A customer contract requires us to obtain and maintain ISO 27001. How does the general counsel confirm the certificate actually covers this contract?
| What to check | Why |
|---|---|
| Certification scope | The certificate vouches for the organisation and activities in scope; if the contracted services are outside it, the certificate proves nothing about them |
| Statement of Applicability (SoA) | Applicability of the 93 controls is decided by risk assessment, with reasons for exclusions; a control the customer cares about may be excluded |
| Version | Implement ISO/IEC 27001:2022; the transition period for 2013 certificates ended on 31 October 2025 |
| Issuer | Under ISO/IEC 17021-1 clause 5.2.5, an accredited certification body and the same legal entity may not provide management system consultancy; the certification body, not the consultant, issues the certificate |
The contract can require that the certificate scope covers the contracted services, and that you notify the customer if the certificate lapses, is suspended or its scope shrinks. It should also be clear that an ISO certificate does not equal NIS2, GDPR or EU CRA compliance; regulatory obligations the customer requires need separate clauses.
The customer wants audit rights. Can an ISO 27001 certificate or audit report replace an on-site audit?
It depends on the rules the customer is subject to:
| Customer type | Room for negotiation |
|---|---|
| Ordinary commercial customer | Audit rights are negotiable: scope, frequency, advance notice, confidentiality and cost, with the certificate, SoA and certification audit results as routine evidence |
| EU financial entity (DORA), where you support critical or important functions | The financial entity or an appointed third party has unrestricted rights of access, inspection and audit; ESMA explains that the frequency is agreed by the financial entity and ad hoc audits must remain possible |
| Customer regulated under NIS2 | Must take into account the specific vulnerabilities of each direct supplier, often confirmed through questionnaires or audits |
The general counsel's bottom-line clauses: auditors must not access other customers' data; confidentiality and permitted use of audit findings; handling of any service disruption caused by an audit. Whether a certificate replaces any given audit is the customer's decision.
What framework should the general counsel use to review incident notice periods, liability caps and indemnities?
| Clause | Framework |
|---|---|
| Incident notice | Start with the customer's own legal deadlines: GDPR personal data breaches within 72 hours of awareness where feasible; NIS2 significant incidents, early warning within 24 hours; DORA, within 4 hours of classification as major and no later than 24 hours after awareness. If the customer wants earlier notice from you, confirm your detection and triage can deliver |
| Liability cap | Whether security or personal data incidents are carved out of the general cap or given their own cap |
| Indemnity | Whether fines imposed on the customer are included; whether a fine can be indemnified depends on the governing law |
| Insurance | Whether cyber insurance cover matches the contractual liability |
| Cooperation in investigations | Which records you must provide, and how fast, when a regulator or the customer investigates |
ISO 27001 incident management procedures and exercise records are the basis for showing you can meet notice clauses. The legal effect of the clauses should be assessed by a lawyer; insurance cover should be confirmed by the broker.
After a security or personal data incident, how do ISO 27001 records help in damages claims and regulatory investigations?
- Personal Data Protection Act, Article 29(1): where a non-government agency violates the Act and personal data is unlawfully collected, processed or used, or data subjects' rights are otherwise infringed, it is liable for damages, unless it can prove it was neither intentional nor negligent. The burden is on the company; risk assessments, controls, internal audits and management review records are the material for showing what measures were taken.
- Amendment of 11 November 2025 (ROC year 114): Article 12 adds notification to the competent authority when a defined reporting threshold is met, immediate response, and recording the facts and responses and keeping records for inspection; some articles are not yet in force and no effective date has been set.
- GDPR: certification mechanisms under Article 42 must be approved by a data protection authority or the EDPB (for example Europrivacy); ISO 27001 is a management system certification issued by a certification body, not such a mechanism.
Whether the records prove the absence of negligence, and how much weight they carry, is for the court to decide case by case; an ISO certificate is not proof of exemption from liability.
Once an incident occurs, what comes first for evidence preservation and external communication?
Framework, in order:
- Activate the response procedure: Article 34 of the Cybersecurity Control Guidelines for Listed Companies requires an incident response and reporting procedure; legal needs a defined role in it
- Preserve evidence: incident logs, system records, forensic data and decision records, noting when each was collected and by whom, so integrity cannot be questioned later
- List the deadlines: put GDPR, NIS2, DORA and customer contract notice periods side by side and decide which apply in one incident classification step
- External communication: Article 18, item 6 of the Regulations Governing Information to be Published in Annual Reports of Public Companies requires disclosure of losses, possible impacts and responses for major cybersecurity incidents; external statements must match the notifications
- Afterwards: bring corrective actions into ISO 27001 improvement tracking
Under Article 41 the Guidelines are adopted by listed companies as appropriate, and the annual report regulations apply to public companies; non-public companies are not subject to these rules and may adopt them voluntarily.
What security clauses should we put in contracts with our own cloud and outsourcing providers?
What you demand upstream must match what you promise downstream: every commitment to a customer needs support in your supplier contracts.
- Articles 31–33 of the Cybersecurity Control Guidelines for Listed Companies cover outsourced information operations; Article 38 requires periodic security audits of the company and its outsourced providers
- TWSE ESG evaluation indicator S-15: disclose a supplier management policy requiring suppliers to comply with rules on topics such as information and communications security and privacy protection, and explain implementation
Clause checklist:
| Clause | Key point |
|---|---|
| Audit or evidence | You can audit, or at least obtain certificates and audit results |
| Incident notice | Shorter than what you promise your customers |
| Subcontracting | Prior consent and equivalent requirements |
| Data processing locations | Consistent with your commitments to customers |
| Termination | Data return and proof of deletion |
The Guidelines and the ESG evaluation apply to listed companies; non-public companies are not subject to them and may adopt them voluntarily.
How does Winners Consulting help a general counsel with ISO 27001?
- Confirm requirements first: the security requirements of customers, tenders and regulators, used to set the certification scope
- Risk assessment and SoA: build the assessment framework in ERM risk language and decide controls and the Statement of Applicability, with reasons for exclusions
- Separate roles: Winners Consulting is a consultant and does not issue certificates; for certified organisations, internal audits can be outsourced to Winners
- One set of evidence: ISO 27001 as the backbone, so NIS2, DORA and customer questionnaires share the same records
- Timeline (as listed on the service page): typically 4–8 months
- Who leads: VP- and director-level consultants lead the work end to end, never outsourced, and the team holds ISO lead auditor qualifications. Named clients: MPI Corporation (旺矽科技), 訊光資訊科技 (InfoLight), 卓元科健 (Cho Yuan), Hypercore Fitness Center
More: ISO 27001 consulting, How to choose an ISO 27001 consultant in Taiwan, Outsourcing ISO 27001 internal audits. Request a free mechanism diagnosis
How other roles see this service
- CEOISO 27001 for the CEO: customers want a certificate, the board wants a report. What comes first?
- CISOCISO implementing ISO 27001: board reporting, the ESG bonus point and certification scope
- CROISO 27001 for CROs: how do information and enterprise risk share one scale?
- CFOCFO view of ISO 27001: annual report cybersecurity disclosure, ESG bonus points and budgeting
- CHROCHRO guide to ISO 27001: screening, NDAs, training, discipline and offboarding
Other services for this role
- ISO 37001 for General Counsel: agent bribery, whistleblowing investigations and contract clauses
- Trade secrets for General Counsel: what to prepare for departing employees, lawsuits and evidence preservation
- GDPR and ISO 27701 for General Counsel: processor contracts, transfers and investigations
- EU CRA for General Counsel: manufacturer liability, reporting duties and ODM contracts
- EU AI Act and ISO 42001 for General Counsel: roles, AI contracts and liability
- NIS2 for the general counsel: jurisdiction, personal liability, investigations and customer clauses
- DORA for the general counsel: negotiating Article 30 contracts, audit rights and exit
- ERM for the general counsel: putting compliance risk on the risk map and proving effectiveness
- TISAX for the general counsel: OEM contracts, participation terms and sharing results