Why do SaaS companies need ISO 27001?
For a B2B software company, security is part of the product. Procurement teams at larger customers send security questionnaires with dozens or hundreds of questions, and many of them accept an ISO/IEC 27001 certificate as a shortcut. A certificate issued by an accredited body shows that your information security management system (ISMS) has been independently audited against 93 Annex A controls.
Without it, every deal repeats the same work: answering questionnaires, sharing policies and joining security calls. With it, you can reference the certificate and your Statement of Applicability and move on.
Does NIS2 apply to SaaS companies?
It can. NIS2 Annex I lists digital infrastructure — including cloud computing service providers and data centre service providers — and ICT service management, which covers business-to-business managed service providers and managed security service providers. Medium and large providers in these categories (50+ employees or more than €10 million turnover) are generally in scope. A SaaS product that is not a cloud computing service in the NIS2 sense may be outside scope, but your customers who are in scope will still push NIS2 supply-chain requirements (Article 21(2)(d)) down to you.
Check the definitions in your country's transposition law and the guidance of your national authority, such as the Centre for Cybersecurity Belgium.
What does a typical SaaS ISMS cover?
- Cloud infrastructure security: identity and access management, logging, backups and configuration management (Annex A 5.23, 8.9, 8.13, 8.15).
- Secure development: secure coding, code review, testing and change management (8.25–8.32).
- Vendor management for sub-processors such as hosting, email and payment providers (5.19–5.22).
- Access control and multi-factor authentication for staff (5.15–5.18, 8.5).
- Incident management and customer notification (5.24–5.28).
- Business continuity and disaster recovery for the production platform (5.29, 5.30).
How does ComplyPilot help SaaS teams?
ComplyPilot (EU compliance platform) is designed for the people who actually do compliance in a scale-up: a founder, a CTO or one security lead. The 93 Annex A controls are ready to use, ISO 27001 policy templates cover the main themes, and each control shows the evidence it still needs. A risk register links risks such as "loss of production database" to the backup, monitoring and restore-test controls that treat them.
Because NIS2 and DORA are overlays on the same control set, you can answer customer questions about NIS2 supply-chain security or DORA third-party requirements from the same evidence. Semantic search across risks, controls and evidence makes it quick to find the right proof during a questionnaire.
What does the path to certification look like?
| Step | What happens | Output in ComplyPilot |
|---|---|---|
| 1. Scope | Decide which product, teams and locations the ISMS covers | Organisation profile and scope |
| 2. Risk assessment | Identify and rate information security risks | Risk register |
| 3. Control selection | Choose and justify Annex A controls | Statement of Applicability |
| 4. Implement and document | Write policies, configure tooling, collect records | Policies and linked evidence |
| 5. Internal audit and management review | Check the ISMS works before the external audit | Tasks and audit records |
| 6. Certification audit | Stage 1 and Stage 2 by an accredited body | Exports for the auditor |
Frequently asked questions
Is ISO 27001 or SOC 2 better for a European SaaS company?
In Europe, ISO 27001 is the more widely recognised standard and is often referenced in public tenders. SOC 2 is common in the United States. Many companies start with ISO 27001 when their customers are mainly European.
Can we get ISO 27001 without a full-time security person?
Yes, many small SaaS companies do, provided someone owns the ISMS and management supports it. ComplyPilot reduces the documentation and evidence workload for that owner.
Do sub-processors have to be ISO 27001 certified?
No, but you must manage supplier risk (Annex A 5.19–5.22). Certified providers make that easier because you can rely on their certificate as evidence.