We often encounter projects where a mobile app is already running, but the client wants an ISO 27001 certificate to enter international markets or meet tender requirements. The standard requires not only technical measures but also building an Information Security Management System (ISMS). Without this system, the audit can't be passed. Recently, we helped an EU fintech startup achieve certification in 6 months: the main problems were secrets management and risk documentation. We completely rewrote the CI/CD, implemented GitLeaks and MobSF, and prepared the SoA from scratch. The client passed the audit on the first attempt.
ISO 27001 is an international standard that, unlike GDPR or HIPAA, is not tied to a specific data type or jurisdiction. It's a management system that needs to be documented and audited by an accredited body. Our experience shows that most problems arise at the documentation stage, not with technical controls. For example, documentation preparation takes up to 60% of the total project time. For an accurate assessment of your project, contact us.
For a mobile app, ISO 27001 means that all development, deployment, and operations processes are embedded in the organization's ISMS. Technical controls are only part of the requirements. We help companies go through this path from gap analysis to certification. In 5 years on the market, we have completed over 20 mobile app security projects.
Why is ISO 27001 important for a mobile app?
The certificate confirms that development processes are protected to world standards. This is necessary for working with financial institutions, medical data, or government contracts. Without ISO 27001, many clients simply won't consider the product. A certified app gains 3 times more customer trust compared to non-certified ones.
How to ensure mobile app compliance with ISO 27001
We split the work into two blocks: technical controls and ISMS documentation. Here are the main technical measures.
Secrets management (control A.8.9)
Hardcoded API keys in code are a common finding during audits. Secrets must never enter the repository:
// Incorrect — violates A.8.9 val apiKey = "sk-prod-abc123xyz" // Correct — via BuildConfig from CI/CD secrets val apiKey = BuildConfig.API_KEY // Even better — the key is obtained from the server upon authentication val apiKey = tokenManager.getApiKey() For iOS we use xcconfig files that are not committed. We add GitLeaks to the pre-commit hook and CI pipeline. According to ISO 27001, control A.8.9, secrets must be stored separately from source code and transmitted through secure channels.
Cryptographic key management (control A.8.24)
The standard requires a documented policy: rotation period, procedure, storage. For a mobile app:
- TLS certificates: rotation 30 days before expiry, certificate pinning updated via OTA config.
- Signing keys: stored in HSM or cloud key management (AWS KMS, Google Cloud KMS).
- Encryption keys for local data: in Android Keystore or iOS Secure Enclave.
Vulnerability Management (controls A.8.7, A.8.8)
A documented process with evidence:
- SAST — static analysis on every PR (MobSF in CI, Semgrep custom rules).
- Dependency scanning — Dependabot or OWASP Dependency-Check.
- Pentest — annually or after major changes. Report kept for the auditor.
- SLA for remediation: critical — one day, high — one week, medium — one month.
Secure SDLC (control A.5.8)
Threat modeling (STRIDE) when designing new features, security requirements in acceptance criteria, code review for changes affecting authentication or encryption. All documented.
What documentation is needed for certification?
The auditor looks at documents, not code. Mandatory set:
| Document | Purpose | When prepared |
|---|---|---|
| Asset register | Source code, keys, production data | At project start |
| Risk register | Threat and impact assessment for each asset | After asset identification |
| Statement of Applicability (SoA) | Which controls are applied, exclusions | After risk register |
| Incident response plan | Procedure for breach or compromise | Before audit |
| Supplier security policy | Requirements for SDKs and cloud services | During ISMS documentation |
All documents are versioned and signed. Self-preparation takes twice as long and often contains errors — with us you go through this path faster.
Full list of controls checked by the auditor
- A.5.8 Secure SDLC
- A.5.9 Revalidation
- A.8.7 Vulnerability management
- A.8.8 Technical review
- A.8.9 Secrets management
- A.8.24 Key management
- A.12.1 Protection from malware
- A.12.6 Technical vulnerability management
Comparison: ISO 27001 vs self-assessment
| Parameter | ISO 27001 (certification) | Self-assessment |
|---|---|---|
| Customer trust | High (international recognition) | Medium (internal evaluation) |
| Effort | Full ISMS + audit | Gap analysis only technical measures |
| Timeline | 4–9 months | 1–2 months |
| Cost | from €5,000 to €15,000 | Lower, but no certificate |
Certification provides official confirmation that self-assessment does not. Savings on auditor fees with proper preparation can be up to 40%.
What is included in our work
We accompany the project from gap analysis to certificate receipt. Within the cooperation, you receive:
- Complete ISMS documentation (templates and filled documents for your project).
- CI/CD setup for secure secrets management.
- SAST and dependency scanning implementation.
- Audit preparation and support at all stages.
- Team training on ISMS processes.
- Post-certification support (annual audits).
Timeline and how to start
Approximate timelines:
- Gap analysis + roadmap: 1–2 weeks.
- Implementation of technical controls: 4–8 weeks.
- ISMS documentation: 2–4 months.
- Full cycle to certification: 4–9 months.
The cost is calculated individually — depends on the current security level and app complexity. Get a consultation on ISO 27001 certification for your mobile app. Contact us for a project assessment — we will help you go through the path to the certificate with minimal risks.
During mobile development under ISO 27001, we implement all necessary controls so that your app meets world security standards and gains the trust of clients and partners.