A facilities director reviewing a new reporting platform asks whether the supplier is secure. The supplier replies that it holds ISO 27001 certification a procurement box gets ticked and the conversation moves on. Nothing further is checked because the certificate feels like a conclusion rather than the starting point it actually is.
That gap matters more in property than in most sectors. Estate data is not one tidy dataset sitting in one system. It is half hourly meter readings access control logs work order histories waste collection records contractor timesheets and emissions calculations pulled from dozens of sources across dozens of buildings then combined into reports that investors regulators and tenants read as fact. Every one of those feeds is a point where data can leak break or quietly drift out of date.
The UK government Cyber Security Breaches Survey recorded that 43 percent of businesses experienced a breach or attack in the previous twelve months roughly 612000 organisations rising to 65 percent of medium and 69 percent of large businesses. Only 25 percent held a formal incident response plan. Against that backdrop knowing what a certificate genuinely proves is a practical skill for anyone responsible for estate information.
What ISO 27001 Certification Actually Certifies
The most common misreading is treating the standard as a product label. It is not. It certifies a management system which is a very different claim.
A Management System Not a Product Badge
The 2022 edition of ISO/IEC 27001 sets out requirements for an Information Security Management System across clauses 4 to 10 covering context leadership planning support operation performance evaluation and improvement. The certificate confirms that an independent auditor examined how an organisation identifies information risk decides what to do about it assigns ownership and reviews whether the decisions are still working.
That distinction matters. A certified supplier has not promised that any platform is impenetrable. It has demonstrated a repeatable process for finding weaknesses and closing them and accepted that an external body will return to check.
Scope Is the Part Most Buyers Skip
Every certificate carries a scope statement and the scope is where the real information sits. A certificate covering only a head office function tells an estate team very little about the platform holding building data. The Codedevza AI Trust Centre publishes that detail openly rather than leaving buyers to ask for it.
| Certificate detail | What is recorded |
|---|---|
| Standard | ISO/IEC 27001 Information Security Management Systems 2022 edition |
| Certificate number | 1N719TSI20261008GBRIS18Y |
| Certified organisation | Codedevza AI Ltd |
| Certification body | TNV System Certification Pvt. Ltd. |
| Accreditation body | IAS an IAF MLA signatory |
| Issued | 8 October 2026 |
| Scope | Digital platforms AI enabled systems and technology services for property facilities management sustainability and ESG |
| Status | Active |
Four areas sit inside that scope and each one touches estate data directly.
- Digital platforms meaning the products designed built and operated for clients
- AI enabled systems covering how models and features are developed deployed and governed
- Data integration covering how client data moves into through and out of those systems
- Consulting and advisory covering property facilities management sustainability and ESG engagements
If a supplier holds estate data and cannot show you a scope statement that names the platform itself the certificate is answering a question you did not ask. See how Codedevza AI applies ISO 27001 certification across estate platforms and data integration.
Why Estate Data Carries Risk That Generic Security Reviews Miss
Security reviews built for office IT tend to assume data lives in a small number of managed applications. Estate data does not behave that way.
Operational and Personal at the Same Time
A single reporting platform may hold consumption figures that look purely technical alongside access records that are unambiguously personal data under the UK GDPR and the Data Protection Act 2018. Teams often classify the whole set by its least sensitive component which is how personal data ends up in spreadsheets nobody treats as sensitive.
| Data category | Typical source | Why it carries risk |
|---|---|---|
| Energy and consumption data | half hourly meters building management systems | reveals occupancy patterns shift timings and empty periods |
| Occupancy and access records | access control visitor management | personal data with clear legal obligations attached |
| Asset and maintenance data | CAFM and work order systems | maps plant locations known faults and response times |
| Waste and resource data | weighbridge tickets contractor feeds | handled by multiple third parties outside your network |
| ESG and disclosure data | reporting platforms and dashboards | feeds published statements and investor facing reports |
Building Systems Were Rarely Designed With Security In Mind
Research from Claroty Team82 analysed close to 467000 building management system devices across 529 organisations and found that 75 percent of those organisations had devices affected by known exploited vulnerabilities while 69 percent had devices carrying critical vulnerabilities previously used in ransomware attacks. Many still run legacy protocols such as BACnet Modbus and KNX without encryption.
This is the uncomfortable part of estate digitisation. The systems generating the most valuable sustainability data are often the least hardened assets on the network a tension explored in the difference between ESG estimation and ESG evidence.
The Cost Sits Higher Than Most Estate Budgets Assume
The IBM Cost of a Data Breach Report 2025 put the global average cost of a breach at 4.44 million dollars with the UK average at 3.29 million pounds and found organisations took an average of 241 days to identify and contain one. For an estate team operational disruption arrives long before the financial number does.
How the 93 Annex A Controls Map to Estate Data
The 2022 revision restructured Annex A from 114 controls across 14 domains into 93 controls across four themes. Organisations do not implement all 93 by default. They record a justified position on every one in a Statement of Applicability the document that reveals how seriously the work was taken.
| Theme | Controls | What it governs | Estate data example |
|---|---|---|---|
| Organisational | 37 | policies supplier due diligence incident management | assessing a waste contractor feed before it is connected |
| People | 8 | screening awareness responsibilities after employment | removing platform access when a site manager leaves |
| Physical | 14 | perimeters entry controls equipment secure disposal | wiping a decommissioned meter gateway before disposal |
| Technological | 34 | access cryptography logging secure development | encrypting half hourly consumption records in transit |
Six control areas carry most of the weight for estate data specifically.
- Access control and least privilege so a contractor sees one site rather than the full portfolio with permissions reviewed on a schedule
- Encryption in transit and at rest applied wherever building data moves or is stored
- Secure development lifecycle meaning security is considered at design and review stages rather than bolted on before launch
- Supplier and sub processor due diligence which matters enormously when a reporting chain runs through several contractors
- Incident response and business continuity so a problem is detected contained and recovered against a documented plan
- Risk assessment and internal audit giving the organisation its own evidence rather than waiting for the external auditor
Supplier due diligence deserves particular attention. The same government survey found only a small minority of businesses review the cyber security of their immediate suppliers which is exactly where estate data exposure concentrates. Strong internal controls mean little when a weekly contractor spreadsheet enters the reporting chain unchecked a pattern connected to broader governance failures that undermine ESG confidence.
Estate data is only as protected as the weakest contractor feed inside the reporting chain. Talk to Codedevza AI about ISO 27001 certification and estate data governance across your portfolio.
What ISO 27001 Certification Does Not Mean
Reading the certificate accurately also means knowing its limits.
It Does Not Guarantee Zero Incidents
A certified organisation can still suffer an incident. What the standard requires is that incidents are detected contained documented and learned from rather than discovered months later by somebody else.
It Does Not Cover Everything the Organisation Does
Only the activities named in the scope statement were audited. Work outside that boundary was not assessed which is why reading the scope line matters more than seeing the logo.
It Is Not the Same as GDPR Compliance
Information security and data protection overlap heavily without being identical. ISO 27001 certification addresses how information is protected. The UK GDPR addresses lawful basis purpose retention and the rights of the people the data describes. A credible supplier aligns with both and will sign a data processing agreement that says so.
It Is Not Permanent
Certificates run on a three year cycle with annual checks in between. A certificate that has lapsed or has not been surveilled is a weaker signal than it appears.
| Audit stage | Typical timing | What happens |
|---|---|---|
| Stage 1 | before certification | documentation and readiness review |
| Stage 2 | within weeks of Stage 1 | full implementation audit across the declared scope |
| Surveillance 1 | around 12 months | sample of controls plus corrective action follow up |
| Surveillance 2 | around 24 months | continued conformity and improvement check |
| Recertification | before the three year expiry | full reassessment and a new three year certificate |
How to Verify a Supplier Certification Claim
Verification takes a few minutes and separates a genuine certificate from a marketing claim.
Step 1 Ask for the Certificate Number and Scope
A real certificate has a number a named certification body and a written scope. If a supplier can only send a logo there is nothing to verify.
Step 2 Check the Accredited Register
Accredited certificates appear on IAF CertSearch the global register of accredited management system certifications. Confirm the organisation name the standard version and that the status reads as active.
Step 3 Read the Scope Against Your Own Use Case
Check that the scope covers the platform the integrations and the services you will actually use. This is the step most buyers skip and the one carrying the most value.
Step 4 Request Supporting Documents and Confirm Accreditation
Mature suppliers share documents such as a Statement of Applicability under a non disclosure agreement. Look also for a named accreditation body that signs the IAF multilateral recognition arrangement because a certificate from an unaccredited body carries far less weight.
What Estate Teams Should Ask Before Sharing Data
Once verification is done a short set of questions closes the remaining gaps. These sit alongside the discipline behind estate level sustainability controls.
- Which categories of estate data will be held and for how long
- Where is the data stored and which sub processors can reach it
- How is access granted reviewed and removed across sites and contractors
- What happens to building data when the contract ends
- How quickly would we be told about an incident affecting our portfolio
- Does the scope statement cover the integrations feeding the platform
Teams that ask these early rarely renegotiate them later. The same structure supports data governance and AI readiness across a portfolio.
Why This Is Becoming a Procurement Standard
Adoption numbers tell their own story. The ISO Survey recorded 96709 valid ISO/IEC 27001 certificates worldwide in 2024 up from 71549 in 2022 and 36362 in 2019. Certification is moving from a differentiator to a baseline expectation wherever a supplier holds operational data for a client.
Disclosure pressure reinforces the shift. Estate data increasingly ends up in reports carrying regulatory and investor weight so the integrity of the pipeline matters as much as the accuracy of the final figure. That connection runs through ESG risk management in property operations and shapes how net zero commitments align with building level data.
Final Thoughts
ISO 27001 certification is not a promise that nothing will go wrong. It is evidence that an organisation has built a repeatable way of finding out what could go wrong deciding what to do about it and proving those decisions to somebody with no commercial interest in a comfortable answer. For estate data spread across meters access systems contractor feeds and reporting platforms that discipline is the difference between a number you can defend and a number you simply hope holds up.
The estate teams getting most value from certification treat it as the opening of a conversation about scope suppliers retention and incident response rather than the end of one.
Estate data moves through too many hands to be protected by assumption alone. Speak to Codedevza AI about ISO 27001 certification and evidence led estate systems.
Frequently Asked Questions
What does ISO 27001 certification actually prove about a supplier?
It proves that an independent auditor assessed how the organisation identifies information risk applies controls assigns ownership and reviews effectiveness. It certifies a management system rather than any single product.
Does ISO 27001 certification cover my estate data automatically?
Only if the scope statement includes the platforms integrations and services holding that data. Always read the scope line before assuming the certificate applies to your use case.
How many controls are in ISO 27001 and must all of them apply?
The 2022 version lists 93 controls across organisational people physical and technological themes. Organisations record a justified position on every control in a Statement of Applicability rather than implementing all 93.
Is ISO 27001 certification the same as being GDPR compliant?
No. The standard addresses how information is protected while the UK GDPR addresses lawful basis purpose retention and individual rights. Credible suppliers demonstrate both and will sign a data processing agreement.
How long does an ISO 27001 certificate stay valid?
Three years from issue with annual surveillance audits in the intervening years and a full recertification audit before expiry.
How can I verify a certificate is genuine?
Request the certificate number the certification body and the scope then confirm the record on IAF CertSearch and check that the status reads as active.
Why is estate data considered higher risk than ordinary business data?
It combines operational and personal information arrives from many building systems and contractors and often flows into published sustainability reporting where errors carry regulatory and reputational consequences.
What should I ask a supplier beyond the certificate itself?
Ask about data categories held storage locations sub processors access review retention after contract end incident notification timelines and whether the scope covers your integrations.
Does certification mean a supplier will never suffer a breach?
No. It means incidents should be detected contained documented and learned from under a tested plan rather than discovered late by an outside party.
How does this connect to wider estate reporting quality?
Security and data quality depend on the same controls around access ownership and supplier oversight which is why certification sits close to the standard behind audit ready ESG data.
References and Further Reading
The requirements discussed here are published in full by the International Organization for Standardization and accredited certificates can be checked against the global register of accredited certifications.
Breach prevalence and incident readiness figures come from the UK Cyber Security Breaches Survey while breach cost and detection timelines come from the Cost of a Data Breach Report. Building system exposure data is drawn from research into cyber physical system security in commercial buildings.
For data protection obligations sitting alongside the standard the Information Commissioner Office publishes practical UK data protection guidance and the National Cyber Security Centre maintains technical security guidance for organisations.
Academic Research
Readers wanting peer reviewed evidence can explore scholarship on information security management system adoption on building management system cyber security on security certification and organisational performance and on data governance across property operations.