ISO 27001 for IT and software companies in Georgia selling abroad

For a Georgian software house or outsourcing company, ISO/IEC 27001 is usually a sales requirement before it is a security project. Building it around how your team actually works keeps it useful after the audit.

Why foreign clients ask for it

Clients in the EU, the UK and the US send long security questionnaires to every new supplier. An accredited ISO/IEC 27001 certificate does not remove the questionnaire, but it shortens it and moves you past the first filter. Several regulatory trends add pressure:

• EU entities covered by the NIS2 Directive must manage security risks in their supply chain, and pass part of that duty to their software suppliers.
• EU financial entities have applied the Digital Operational Resilience Act (DORA) since 17 January 2025, including requirements on ICT third-party providers.
• Enterprise clients of any sector want evidence of secure development, access control and incident handling before they share production data.

Georgian context

Many IT companies in Georgia use International Company status, which gives reduced profit and personal income tax rates to qualifying IT companies that provide software services to non-residents. One condition is that the main income-generating work, including the core IT staff, is carried out from Georgia. That has a practical consequence for ISO 27001: the team that builds and runs the product sits in Tbilisi, Batumi or works remotely within the country, and it is this team the auditor will interview.

Personal data of clients, users and staff is subject to the Law of Georgia on Personal Data Protection, and data of EU residents to the GDPR as well. Both belong in the ISMS legal register.

Setting the scope

The most common mistake is a scope that is either too narrow to satisfy clients or so wide that the project stalls. Questions that help:

1. Which services or products do clients ask about? A SaaS platform, custom development, a dedicated team model, support and maintenance?
2. Which legal entity signs the client contracts? If a foreign parent company sells and the Georgian company develops, both may need to be considered.
3. Where does the work happen? Offices, co-working spaces, remote work from home, staff travelling or working from other countries.
4. Which infrastructure is yours and which is the client's? Many outsourcing firms work inside the client's environment, which changes which controls apply.

Write the scope so that a client reading the certificate understands what is covered. "Design, development and support of the [product] platform" is clearer than a generic phrase.

Controls auditors check first in software companies

• Access management. Joiner, mover and leaver process, MFA, removal of access when contractors finish, access reviews with evidence.
• Secure development. ISO/IEC 27001:2022 Annex A includes controls for the secure development life cycle, secure coding, security testing, separation of environments and change management. Auditors will sample pull requests, test results and release records.
• Cloud services. How you select, configure and monitor cloud providers. ISO/IEC 27017 and ISO/IEC 27018 add cloud and cloud privacy guidance where clients ask for it.
• Remote work and endpoints. Disk encryption, patching, device inventory and rules for personal devices.
• Supplier management. Freelancers and subcontractors are common in Georgian IT; they need contracts, NDAs and access control like employees.
• Logging, backups and incident response. Tested restores and at least one documented incident or exercise.

Related frameworks clients may ask for

US customers often ask for a SOC 2 report instead of, or in addition to, ISO 27001. SOC 2 is an attestation report issued by a licensed US CPA firm, not a certificate; much of the control work overlaps. See SOC 2 for Georgian SaaS startups. If you build AI features for EU clients, ISO 42001 and the EU AI Act explains the next layer. Privacy-heavy products may add ISO 27701.

How BALTUM works with IT companies

We run a gap assessment against ISO/IEC 27001:2022, agree the scope with you, and help put controls into the tools your engineers already use, such as your ticketing system, code repository and cloud console, so that evidence is produced as part of normal work. We train the team, carry out the internal audit and support you through the audit with an accredited certification body. Duration depends on scope and your starting point and is set after the first assessment. More on the standard: ISO 27001.

To discuss your scope, use the form on this site or write to info@baltum.org.

Frequently asked questions

Do remote developers in Georgia need to be in the ISO 27001 scope?

If they work on the services in scope, yes. The auditor will check how their devices, access and working practices are controlled, and may interview some of them remotely.

Can we certify only one product?

Yes. A scope limited to one platform or service, with the people and processes that support it, is common and can be extended later.

More articles from BALTUM Georgia