ISO/IEC 27001 is an international standard for how an organization manages information security. It sets requirements for an information security management system (ISMS): the policies, responsibilities, risk assessments, and review processes used to protect information and improve the security program over time.

An organization can have that management system independently assessed against the standard. Successful assessment leads to a certificate covering the organizational activities and services within its defined scope.

You may encounter a request for an ISO/IEC 27001 certificate in a procurement policy, customer agreement, or vendor questionnaire. The certificate supplies independent evidence about the provider's management of information security.

Files.com Certification Plans

Files.com is currently pursuing ISO/IEC 27001 certification. We expect to be audited and certified in 2027. We do not currently hold an ISO/IEC 27001 certificate.

Many customers accept our SOC 2 Type II report as alternative assurance while we pursue ISO certification. This report is an independent auditor's examination of our controls over a defined period. Whether that meets your requirements depends on the evidence your organization needs and any contractual requirement for a specific certificate.

What Certification Addresses

Certification addresses how the organization manages information security across people, policies, processes, and technology. It includes the ongoing work of identifying risks, selecting and operating controls, and reviewing how well those controls work.

A certificate applies to the organizational activities and services within its stated scope. When reviewing a provider's certificate, check that scope against the service and relationship you plan to use. A supplier's certification also does not establish certification of your own organization or its use of the service.

Our Information Security Program explains the governance, risk management, and controls already operating at Files.com. The broader Compliance reference describes those practices and their supporting evidence while certification is underway.

Using SOC 2 Evidence During Your Review

Files.com undergoes an annual independent SOC 2 Type II examination covering Security, Availability, and Confidentiality. The report describes the system, controls, examination period, auditor's opinion, and results of testing. It lets your reviewers assess the design and operating effectiveness of the controls within that scope.

SOC 2 and ISO/IEC 27001 provide different forms of assurance. A SOC 2 report is not an ISO certificate, but its detailed control descriptions and testing results can answer many of the underlying vendor-review questions. Many customers use it as a bridge while Files.com pursues ISO certification.

Review the report alongside the Shared Responsibility Model, including the controls your organization and connected providers operate. Our SOC 2 bridge letter is management's statement covering the period after the most recent examination.

The report and bridge letter are available under a nondisclosure agreement (NDA). Document Requests explains eligibility and access, and the Trust Center lists available evidence.

If your procurement process requires an ISO/IEC 27001 certificate specifically, raise that requirement with your Account Executive or Account Manager during evaluation. Distinguish a request for assurance about our security program from a requirement that can be satisfied only by an issued certificate.