ISO 27001 Readiness for Fintech: Steps, Documents, Audit

ISO/IEC 27001 readiness for a fintech company means having a working information security management system (ISMS) before the certification body arrives: a defined scope, a risk assessment and treatment plan, a Statement of Applicability against the 93 controls of Annex A in the 2022 edition, the policies those controls need, records that show they run, an internal audit and a management review. The certificate itself comes from an accredited certification body after a two-stage initial audit.

INNOVA prepares fintech companies for that audit: the ISMS document set (policies, risk register, Statement of Applicability), an internal audit, the technical fixes, and a list of what remains before certification. We run our own ISMS built on ISO/IEC 27001:2022. The time to readiness depends on the scope and on how many controls already run with evidence.

Preparing a fintech for ISO/IEC 27001? We write the ISMS documents, run the internal audit and fix what we find. Cybersecurity and ISO/IEC 27001 readiness → · Book a paid 30-minute consultation (USD 99, credited to the project)

Why fintech companies go for ISO/IEC 27001

Banks and partners send security questionnaires. A certificate with a clear scope answers many of their questions in one document.
Regulators expect an ICT risk framework. An EU payment or e-money institution applies DORA, and an ISMS built on ISO/IEC 27001 can cover much of DORA's policy set. The parts DORA adds are in DORA ICT requirements for an EMI licence.
The product runs in the cloud and through providers. The ISMS scope, the risk register and the supplier reviews cover that stack, which is where fintech risk usually sits.

The readiness steps

Step	What you hold at the end
1. Scope and context	ISMS scope: entities, products, locations, systems, interfaces with providers
2. Leadership and policy	Information security policy approved by management, roles and responsibilities
3. Risk assessment	Risk assessment method and a risk register for the scope
4. Risk treatment and SoA	Risk treatment plan and the Statement of Applicability: each Annex A control included or excluded, with the reason
5. Objectives and support	Security objectives, competence and awareness records, documented information
6. Controls in operation	Policies and procedures running, with evidence: access reviews, backups restored, patches applied, supplier checks
7. Internal audit	Internal audit report against the standard and the SoA
8. Management review	Minutes of the management review, decisions and actions
9. Corrections	Nonconformities closed, corrective actions recorded

ISO/IEC 27001 readiness for a fintech: scope, risk assessment, Statement of Applicability, controls in operation, internal audit, management review, stage 1 and stage 2 certification audit — From scope to certificate: what the fintech does and what the certification body checks.

Annex A in the 2022 edition

Annex A of ISO/IEC 27001:2022 is aligned with ISO/IEC 27002:2022: 93 controls organised in four themes, 11 of them new compared with the 2013 edition. The Statement of Applicability lists every control, says whether it applies and why, and points to the evidence. Certification bodies had to complete the transition of certificates issued against the 2013 edition by 31 October 2025.

Where fintech companies usually need the most work

Suppliers and cloud. Each provider that touches customer data or payments needs a security review and contract terms on security and incidents.
Access. Strong authentication for administrators and remote access, joiner and leaver records, and periodic access reviews with evidence.
Secure development. A written secure coding standard, code review, separation of environments and change records for the product.
Logging and monitoring. Logs that cover payments and admin actions, kept long enough and reviewed.
Backups and continuity. A restore that has actually been tested, and a continuity plan for the payment flow.

ISO/IEC 27001 and DORA

For an EU payment or e-money institution, DORA is the law and ISO/IEC 27001 is a voluntary standard. DORA makes no certification mandatory, and its RTS on the ICT risk management framework asks entities to consider leading practices and, where applicable, standards. An ISO/IEC 27001 ISMS can cover much of DORA's asset management, access, cryptography, logging, vulnerability, backup and continuity policies. DORA adds its own register of information on ICT contracts, incident reporting within 4 and 24 hours, yearly tests of the systems that support critical or important functions, and the management body's ultimate responsibility for ICT risk.

The certification audit

An accredited certification body runs the initial certification audit in two stages, Stage 1 and Stage 2. A three-year certification cycle follows, with surveillance audits in the years between and a recertification audit before the certificate expires. INNOVA prepares you for the audit; an independent accredited certification body issues the certificate.

What INNOVA does and what it costs

The ISMS document set: policies, risk register, Statement of Applicability.
Technical work on what we find: MFA switched on, hardening, a tested restore from backup, alerts configured.
Internal audit and a list of what remains before the certification audit.
For an EU payment or e-money institution, the security side of the licence: policies, risk register and technical measures, with the licence application run by our licensing practice.

Every test of your systems starts with a scope letter signed by the system owner, and a person checks every finding before it reaches the report. We re-test after the fixes. The work is a fixed quote once the scope is agreed. We also prepare companies for CyberSecure Canada.

FAQ

What does ISO 27001 readiness mean for a fintech company?

A working ISMS before the audit: a defined scope, a risk assessment and treatment plan, a Statement of Applicability against the 93 Annex A controls, policies and records that show the controls run, an internal audit and a management review.

Do you issue the ISO/IEC 27001 certificate?

No. An independent accredited certification body issues it after its audit. We prepare the company for that audit: the ISMS documents, the risk register, the Statement of Applicability, an internal audit and the technical fixes.

Which edition of ISO/IEC 27001 should a fintech use?

ISO/IEC 27001:2022. The transition of certificates issued against the 2013 edition had to be completed by 31 October 2025, and certification now runs against the 2022 edition with its 93 Annex A controls.

Is ISO/IEC 27001 mandatory for a payment or e-money institution in the EU?

DORA makes no certification mandatory. It sets its own ICT requirements, and an ISO/IEC 27001 ISMS can cover much of them. The register of information, incident reporting deadlines and testing duties are DORA's own.

How long does ISO 27001 readiness take?

It depends on the scope and on how many controls already run with evidence. The certification body then schedules Stage 1 and Stage 2 of its audit.

What evidence should a fintech have ready for the certification audit?

Records that show the controls in the Statement of Applicability run: access reviews, tested backups, patch and vulnerability records, supplier reviews, logs, incident records, the internal audit report and the management review minutes.

Next steps

Tell us what your bank, partner or regulator asked for, and where your product and data run. We reply in writing within 24 hours; the exact quote follows once the scope is agreed. Cybersecurity and ISO/IEC 27001 readiness → · Contact us

Sources (checked 21 October 2026):

UKAS, Transition arrangements for ISO/IEC 27001:2022 (93 controls, 11 new, 4 themes; transitions completed by 31 October 2025): ukas.com
NSAI, ISO/IEC 27001:2022 transition policy: nsai.ie
IAF MD 5:2023, audit time for initial (Stage 1 plus Stage 2), surveillance and recertification audits: iaf.nu
Regulation (EU) 2022/2554 (DORA) and Commission Delegated Regulation (EU) 2024/1774: eur-lex.europa.eu

For information only. The certification body decides on the certificate under its accreditation rules.

This material is for general information only and does not constitute legal or tax advice. Accurate as of the publication date.