been audited, they should be able to provide you with the information (or, if the audit was very recently, when to expect the audit results).

Depending on your relationship and agreements with the organization providing the product and service, you may also be able to perform audits. In some industries, there are quality organizations who have staff who are familiar with various applicable standards and how to conduct audits. If the developing organization does not have the appropriate certifications or audit results, performing an audit may be necessary to give you confidence that they are capable of performing the work to the necessary standards.

Usually, this type of work is done before an organization is hired or contracted to perform work. As part of a vendor selection and management process, any required certifications and capabilities would be identified and it is up to the vendors to provide information of holding those certifications or having the capabilities necessary.

  • Hi Thomas thank you for your comments
    – Salim
    Nov 7, 2019 at 6:57
  • Same what we did in our company as you said "this type of work is done before an organization is hired or contracted to perform work. " We put this in contract (of the consultant which we hired for a project several months) and made sure that the consultant complies with our needs regarding ISO27001 Nov 11, 2019 at 10:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.