Glossary
ISO/IEC 27001
The international standard for information security management systems (ISMS), updated in 2022. ISO/IEC 27001 specifies requirements for an ISMS through a documented set of organisational, people, physical, and technological controls. For B2B SaaS vendors selling into EU enterprises, ISO 27001 is the most commonly cited security baseline in RFP responses, alongside SOC 2 Type II.
Full definition
ISO/IEC 27001:2022 is the international standard specifying requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS). The 2022 revision restructured Annex A controls into four themes (organisational, people, physical, technological) and introduced 11 new controls including threat intelligence, ICT readiness for business continuity, data masking, and secure coding. Certification is performed by accredited bodies through a two-stage audit (Stage 1 documentation review, Stage 2 implementation audit) followed by annual surveillance audits and a three-yearly recertification. For B2B SaaS vendors selling into EU enterprises, ISO 27001 is the most commonly cited security baseline in RFP responses, alongside SOC 2 Type II. The control set overlaps substantially with the GDPR Article 32 technical-and-organisational-measures expectation. A whistleblower channel vendor without ISO 27001 (or an equivalent SOC 2 Type II) will be filtered out by procurement at most large EU enterprises.
Related terms
- ISO 37301 The international standard for compliance management systems, published in 2021. ISO 37301 defines requirements for organisations to identify their compliance obligations, manage compliance risk, and maintain a culture that enables compliance. Whistleblowing channels are explicitly listed as a control. Organisations often pursue triple certification across ISO 37001 (anti-bribery), ISO 37002 (whistleblowing), and ISO 37301.
- GDPR Regulation (EU) 2016/679, the General Data Protection Regulation, governs processing of personal data of EU residents. Whistleblowing channels process personal data of the reporter, the person reported on, and third parties named in the report. Key articles: Art. 6 (legal basis), Art. 5 (minimisation), Art. 9 (special categories), Art. 17 (erasure), and Art. 30 (records).