Trust Center Database / Insights / ISO 27001 holders carry 1.9x the confirmed standards

ISO 27001 holders carry 1.9x the confirmed standards

Companies with ISO 27001 do not hold one more certificate than everyone else. They hold roughly twice as many, which is what a functioning security programme looks like from outside.

2.26

confirmed standards on average

among the 620 ISO 27001 holders

1.18

for everyone else

the other 1033 companies

1.9x

the depth

ISO holders vs the rest

Average confirmed standards

ISO 27001 holders2.26 avg standards
Everyone else1.18 avg standards

How the two populations spread

ISO 27001 holders: 1 standard176 (28%)
ISO 27001 holders: 2 standards241 (39%)
ISO 27001 holders: 3 standards127 (20%)
ISO 27001 holders: 4 or more76 (12%)
Everyone else: 1 standard546 (53%)
Everyone else: 2 standards270 (26%)
Everyone else: 3 standards35 (3%)
Everyone else: 4 or more6 (1%)

How to read this

The causation runs both ways and we cannot separate them here: the controls ISO 27001 requires make further certifications cheap to add, and companies already investing in compliance are likelier to pursue ISO in the first place. Either way, the certificate is a reliable marker of a company that treats security as a programme rather than a checkbox.