ISO/IEC 27001 certification is a recognised benchmark for organisations seeking to structure their information security management. It is based on a risk-based approach, documented policies, appropriate controls and a continuous improvement process.
However, certification alone does not enable continuous monitoring of changes to an organisation's external attack surface. Between two audits, a configuration may change, a subdomain may be created, a certificate may expire, or a known vulnerability may affect an internet-facing service.
This is where cyber ratings provide complementary value. They make it possible to observe certain technical signals related to an organisation's exposure from the outside and to monitor how they evolve over time. They do not replace the information security management system, audits or ISO/IEC 27001 certification. However, they help to provide objective insight into internet-visible risks and support a continuous compliance approach.
ISO/IEC 27001: a structured approach, but not a static one
ISO/IEC 27001 defines the requirements applicable to an information security management system, or ISMS. It aims to help organisations preserve the confidentiality, integrity and availability of their information through structured risk management.
An ISO/IEC 27001 approach involves, among other things:
- defining the scope of the ISMS;
- identifying and assessing risks;
- selecting and implementing security measures;
- documenting policies, procedures and responsibilities;
- monitoring the effectiveness of controls;
- conducting internal audits and management reviews;
- implementing corrective actions and continuous improvement.
Certification confirms that a certification body has assessed the conformity of the ISMS against the requirements of the standard, for a defined scope and at a given point in time. It is therefore an important signal of maturity and trust for customers, partners, investors and insurers.
To understand the requirements, the certification process and the role of an ISMS, read our guide: ISO 27001: everything you need to know about the information security standard.
Certification does not continuously cover every risk signal
ISO/IEC 27001 certification does not guarantee the absence of vulnerabilities, incidents or misconfigurations. It confirms the existence of a management system and controls that are appropriate for the audited scope.
However, the external attack surface is constantly changing. A new test environment, an application deployed by a business team, a misconfigured cloud service or a vulnerability affecting an exposed device can create risk without waiting for the next internal audit or recertification audit.
The objective, therefore, is not to oppose ISO/IEC 27001 certification and cyber ratings, but to understand how they complement one another:
- ISO/IEC 27001 structures security governance, risk management and security processes;
- cyber ratings provide regular visibility into certain technical elements observable from the internet;
- audits and penetration tests provide deeper insight into risks within specific scopes;
- action plans make it possible to address and track identified gaps.
What cyber ratings bring to an ISO/IEC 27001 approach
Cyber ratings assess an organisation's external posture using publicly accessible data. They can cover exposed assets, accessible services, known vulnerabilities, TLS configurations, certificates, email security mechanisms and certain indicators of compromise.
This approach does not provide access to an organisation's internal controls. It therefore does not measure, for example, backup quality, employee awareness, privileged access management or the effectiveness of incident response arrangements.
However, it provides useful complementary information in three areas.
Verifying the organisation's actual exposure
An asset inventory is essential to any risk management approach. Yet maintaining a complete view of internet-facing domains, subdomains, IP addresses, cloud services and applications remains complex.
IT, marketing, sales, HR and business teams may subscribe to new services or launch projects that alter the organisation's external exposure. Certain resources may also remain in place after a project ends or a service provider leaves.
Cyber ratings help map assets visible from the internet and identify certain gaps between the theoretical inventory and the reality of the exposed surface. This visibility helps inform risk analysis and strengthen asset monitoring as part of the ISMS.
Identifying observable technical gaps
An ISO/IEC 27001 approach relies on implementing controls appropriate to the risks. Cyber ratings can provide factual evidence regarding certain technical controls visible from the outside.
For example, they may highlight:
- publicly accessible administration ports;
- known vulnerabilities affecting exposed services;
- outdated protocols or cipher suites;
- expired, invalid or self-signed TLS certificates;
- missing or misconfigured SPF, DKIM or DMARC mechanisms;
- services or databases accessible without appropriate restrictions.
These findings are not sufficient to assess ISO/IEC 27001 conformity. However, they can feed into risk registers, treatment plans and evidence of continuous improvement.
Measuring progress over time
One of the challenges of a compliance approach is demonstrating that identified gaps are addressed and that controls remain effective over time.
A one-off rating does not fully meet this objective. Conversely, a solution that regularly updates observed data makes it possible to track changes in certain technical indicators, detect a deterioration in posture and verify the impact of remediation measures.
Security Rating® provides an automated, non-intrusive assessment of the external attack surface. Its overall score and domain-specific ratings make it possible to monitor the external cyber posture and share progress with technical teams, management or auditors.
ISO/IEC 27001 and cyber ratings: complementary approaches
| ISO/IEC 27001 | Cyber rating |
|---|---|
| Structures an information security management system | Assesses risk signals observable from the internet |
| Relies on risk analysis, policies, processes and controls | Relies on the analysis of exposed assets and public data |
| Covers a scope defined by the organisation | Helps identify external assets associated with the organisation |
| Relies on internal and external audits | Enables regular monitoring of the external attack surface |
| Confirms the conformity of an ISMS with the standard, within the certified scope | Does not certify conformity and does not cover internal defence mechanisms |
| Helps establish sustainable security governance | Helps detect certain technical gaps and track their remediation |
The value lies in combining these two approaches. ISO/IEC 27001 certification provides the governance and risk management framework. Cyber ratings offer an external, automated and regular view of part of the organisation's technical exposure.
Better preparing for audits and demonstrating continuous improvement
ISO/IEC 27001 audits assess, among other things, an organisation's ability to identify its risks, implement appropriate measures and ensure the continuous improvement of its ISMS.
In this context, a cyber rating can serve as a complementary source of information to:
- enrich the mapping of exposed assets;
- support risk analysis with external observations;
- identify issues requiring technical or organisational verification;
- track remediation actions;
- demonstrate changes in certain security indicators over time;
- prepare discussions with audit, compliance or management teams.
A strong cyber rating should not be presented as evidence of ISO/IEC 27001 conformity. A rating does not cover all the requirements of the standard, nor all internal processes and controls. It should be used as a complementary tool within a risk management approach.
Organisations seeking to go further can also rely on governance tools to centralise their controls, evidence, action plans and assessment campaigns. Discover how Board of Cyber helps improve compliance over time.
Assessing ISO/IEC 27001-certified suppliers
A supplier's ISO/IEC 27001 certification is an important element of a third-party risk management approach. It confirms that a structured information security management process is in place within the certified scope.
However, it does not remove the need for the contracting organisation to assess supplier risk. Several elements should be reviewed:
- the scope covered by the certificate;
- the validity date and the certification body;
- the relevance of the certified scope to the purchased service;
- the supplier's criticality to business operations;
- the data processed and the interconnections implemented;
- vulnerabilities or technical exposures visible from the internet;
- the supplier's ability to remediate identified gaps.
Certification provides assurance regarding a management system, but it does not make daily changes to the external attack surface visible. Cyber ratings usefully complement questionnaires, audits and certifications by detecting certain deteriorations between two assessments.
This approach is detailed in our article on the 7 methods for assessing your suppliers' cyber risk.
A response to growing compliance requirements
Organisations must now navigate several regulatory and standards-based frameworks: ISO/IEC 27001, GDPR, DORA, NIS2, the Cyber Resilience Act and the AI Act. These texts do not have the same scope or requirements, but they all reinforce the need to structure risk management and maintain evidence.
ISO/IEC 27001 certification can provide a useful foundation for organising this approach. Cyber ratings can, in turn, help document certain aspects of external exposure and continuous improvement.
They can also support discussions with insurers. Cyber insurance does not replace security measures. However, insurers are increasingly assessing the maturity of policyholders and their ability to prevent incidents. Our guide to cyber insurance outlines the criteria to consider.
To better understand the regulations that influence supplier risk management, also read the 8 regulations you need to know to successfully implement your TPRM approach.
Security Rating®: continuous visibility into external posture
Security Rating® helps organisations analyse their external attack surface, as well as that of their subsidiaries, suppliers and partners. The solution identifies publicly accessible assets, assesses multiple risk domains and provides remediation recommendations.
This approach can complement an ISO/IEC 27001 initiative in several ways:
- by providing an external view of exposed assets and services;
- by facilitating the identification of certain technical gaps;
- by enabling the tracking of remediation for observable vulnerabilities;
- by providing indicators that can be used by operational teams and management;
- by contributing to the continuous assessment of suppliers and partners.
Security Rating® does not replace ISO/IEC 27001 certification, an internal audit or a penetration test. It is a complementary tool for maintaining visibility into internet-visible risks and prioritising remediation actions.
Conclusion
ISO/IEC 27001 certification remains a reference framework for sustainably structuring information security governance. It makes it possible to define a management system, organise risk management and demonstrate commitment to stakeholders.
In an environment where the attack surface evolves rapidly, however, it benefits from being complemented by continuous visibility mechanisms. Cyber ratings provide an external view of exposed assets and certain technical risk signals.
Used together, ISO/IEC 27001 certification, audits, supplier assessments and cyber ratings enable organisations to build a more practical, measurable compliance approach that is better aligned with evolving risks.
FAQ
Can cyber ratings help obtain ISO/IEC 27001 certification?
No. Cyber ratings alone cannot be used to obtain ISO/IEC 27001 certification. Certification concerns an information security management system, its processes, risk analysis and controls. A cyber rating provides a complementary assessment of certain risks observable from the internet.
Can an ISO/IEC 27001-certified company have external vulnerabilities?
Yes. ISO/IEC 27001 certification confirms the conformity of an ISMS with the standard, for a defined scope and at the time of the audit. It does not guarantee the absence of vulnerabilities, configuration errors or newly exposed assets. Regular external monitoring can help identify such changes.
How should an ISO/IEC 27001-certified supplier be assessed?
An ISO/IEC 27001 certificate is useful, but it should be assessed in light of its scope, validity and the criticality of the service provided. It can be complemented by a security questionnaire, contractual clauses, a targeted audit and a cyber rating to monitor risks visible from the internet.
Does Security Rating® make a company ISO/IEC 27001 compliant?
No. Security Rating® does not make an organisation ISO/IEC 27001 compliant. The solution helps identify and track certain technical risks observable from the internet. It can provide useful input as part of a risk management, continuous improvement or audit preparation process.
