An ISO/IEC 27001 management system for EMIs and fintech companies
An ISO 27001 consultant for EMI and fintech companies builds the information security management system that a certification body will later audit: scope, risk assessment, Statement of Applicability, policies, records and an internal audit. We do that work with your team, tie it to what your regulator and banking partners ask for, and hand over a system ready for an accredited certification body.
ISO/IEC 27001 certification is voluntary. Fintechs pursue it because banks, partners and regulators ask how security is managed, and a certificate gives independent confirmation.
ISO states that each company decides whether to seek certification, and that the certificate comes from an accredited conformity assessment body whose competence an accreditation body has independently confirmed.
Where it meets your licence
DORA allows EU financial entities to contract only with ICT providers that comply with appropriate information security standards (Art. 28(5)). A payment institution's application under PSD2 includes a security policy document with a risk assessment and control measures (Art. 5(1)(j)). An ISO/IEC 27001 ISMS gives one base for both documents and for bank questionnaires.
ISMS implementation in a fintech: what we build
We build a working ISMS: scope, risk assessment and treatment, Statement of Applicability, policies, records that show controls operate, internal audit and management review. Every document is written for your real systems and processes.
Scope. Which entities, products, cloud environments and offices are inside. For a group with an EMI and a technology company this first decision shapes everything else.
Risk. An asset and risk register, assessment, and a treatment plan with owners.
Statement of Applicability. Each Annex A control with a decision on applicability, the justification and a pointer to evidence.
Policies and procedures. Only the ones your chosen controls require, written the way you actually work.
Records. Access logs, backup checks, training, incident reviews: the trail that shows controls operate.
Internal audit and management review. We run the internal audit against the standard and prepare the review material.
A person checks every finding, and all documents belong to you.
Statement of Applicability for a fintech: Annex A in the 2022 edition
Annex A of ISO/IEC 27001:2022 holds 93 controls in four themes, 11 of them new compared with the previous edition. The Statement of Applicability records, for each control, whether it applies, why, and where the evidence is.
UKAS notes that in the 2022 edition 24 controls were merged and 58 updated. Certification bodies had to finish moving clients to the new edition by 31 October 2025, and the transition audits looked at updates to the Statement of Applicability and the risk treatment plan (IAF MD 26). Certification today runs against ISO/IEC 27001:2022 with Amendment 1:2024 on climate action.
Typical fintech decisions
For a fully cloud-based EMI, physical security controls are often met through the provider, which has to be justified with the contract and the provider's reports. Secure development controls apply whenever you build the product in-house. An exclusion with no justification becomes a nonconformity in the auditor's report.
The ISO 27001 stage 1 and stage 2 audit
The initial certification audit runs in two stages, followed by a three-year cycle with yearly surveillance audits and a recertification. An accredited certification body runs the audit and decides on the certificate.
IAF MD 5:2023 calculates initial audit time as Stage 1 plus Stage 2 and states that, during the first three-year cycle, surveillance takes about a third of the initial audit time each year.
We prepare you for both stages: internal audit, closing nonconformities, collecting evidence and walking the control owners through the auditor's questions. If a bank needs answers first, a verified ISMS base covers most of its security questionnaire straight away.
ISO 27001 and DORA: one control base
ISO/IEC 27001 covers most of the protection and governance measures DORA expects, and DORA adds its own: incident reporting measured in hours, a register of ICT contracts and a yearly framework review with a report for the authority. We build the ISMS so both rest on the same documents.
Under DORA the ICT risk management framework is documented and reviewed at least once a year (Art. 6(5)), and the register of information on ICT contracts goes to the authority in full on request (Art. 28(3)). We add those elements to the ISMS and produce a mapping from ISO controls to DORA requirements. The licence side sits with our licensing practice; the steps are laid out in the guide on ISO 27001 readiness for a fintech.
Facts about the standard and certification
Requirement
What it means
Source
ISO/IEC 27001:2022, edition 3, October 2022, Amendment 1:2024
Certification runs against the 2022 edition with its amendment
A scope decision, an asset and risk register and a treatment plan
A Statement of Applicability for the 93 Annex A controls with justifications and evidence pointers
Policies and procedures written for your real processes, and records that show controls operate
An internal audit report, management review material and a list of what remains before the certification audit
What we need from you
A management decision on the goal: certification, a bank's questionnaire or the licence ICT section
An ISMS owner on your side and time from your IT team or contractor
A list of systems, cloud services and suppliers
A signed scope letter
Boundaries
An accredited certification body issues the certificate; we prepare you for its audit
The certification body decides on certification and nonconformities, and you choose and contract it
We hold no ISO/IEC 27001 certificate ourselves and cannot issue one
A legal opinion on DORA or other laws comes from a lawyer
Risks of ISO 27001 preparation alone, with a chatbot or a freelancer
On your own
The team writes forty policies and postpones the records. At Stage 2 the auditor asks for months of logs and minutes, and they are missing.
Chatbot
It generates a Statement of Applicability with controls you do not run and exclusions with no justification. The auditor checks the SoA against practice line by line.
Freelancer
Sells a template set built for someone else's scope. The documents contradict your cloud architecture, and the board signs what it does not understand.
Frequently asked questions
It depends on the scope, the number of systems and how many controls already run with records. At Stage 2 the auditor needs evidence that controls operated over a period, so records should start as early as possible. We give a realistic timeline to the certification audit after a paid 30-minute consultation and a short review of where you stand today.
An accredited certification body that you choose; an accreditation body confirms its competence. A consultant prepares the system, runs the internal audit and closes nonconformities, and only the certification body issues the certificate. When choosing a body, check that its accreditation is recognised where your banks and regulators operate.
An ISMS document that states, for each of the 93 Annex A controls of ISO/IEC 27001:2022, whether the control applies, why, and where the evidence is. The auditor reads it first and checks it against practice. For a fintech the key is to justify exclusions honestly, such as physical controls in a fully cloud-based company, and to tie every control to a record or a setting.
DORA and PSD2 name no certificate as a separate licence condition. A payment institution's application includes a security policy document, and DORA requires financial entities to use providers that comply with appropriate information security standards. An ISO/IEC 27001 ISMS gives a common base for both, and a certificate often speeds up conversations with banks.
The price depends on the scope, the number of entities, systems and suppliers, whether policies and records exist, and whether you need help fixing settings. After a paid 30-minute consultation we fix the scope and the price in a scope letter. The price is fixed. The certification audit itself is priced separately by the certification body you choose.
It covers most protection and governance measures. DORA adds incident classification and reporting measured in hours, a register of information on ICT contracts, mandatory contract terms and a yearly framework review with a report for the authority. We build these into the ISMS and prepare a mapping so one set of documents serves both frameworks.
