ISO 27001 certification for professional firms: protecting data and enhancing the firm

The competitive value of data security for professional firms

What is ISO/IEC 27001

the ISO/IEC 27001 is the international standard that defines the requirements for an information security management system (ISMS). The current edition is the ISO/IEC 27001:2022 : the transition period from the 2013 version ended on October 31, 2025, and from that date, certificates issued under the old edition are no longer valid.

The standard does not mandate a specific technology. Instead, it asks the firm to analyze the risks to which information is exposed and to choose, among the 93 controls of Annex A (organizational, people-related, physical, and technological), those necessary to reduce them, justifying the choices in a document called Statement of Applicability . The certification is issued by an accredited certification body, in Italy by Accredia , has a three-year validity and is subject to annual surveillance audits and a renewal audit upon expiration.

Why it is a choice factor today

The context explains why data security has become a business issue as well as a technical one. According to the Clusit Report 2026 , in 2025 there were 5,265 serious cyber incidents recorded worldwide, in 49% growth over the previous year; in Italy there were 507, with a 42% increase , equal to 9.6% of the world total, a share much higher than the country's economic weight.

For a professional firm, an incident does not just mean days of downtime: it means having to explain to clients that their confidential documents may have been exposed. An ISO 27001 certification addresses this concern in advance. Specifically, it can:

• Ssimplify client due diligence : many supplier security questionnaires ask if the organization is certified, and an accredited certificate is a verifiable answer;
• Rstrengthen the position in accreditations at banks, insurance companies, and large groups, which are also subject to stringent regulations such as the DORA regulation (EU Reg. 2022/2554) on digital operational resilience in the financial sector, requiring service providers to meet high standards of security and verifiability;
• Dstructure the firm's accountability in personal data protection, because risk analysis and documented measures help demonstrate the adequacy required by Art. 32 of the GDPR;
• Transform security as a continuous process , with roles, periodic audits, and constant improvement, instead of a series of occasional interventions.

What the certification is not

To avoid wrong expectations, it is useful to clarify three points. ISO 27001 is voluntary : no law mandates it for professional firms. It is not a GDPR certification and does not replace privacy obligations, even if it supports them. It does not guarantee that an incident will never happen : attests that the firm has a system to prevent, detect, and manage risks in a controlled manner and improve it over time.

IT infrastructure adjustment: a practical path towards compliance

The path to certification includes both the definition of processes and policies, managed by specialized ISO consultants, and the adaptation of the IT infrastructure. It is precisely on the IT side that Lanpartners intervenes, which is also ISO/IEC 27001:2022 certified : we work alongside the ISO consultant chosen by the firm to verify the technical aspects, adapt the systems, and provide the required evidence, operating both remotely and in the firm's offices in Milan for all field checks.

The typical phases are these:

1. Definition of the scope : which locations, processes, systems, and people are included in the management system. For a firm, it can be the entire organization or, initially, the most critical activities.
2. Gap analysis : comparison between the current situation and the standard's requirements, to understand what already exists, what is missing, and how much work is needed.
3. Risk analysis and treatment : identification of threats to the firm's information, assessment of their likelihood and impact with the technical support of Lanpartners for IT risks, selection of controls, and drafting of the Statement of Applicability by the ISO consultant.
4. Technical and organizational measures : adaptation of the IT infrastructure and preparation of technical evidence by Lanpartners, supported by the drafting of policies and procedures and staff training provided by the ISO consultant.
5. Internal audit and management review : verify that the system actually works before presenting it to the external body.
6. Certification audit : carried out by an accredited body, usually in two phases, one documentary and one on-site.

On a technical level, the areas in firms that most often require intervention are the following:

Area	What to check	Intervention examples
Identity and access	Who accesses what, with which credentials	Multi-factor authentication, role-based profiles, periodic access review
Backup and continuity	Whether data is actually recovered after a failure or an attack	Offsite and immutable copies, restoration tests, continuity plan
Devices and updates	Status of the firm's PCs, servers, and smartphones	Centralized management, regular patching, disk encryption
Mail and collaboration	Exposure to phishing and uncontrolled sharing	Mail protection, sharing rules, document classification
Monitoring and incidents	Ability to detect an attack and react	Log collection, response procedures, defined roles
Suppliers	Security of cloud, software, and external consultants	Supplier evaluation, security contract clauses

We have explored many of these topics in dedicated articles: the operational continuity and backup , the incident response in the first 24 hours and the three-year planning described in our IT Roadmap for law firms . The overall timeline depends on the size of the firm and the starting point: this is why the initial gap analysis is the step that allows for realistic estimates.

Data security for notaries, lawyers, and accounting firms in Milan

From our Milan office, we work every day with law firms, notary offices, and accounting firms. It is an experience that has taught us one thing: the three profiles share the obligation of confidentiality, but they handle different information and face different risks, and an effective ISO 27001 system must start precisely from these differences.

Law firms

Lawyers are bound by professional secrecy , also protected criminally by art. 622 of the Penal Code. Deeds, opinions, correspondence with clients, and documents regarding litigation or extraordinary transactions are information of the highest value, even for those seeking them for extortion purposes. Added to this is the risk linked to the ungoverned use of artificial intelligence tools, which we analyzed when talking about Shadow AI in law firms .

Notary offices

The notary preserves deeds and documents intended to last over time and works in close contact with public registries and telematic procedures. For a notary office, the priority is integrity and availability of digital archives , in addition to the protection of the parties' personal and financial data. Verified backups, access control, and traceability of operations are central controls in an ISO 27001 system.

Accounting firms

Accountants and tax consultants manage accounting, tax, and asset data of businesses and families, often with delegated access to public administration platforms and management software shared with clients. The credentials and data flows to the outside are therefore the most sensitive points, along with email, a typical channel for fraud based on IBAN substitution and fake documents.

On-site support for Milan offices

In Milan, many firms assist banks, insurance companies, and large industrial groups, which are subject to the DORA regulation and other European regulations on digital resilience. For this reason, they are often the first to receive security questionnaires and requests for guarantees from clients. For over twenty years, we have been supporting them with managed IT services and of cybersecurity , and on the path towards ISO 27001 we work in synergy with the firm's ISO consultant: we carry out on-site technical inspections, verify the network and data protection infrastructure, and provide all the necessary IT support, up to being present during the certification audit for technical aspects.

Indirect NIS2 and supply chain: why large clients will demand higher standards

What NIS2 provides for in Italy

the Directive (EU) 2022/2555 , known as NIS2 , was implemented in Italy with the Legislative Decree September 4, 2024, no. 138 , in force from October 16, 2024, which identifies the National Cybersecurity Agency (ACN) as the competent authority. For entities included in the NIS list in 2025, the obligation to notify incidents is operational from January 2026 and the basic security measures must be made operational by October 31, 2026 ; after that date the ACN can initiate audits and inspections. For those who entered the list in 2026, the deadlines are January 1, 2027 for notifications and July 31, 2027 for measures. The notification of a significant incident to CSIRT Italia follows three stages: a pre-notification within 24 hours from when it becomes known, a notification within 72 hours and a final report within one month . We introduced the directive in our article on NIS2 and the digital security of companies .

Why it also concerns professional firms

In most cases, professional firms are not NIS subjects. However, many of their clients are: companies in the energy, healthcare, transport, banking, manufacturing, and digital sectors, above certain size thresholds. Among the measures required of these subjects is the supply chain security , that is, the management of risks related to suppliers and service providers. With ACN Determination no. 127437/2026, NIS entities must communicate the list of their relevant suppliers to the Agency every year: although a professional firm does not normally fall into the latter category, general supply chain security requirements still lead NIS clients to request guarantees from their consultants.

In practice, NIS entities must map their suppliers, assess their security level, define proportionate requirements, and translate them into contractual clauses, with audit rights and incident notification obligations. A firm that accesses a client's systems or processes their confidential information may fall under this assessment: it is therefore reasonable to expect that more and more clients will ask their consultants for security questionnaires, documentary evidence, and specific contractual clauses.

The role of ISO 27001

NIS2 does not mandate ISO 27001 certification, neither for obligated entities nor for their suppliers, and certification does not replace the requirements set out by the decree. However, many topics coincide: risk analysis, incident management, business continuity, access control, supplier security. For this reason, a accredited ISO 27001 certificate is one of the most recognized ways a supplier can demonstrate to a NIS-subject client that they manage security in a structured manner, and it can simplify the audits that the client is required to perform.

Book a feasibility study for certification: make your firm a model of security

Before starting the process, it is useful to understand the state of the IT infrastructure. With a IT feasibility study we analyze your technological infrastructure and your clients' needs, including an on-site visit if you are located in Milan, to define:

• The most suitable perimeter for certification;
• The main technical gaps regarding the IT controls of ISO/IEC 27001:2022;
• The necessary technological adjustment interventions, with their relative priorities;
• A realistic estimate of time and resources.

The certification is then issued by an independent accredited body, while organizational and procedural consulting is entrusted to the ISO consultant chosen by the firm. Our role is to ensure that the IT infrastructure is robust, secure, and ready for the audit. Contact us to book the IT feasibility study and discover all our cybersecurity services .

Frequently asked questions

What is ISO 27001 certification and what does it attest for a professional firm?

ISO/IEC 27001 is the international standard that defines the requirements for an information security management system. The certification, issued by an accredited body, attests that the firm analyzes risks and adopts the necessary controls, chosen from the 93 in Annex A of the 2022 edition, justifying them in the Statement of Applicability.

Is ISO 27001 certification mandatory for lawyers, notaries, and accountants?

No, ISO 27001 is voluntary and no law mandates it for professional firms. However, it is increasingly requested in practice by banks, insurance companies, and large groups, which send security questionnaires to suppliers and consultants. A certificate issued by an accredited body is a verifiable response to these requests.

How long does ISO 27001 certification last and what periodic checks does it involve?

ISO 27001 certification is valid for three years. During this three-year period, the accredited certification body, which in Italy is accredited by Accredia, conducts annual surveillance audits. Upon expiration, a renewal audit is required. As of October 31, 2025, only certificates for the 2022 edition will be valid.

What are the steps to obtain ISO 27001 certification for a professional firm?

The process starts with defining the scope and conducting a gap analysis, which compares the current situation with the standard's requirements. This is followed by risk assessment and treatment, technical and organizational interventions, an internal audit with management review, and finally the certification audit, typically in two stages: a document review and an on-site audit.

Does ISO 27001 guarantee compliance with GDPR and NIS2 for a professional firm?

No, ISO 27001 is not a GDPR certification and does not replace the compliance requirements of Legislative Decree 138/2024 regarding NIS2. However, many requirements overlap, such as risk analysis and incident management. A certified system therefore helps to demonstrate adequate measures, for example with respect to Art. 32 of the GDPR.

Does the NIS2 apply to professional firms and why do clients ask for ISO 27001?

In most cases, professional firms are not subject to NIS, but many of their clients are, and they must manage supply chain security. They may therefore request questionnaires, evidence, and contractual clauses. An accredited ISO 27001 certificate is one of the most recognized ways to demonstrate structured security management.