How to choose the right ISO 27001 HR software

An ISO 27001 certified HR platform is one whose provider holds a current certificate issued by an accredited certification body, with the HR product itself named inside the certificate's scope. Ask for the certificate, read the scope statement, check the issue and expiry dates, then look at how the product actually handles access, logging and retention of employee records. Certification tells you a management system was audited. It does not, on its own, tell you your data is well handled.

Last reviewed September 2026.

What ISO 27001 certification actually covers

ISO/IEC 27001 is the international standard for an information security management system. A certificate says an accredited auditor examined how an organisation identifies risks to information, decides which controls to apply, documents those decisions, and reviews them over time. The audit is of the management system, not of any single feature.

That distinction matters when you are buying. A vendor can hold a valid certificate covering its corporate IT and still run your HR module on infrastructure sitting outside the certified scope. It can also hold a certificate that covers everything and still give a department head more access to employee records than that person needs, because scope and configuration are different questions. Read the certificate for what is in, then ask product questions separately.

The standard sits alongside privacy law rather than replacing it. Meeting ISO 27001 helps an organisation show it takes security seriously, and it generates much of the evidence that a privacy regulator or a client's risk team will ask for. This article is general information for people buying software. Where legal obligations are in question, take professional advice from someone who knows your jurisdiction and your industry.

How to check a vendor is genuinely ISO 27001 certified

Most zero-click frustration with this topic comes from vendors putting a badge on a website and buyers having no way to test it. There are five checks, and none of them take long.

Ask for the certificate itself, not the badge. A real certificate carries a certificate number, the name of the legal entity it was issued to, the issuing certification body, an issue date and an expiry date. If what comes back is a screenshot of a logo, keep asking.

Check the certification body is accredited. Certification bodies are themselves accredited by a national accreditation body, and most publish a searchable register of the certificates they have issued. Look the certificate number up on the issuer's register rather than taking the PDF at face value.

Read the scope statement. This is the sentence on the certificate that says what was audited. You want the product you are buying and the infrastructure it runs on to be inside that sentence. A scope limited to "head office corporate services" covers the vendor's own laptops, not your employee records.

Check the dates and the surveillance cycle. Certificates run on a three-year cycle with annual surveillance audits in between. A certificate that expired last year, or one where the most recent surveillance audit cannot be evidenced, is a flag worth raising.

Ask for the Statement of Applicability. This document lists the controls the organisation applied and, importantly, the ones it excluded and why. Vendors will not always share it in full, and that is reasonable. A vendor that will walk you through the relevant sections under a confidentiality agreement is behaving normally. A vendor that has never heard of it is not certified in any meaningful sense.

ISO 27001 HR software for data-sensitive industries

The certificate is the same everywhere. What changes by sector is the second layer of questions you should be asking once the certificate checks out, because the consequences of a mishandled record differ.

None of those questions require a legal team. They require a vendor willing to answer in writing. If you are running a formal selection, the HR tech requirements builder gives you a structure to put security questions next to functional ones so they get weighted rather than waved through at the end.

The controls worth checking inside the software

A polished interface hides a lot. Four things are worth looking at directly in a trial environment rather than reading about in a brochure.

Access control should be granular enough that a line manager can see a performance record without seeing a bank account or a home address. Ask the vendor to show you the permission model and then try to break it with a test account.

Audit logging should record every view, edit, export and deletion, with a user and a timestamp, and the log should be readable by you rather than only by the vendor's support team. Exports matter more than views in practice, because a spreadsheet downloaded to a laptop leaves the system entirely.

Encryption in transit and at rest is close to universal now, so the more useful question is about key management and about backups. Ask how often backups are tested by restoring them, not how often they are taken.

Retention and deletion is where most HR systems are weakest. Employee and candidate records accumulate for years past any purpose. Ask whether retention rules can be set per record type, whether deletion is real deletion, and what happens to your data if you leave the vendor. The same logic applies to the people analytics layer, where aggregated reporting often quietly keeps the underlying rows alive.

For a wider view of how these controls fit together across a people stack, our guide to data security in HR software covers the operational side in more detail.

Questions to put to a vendor

Send these in writing and keep the replies with your selection file.

• What is your certificate number, who issued it, and where can I verify it on their register?
• Does the scope statement include the product I am buying and the environment it runs in?
• When was your last surveillance audit, and were any non-conformities raised?
• Which sub-processors touch our data, where are they, and how are we told when that list changes?
• How do we get a full export of our data, in what format, and how long after we ask?
• Who at your company can read a customer's employee records, under what circumstances, and is that access logged?

Compono is ISO 27001 certified, and the honest position is that you should put every one of those questions to us as readily as to anyone else. Our fit boundary is worth saying plainly: Compono holds hiring, engagement, learning and competency data across the HR software platform. It is not a payroll or finance system, so pay and banking records sit with your payroll vendor and need the same questions asked there. If you are still working out which system holds which record, the difference between an ATS and an HRIS is the place to start, because the split determines who is responsible for the most sensitive fields.

Where ISO 27001 and performance reviews meet

Performance data is one of the few HR record types that is both highly sensitive and widely shared. Reviews get copied into slide decks for calibration meetings, forwarded to new managers during a restructure, and left in shared drives long after anyone needs them.

Working to ISO 27001 changes that in two practical ways. It forces a decision about who is allowed to read a review and for how long, which is a conversation most organisations have never actually had. And it creates a record of who read what, which protects the reviewer as much as the employee when a decision is later challenged. People also write more candidly when they believe the document will not circulate, so tighter access tends to improve the content of reviews rather than restrict it.

The gain is real but modest. Certification will not make a badly designed review process useful. It will stop a useful one from quietly turning into a liability.

Frequently asked questions

How do I check a vendor is really ISO 27001 certified?

Ask for the certificate rather than the badge, then look the certificate number up on the issuing certification body's public register. Check that the issuer is itself accredited, that the certificate has not expired, and that the scope statement names the product you are buying.

What is the difference between ISO 27001 certified and ISO 27001 compliant?

Certified means an accredited external auditor has examined the information security management system and issued a certificate. Compliant is a self-description with no independent audit behind it. Both can be honest, but only one is verifiable.

Does ISO 27001 certification mean my employee data is safe?

It means the vendor has an audited system for managing security risk, which is a good sign. It does not guarantee the specific controls you need are switched on in your instance, so still check access permissions, audit logging and retention settings yourself.

Is ISO 27001 the same as GDPR or the Australian Privacy Act?

They are related but different. ISO 27001 is a framework for how you manage information security. Privacy laws such as GDPR or the Australian Privacy Act set legal obligations about personal data. Working to the standard helps you meet those obligations, and professional advice is the right way to confirm you have.

Does a small business need ISO 27001 certified HR software?

Whatever your size, you hold sensitive data covered by privacy law. Smaller organisations rarely certify themselves, but buying from a certified vendor is a practical way to inherit a level of assurance you could not build alone.

Can ISO 27001 make performance reviews better?

Indirectly, yes. It forces a decision about who can read review data and for how long, and it logs who actually did. Reviewers tend to write more candidly when they trust the document will not circulate.