ISO 27001 certification for professional firms: protecting data and enhancing the firm

The competitive value of data security for professional firms

What is ISO/IEC 27001

the ISO/IEC 27001 is the international standard that defines the requirements for an information security management system (ISMS). The current edition is the ISO/IEC 27001:2022 : the transition period from the 2013 version ended on October 31, 2025, and from that date, certificates issued under the old edition are no longer valid.

The standard does not mandate a specific technology. Instead, it asks the firm to analyze the risks to which information is exposed and to choose, among the 93 controls of Annex A (organizational, people-related, physical, and technological), those necessary to reduce them, justifying the choices in a document called Statement of Applicability . The certification is issued by an accredited certification body, in Italy by Accredia , has a three-year validity and is subject to annual surveillance audits and a renewal audit upon expiration.

Why it is a choice factor today

The context explains why data security has become a business issue as well as a technical one. According to the Clusit Report 2026 , in 2025 there were 5,265 serious cyber incidents recorded worldwide, in 49% growth over the previous year; in Italy there were 507, with a 42% increase , equal to 9.6% of the world total, a share much higher than the country's economic weight.

For a professional firm, an incident does not just mean days of downtime: it means having to explain to clients that their confidential documents may have been exposed. An ISO 27001 certification addresses this concern in advance. Specifically, it can:

• S simplify client due diligence : many supplier security questionnaires ask if the organization is certified, and an accredited certificate is a verifiable answer;
• R strengthen the position in accreditations at banks, insurance companies, and large groups, which are also subject to stringent regulations such as the DORA regulation (EU Reg. 2022/2554) on digital operational resilience in the financial sector, requiring service providers to meet high standards of security and verifiability;
• D structure the firm's accountability in personal data protection, because risk analysis and documented measures help demonstrate the adequacy required by Art. 32 of the GDPR;
• Transform security as a continuous process , with roles, periodic audits, and constant improvement, instead of a series of occasional interventions.

What the certification is not

To avoid wrong expectations, it is useful to clarify three points. ISO 27001 is voluntary : no law mandates it for professional firms. It is not a GDPR certification and does not replace privacy obligations, even if it supports them. It does not guarantee that an incident will never happen : attests that the firm has a system to prevent, detect, and manage risks in a controlled manner and improve it over time.

IT infrastructure adjustment: a practical path towards compliance

The path to certification includes both the definition of processes and policies, managed by specialized ISO consultants, and the adaptation of the IT infrastructure. It is precisely on the IT side that Lanpartners intervenes, which is also ISO/IEC 27001:2022 certified : we work alongside the ISO consultant chosen by the firm to verify the technical aspects, adapt the systems, and provide the required evidence, operating both remotely and in the firm's offices in Milan for all field checks.

The typical phases are these:

1. Definition of the scope : which locations, processes, systems, and people are included in the management system. For a firm, it can be the entire organization or, initially, the most critical activities.
2. Gap analysis : comparison between the current situation and the standard's requirements, to understand what already exists, what is missing, and how much work is needed.
3. Risk analysis and treatment : identification of threats to the firm's information, assessment of their likelihood and impact with the technical support of Lanpartners for IT risks, selection of controls, and drafting of the Statement of Applicability by the ISO consultant.
4. Technical and organizational measures : adaptation of the IT infrastructure and preparation of technical evidence by Lanpartners, supported by the drafting of policies and procedures and staff training provided by the ISO consultant.
5. Internal audit and management review : verify that the system actually works before presenting it to the external body.
6. Certification audit : carried out by an accredited body, usually in two phases, one documentary and one on-site.

On a technical level, the areas in firms that most often require intervention are the following:

We have explored many of these topics in dedicated articles: the operational continuity and backup , the incident response in the first 24 hours and the three-year planning described in our IT Roadmap for law firms . The overall timeline depends on the size of the firm and the starting point: this is why the initial gap analysis is the step that allows for realistic estimates.

Data security for notaries, lawyers, and accounting firms in Milan

From our Milan office, we work every day with law firms, notary offices, and accounting firms. It is an experience that has taught us one thing: the three profiles share the obligation of confidentiality, but they handle different information and face different risks, and an effective ISO 27001 system must start precisely from these differences.

Law firms

Lawyers are bound by professional secrecy , also protected criminally by art. 622 of the Penal Code. Deeds, opinions, correspondence with clients, and documents regarding litigation or extraordinary transactions are information of the highest value, even for those seeking them for extortion purposes. Added to this is the risk linked to the ungoverned use of artificial intelligence tools, which we analyzed when talking about Shadow AI in law firms .

Notary offices

The notary preserves deeds and documents intended to last over time and works in close contact with public registries and telematic procedures. For a notary office, the priority is integrity and availability of digital archives , in addition to the protection of the parties' personal and financial data. Verified backups, access control, and traceability of operations are central controls in an ISO 27001 system.

Accounting firms

Accountants and tax consultants manage accounting, tax, and asset data of businesses and families, often with delegated access to public administration platforms and management software shared with clients. The credentials and data flows to the outside are therefore the most sensitive points, along with email, a typical channel for fraud based on IBAN substitution and fake documents.

On-site support for Milan offices

In Milan, many firms assist banks, insurance companies, and large industrial groups, which are subject to the DORA regulation and other European regulations on digital resilience. For this reason, they are often the first to receive security questionnaires and requests for guarantees from clients. For over twenty years, we have been supporting them with managed IT services and of cybersecurity , and on the path towards ISO 27001 we work in synergy with the firm's ISO consultant: we carry out on-site technical inspections, verify the network and data protection infrastructure, and provide all the necessary IT support, up to being present during the certification audit for technical aspects.

Indirect NIS2 and supply chain: why large clients will demand higher standards

What NIS2 provides for in Italy

the Directive (EU) 2022/2555 , known as NIS2 , was implemented in Italy with the Legislative Decree September 4, 2024, no. 138 , in force from October 16, 2024, which identifies the National Cybersecurity Agency (ACN) as the competent authority. For entities included in the NIS list in 2025, the obligation to notify incidents is operational from January 2026 and the basic security measures must be made operational by October 31, 2026 ; after that date the ACN can initiate audits and inspections. For those who entered the list in 2026, the deadlines are January 1, 2027 for notifications and July 31, 2027 for measures. The notification of a significant incident to CSIRT Italia follows three stages: a pre-notification within 24 hours from when it becomes known, a notification within 72 hours and a final report within one month . We introduced the directive in our article on NIS2 and the digital security of companies .

Why it also concerns professional firms

In most cases, professional firms are not NIS subjects. However, many of their clients are: companies in the energy, healthcare, transport, banking, manufacturing, and digital sectors, above certain size thresholds. Among the measures required of these subjects is the supply chain security , that is, the management of risks related to suppliers and service providers. With ACN Determination no. 127437/2026, NIS entities must communicate the list of their relevant suppliers to the Agency every year: although a professional firm does not normally fall into the latter category, general supply chain security requirements still lead NIS clients to request guarantees from their consultants.

In practice, NIS entities must map their suppliers, assess their security level, define proportionate requirements, and translate them into contractual clauses, with audit rights and incident notification obligations. A firm that accesses a client's systems or processes their confidential information may fall under this assessment: it is therefore reasonable to expect that more and more clients will ask their consultants for security questionnaires, documentary evidence, and specific contractual clauses.

The role of ISO 27001

NIS2 does not mandate ISO 27001 certification, neither for obligated entities nor for their suppliers, and certification does not replace the requirements set out by the decree. However, many topics coincide: risk analysis, incident management, business continuity, access control, supplier security. For this reason, a accredited ISO 27001 certificate is one of the most recognized ways a supplier can demonstrate to a NIS-subject client that they manage security in a structured manner, and it can simplify the audits that the client is required to perform.

Book a feasibility study for certification: make your firm a model of security

Before starting the process, it is useful to understand the state of the IT infrastructure. With a IT feasibility study we analyze your technological infrastructure and your clients' needs, including an on-site visit if you are located in Milan, to define:

• The most suitable perimeter for certification;
• The main technical gaps regarding the IT controls of ISO/IEC 27001:2022;
• The necessary technological adjustment interventions, with their relative priorities;
• A realistic estimate of time and resources.

The certification is then issued by an independent accredited body, while organizational and procedural consulting is entrusted to the ISO consultant chosen by the firm. Our role is to ensure that the IT infrastructure is robust, secure, and ready for the audit. Contact us to book the IT feasibility study and discover all our cybersecurity services .

FAQ: ISO 27001 certification for professional firms

What is ISO 27001 certification?

It is the certification, issued by an accredited body, which attests that an organization has adopted an information security management system compliant with the ISO/IEC 27001 standard. The edition in force is the 2022 one, with 93 reference controls in Annex A.

Is ISO 27001 mandatory for lawyers, notaries, and accountants?

No. It is a voluntary certification. However, it is increasingly requested in practice by clients such as banks, insurance companies, and large corporations, which must evaluate the security of their suppliers and consultants.

How long does ISO 27001 certification last?

The certificate is valid for three years. During the three-year period, the certification body conducts annual surveillance audits and, upon expiration, a renewal audit.

How much time is needed to obtain certification?

It depends on the size of the firm, the chosen scope, and the initial level of security. An initial gap analysis is the most reliable way to estimate the necessary time and interventions.

Does NIS2 apply to professional firms?

In most cases no, but it applies to many of their clients. Typically, a professional firm does not fall under the relevant suppliers as per ACN Det. 127437/2026, but NIS entities must still assess the risks of their supply chain and may therefore request guarantees, questionnaires, and contractual security clauses from their consultants.

Does ISO 27001 guarantee compliance with NIS2 or GDPR?

No. It does not replace the obligations provided for by Legislative Decree 138/2024 nor those of the GDPR. However, many requirements overlap, and a certified system helps to demonstrate that adequate and documented security measures have been adopted.

Who issues the certification and what is Lanpartners' role?

The certification is issued by an accredited third-party certification body, while the methodological and procedural part of the standard is handled by the firm's ISO consultant. Lanpartners, which is also ISO/IEC 27001:2022 certified, deals exclusively with the IT infrastructure: it performs the technical verification, adapts the IT systems, provides the IT evidence, and supports the firm and its consultant for the entire technological component.