Why public sector suppliers certify
Public bodies buy through structured procurement, and ISO 27001 has become a standard qualifying requirement in tenders and framework agreements for anything involving data or systems. Prime contractors flow the same requirement down to their supply chains. Without an accredited certificate whose scope matches the work, bids are routinely excluded before they are evaluated.
What the audit focuses on
Public sector work often involves information with defined handling requirements, staff who need to be vetted, and sites that must meet physical security expectations. The audit examines:
- Requirements identification. Whether the ISMS captures the security clauses in contracts and frameworks and turns them into controls.
- Classification and handling. How official or sensitive information is marked, stored, transmitted, and destroyed, and whether staff know the rules.
- People. Screening at the level required by contracts, confidentiality terms, and awareness training that covers the specific obligations.
- Physical security. Secure areas, visitor control, clear desk, and equipment disposal at the sites where government information is handled.
- Supply chain. How security requirements are passed to subcontractors and how their compliance is checked.
- Reporting. Incident reporting to contracting authorities within required timelines.
Systems operated for US federal agencies
Where you operate a system for a US federal agency, the agency will usually require its NIST SP 800-53 controls to be assessed under the Risk Management Framework before the system is authorized, and reassessed while it runs. We perform those assessments as a separate engagement. See NIST SP 800-53 control assessments and RMF continuous monitoring assessments.
Controlled unclassified information
Contracts that involve controlled unclassified information, including Department of Defense contracts under DFARS 252.204-7012, require your systems to meet NIST SP 800-171. We assess those requirements independently. See NIST SP 800-171 assessments.
Scope statements that work in procurement
Evaluators compare the scope on your certificate with the services in the tender. At application we check the scope statement with you so that it accurately describes the services, sites, and functions covered, and holds up in bid evaluation without overstating what was audited. Writing it is your consultants’ job; agreeing that it is auditable is ours.
Timing
Tender deadlines are not negotiable, so we plan backwards from them. If your ISMS is ready, we can usually complete Stage 1 and Stage 2 within eight to ten weeks. If you have a bid in progress, tell us at the first conversation and we will prioritize dates accordingly.