ISO/IEC 27001: Protecting Your Company’s Data

A security breach can cost millions—not only in direct losses, but also in lost trust, regulatory fines, and business interruption. ISO/IEC 27001 certification is the internationally recognized way for an organization to demonstrate that it manages its information security systematically, rather than in a fragmented manner.

In this article, we will look at what the standard is, the principles on which it is based, what it requires from your organization, and why more and more Bulgarian companies—especially in IT, finance, and services—are choosing to become certified.

What is ISO/IEC 27001?

ISO/IEC 27001 is the international standard for Information Security Management Systems (ISMS). It specifies the requirements for establishing, implementing, maintaining, and continually improving a system that protects an organization’s information assets.

The key word here is “system.” ISO/IEC 27001 is not a list of technical measures or software that you install. It is a management framework—a set of processes, policies, and controls through which an organization systematically identifies risks to its information and manages them.

The standard is applicable to any organization, regardless of its size or sector—from IT companies and financial institutions to manufacturing enterprises, healthcare organizations, and public administration. Wherever sensitive information is processed, ISO/IEC 27001 has value.

The Three Pillars of Information Security: The CIA Triad

At the core of ISO/IEC 27001 is the concept of three fundamental properties of information, known as the CIA Triad:

Confidentiality – Information is accessible only to authorized persons. Customer data, trade secrets, and personal data do not fall into the wrong hands.
Integrity – Information is accurate and complete; it has not been modified or corrupted without authorization. The data you rely on is trustworthy.
Availability – Authorized users have access to information when they need it. Systems are operational rather than being blocked by incidents or attacks.

Every security measure under ISO/IEC 27001 ultimately serves one or more of these three principles. If you understand the CIA Triad, you understand the logic of the entire standard.

How ISO/IEC 27001 Works: The Risk-Based Approach

The core of ISO/IEC 27001 is risk management. Instead of applying a universal list of measures to everyone, the standard requires every organization to:

identify its information assets—what data, systems, and processes it possesses;
assess the risks—what threats and vulnerabilities exist for those assets;
determine how to treat the risks—to reduce, accept, transfer, or avoid them;
implement appropriate controls—specific measures to reduce priority risks;
monitor and improve—continually review and improve the system.

This approach means that the security system of a small software company will look different from that of a bank—and that is exactly the intention. The controls are proportionate to the actual risks.

An important document in this process is the Statement of Applicability (SoA). It describes which controls from Annex A the organization applies and why, and which it excludes and on what grounds.

Annex A: The Catalogue of Controls

ISO/IEC 27001 includes Annex A. In the current version, ISO/IEC 27001:2022, there are 93 controls, grouped into four themes:

Organizational controls – policies, roles and responsibilities, asset management, supplier relationships.
People controls – pre-employment screening, security awareness training, disciplinary processes, responsibilities following termination of employment.
Physical controls – physical security perimeters, access control to premises, protection of equipment.
Technological controls – access management, encryption, protection against malware, backup, network monitoring.

The organization is not required to implement all 93 controls—it selects those that are relevant based on the risk assessment and justifies its selection in the Statement of Applicability.

ISO/IEC 27001 and the Regulatory Framework

ISO/IEC 27001 is a voluntary standard, but it does not exist in a vacuum. More and more legal and regulatory requirements in Bulgaria and the European Union require organizations to manage information security systematically, and an implemented ISMS provides the practical framework through which these requirements are fulfilled and demonstrated. Below are the three most important areas where they intersect.

GDPR: Protection of Personal Data

The General Data Protection Regulation (GDPR) establishes obligations for the protection of personal data and provides for significant penalties in the event of violations.

ISO/IEC 27001 does not automatically make you GDPR compliant, but it significantly facilitates achieving and demonstrating such compliance.

An implemented ISMS demonstrates to regulators and customers that data protection is managed responsibly and systematically through risk assessment, access controls, and incident response procedures, which are fundamental to both frameworks.

Cybersecurity Act (NIS2)

The Bulgarian Cybersecurity Act transposes Directive (EU) 2022/2555 (NIS2) into national legislation. This is the most significant cybersecurity reform in the European Union to date.

The scope of the legislation has been expanded and introduces stricter requirements for risk management, shorter incident reporting deadlines, and significantly higher penalties.

For organizations falling within the scope of the legislation, ISO/IEC 27001 is a natural starting point. The requirements for risk management, security controls, and incident response procedures under NIS2 largely overlap with the logic of the standard.

An implemented ISMS does not fulfil all legal obligations under the Act, but it provides a solid foundation for compliance.

DORA: Digital Operational Resilience for the Financial Sector

The Digital Operational Resilience Act (DORA, Regulation (EU) 2022/2554) establishes a unified framework for managing information and communication technology (ICT) risk in the European Union’s financial sector—including banks, insurance companies, investment firms, payment institutions, and their ICT service providers.

DORA is based on five pillars: ICT risk management, incident reporting, operational resilience testing, third-party risk management, and information sharing on cyber threats.

Its requirements are more stringent and more specific than those of a general management system standard, but an organization with an implemented ISO/IEC 27001 system already has a significant portion of the required processes in place: risk assessment, supplier controls, incident response procedures, and continual improvement.

ISO/IEC 27001 does not fully cover DORA, but it significantly shortens the path to compliance.

Why Become Certified to ISO/IEC 27001?

ISO/IEC 27001 is voluntary, but it is the practical bridge to complying with a whole series of mandatory regulations.

A well-designed ISMS supports GDPR, NIS2, and DORA simultaneously, rather than requiring you to manage each requirement separately.

What Does the Certification Process Look Like?

Certification to ISO/IEC 27001 by an accredited certification body such as Smart Certification follows these stages:

Preparation – The organization implements an ISMS, including an information security policy, risk assessment and risk treatment, and a Statement of Applicability.
Certification Audit – The certification body reviews the documentation and assesses the organization’s readiness (Stage 1), and then verifies how the system operates in practice (Stage 2).
Certificate Issuance – Following a successful audit, a certificate valid for three years is issued.
Surveillance Audits – Conducted annually.
Recertification – Conducted after three years.

A prerequisite for certification is the existence of an implemented and functioning ISMS, including an information security policy, a risk management procedure, and a Statement of Applicability.

For more information, see our Certification Process.

Frequently Asked Questions (FAQ)

Who needs ISO/IEC 27001? Any organization that processes sensitive information—including IT companies, financial institutions, cloud service providers, healthcare organizations, as well as manufacturing and commercial companies with valuable data or customer security requirements.

Is it mandatory to implement all Annex A controls? No. The organization selects the applicable controls based on its risk assessment and justifies those selections in the Statement of Applicability (SoA).

How long does certification take? Depending on the size and complexity of the organization, typically from several months to around one year.

Is a consultant required? Not necessarily. Many organizations prepare independently or using internal resources. The certification body cannot provide consultancy and certification services at the same time—this is a requirement for impartiality.

Next Step

Protecting information is no longer merely a technical detail—it is a business priority and increasingly a contractual requirement.

If you would like to understand how ISO/IEC 27001 applies specifically to your organization, explore our ISO/IEC 27001 certification services or contact us for a consultation.

Smart Certification is an accredited certification body for ISO 9001, ISO 14001, ISO 45001, and ISO/IEC 27001.