.svg){kind=logo}
.png?width=300&name=iso%20(1).png)
desk.ly is certified to ISO/IEC 27001:2022. What is behind the standard, and what does it mean for you in practice? This article explains both.
The most important questions at a glance
ISO 27001 is a recognised standard that sets out requirements for establishing and implementing information security management systems. These include policies, procedures, responsibilities, controls and resources for handling data securely within an organisation.
To obtain ISO 27001 certification, a company must demonstrate that it operates an information security management system (ISMS) that meets the requirements of the standard. An independent certification body verifies this in a multi-stage audit.
There is no general legal obligation to obtain ISO 27001 certification. Many companies still choose to get certified because customers, regulators or industry rules require a verifiable security standard.
Germany’s NIS2 Implementation Act has made the topic more relevant. Since 6 December 2025, around 29,500 organisations in Germany have been supervised by the Federal Office for Information Security (BSI), up from around 4,500 (BSI, 2025). Among other things, these companies must implement risk management measures that also cover their supply chain (Section 30 BSIG; Gesetz zur Umsetzung der NIS-2-Richtlinie, 2025). As a result, they scrutinise their software providers more closely. An ISO 27001-certified provider makes this review easier, but does not replace a company’s own NIS2 obligations.
ISO 27001 certification enables companies and organisations to reduce their information security risks effectively. The information security management system (ISMS) helps them fully meet security requirements and build a strong security culture.
ISO 27001 certification is valid for three years. During this period, the information security management system (ISMS) must be managed and maintained. The certification body carries out annual surveillance audits: the first within one year and the second in the following year. A recertification audit must be completed before the three years expire.
What does ISO 27001 certification mean?
ISO 27001 is a globally recognised standard for information security management. Companies certified to this standard have a robust information security management system, or ISMS, that has been rigorously examined by an independent auditor. It documents all measures, such as security policies, access controls and processes for the secure handling of data. Certification does not cover a single feature but the management system behind it. At desk.ly, the scope explicitly covers the provision and development of the cloud application for managing and organising office resources.
Why ISO 27001 certification?
Thanks to ISO 27001 certification, an independent body has examined how we handle data in our workplace management software. Confidentiality, integrity and availability of data are the protection goals our management system is measured against. We were certified by Proks Certification GmbH, certificate number DE-IS-20240082. This gives our users confidence in how their data is processed and makes implementation easier.
ISO 27001 certification supports compliance
Companies’ own data protection requirements often place high demands on software solutions. This applies in particular to large companies and to those that are part of critical infrastructure (KRITIS), fall under the NIS2 Implementation Act or are ISO 27001 certified themselves. They must ensure that the providers they work with also meet appropriate security standards.
Start your journey into the future of hybrid work with desk.ly
ISO 27001 certification makes software roll-out easier
Checking lots of individual aspects can make rolling out a new tool rather complicated. With an ISO 27001-certified provider, the requirements are usually covered. With desk.ly, companies have this in writing and can save a lot of time reviewing our standards when implementing our desk booking software.
“ISO 27001 certification shows that we ensure the integrity, confidentiality and availability of the data we work with.”
How we met the requirements of ISO 27001 certification
Individual risk analysis
Our experts examined potential security gaps in depth and developed processes to identify and prevent them.
Strict security policies
We have established internal security policies and procedures that protect your sensitive data. This includes access controls and high encryption standards for our software.
Compliance is a team effort
Everyone in the team has committed to complying with these security policies. This includes thorough training and awareness-raising on information security for every team member. All employees understand how important data protection is and play their part.
desk.ly has been certified to ISO/IEC 27001:2022 since March 2024. Since then, annual surveillance audits have checked that the management system holds up in day-to-day practice.
"desk.ly is certified to the current 2022 version of ISO 27001. Regular monitoring and audits ensure that we continuously improve our security measures."
— Amir El Sayed, Co-Founder of desk.ly
Beyond ISO 27001: what else we do for data protection
Certification is, of course, not all we do to handle sensitive data securely. desk.ly is also GDPR-compliant, developed in Germany – in Osnabrück, to be precise – and hosted in Germany. Find out more about data protection at desk.ly on this page.
References
Bundesamt für Sicherheit in der Informationstechnik. (2025, December 5). Cybersicherheitsrecht: NIS-2-Umsetzungsgesetz ab morgen in Kraft [Cybersecurity law: NIS-2 Implementation Act enters into force tomorrow] [Press release]. https://www.bsi.bund.de/DE/Service-Navi/Presse/Pressemitteilungen/Presse2025/251205_NIS-2-Umsetzungsgesetz_in_Kraft.html
Gesetz zur Umsetzung der NIS-2-Richtlinie und zur Regelung wesentlicher Grundzüge des Informationssicherheitsmanagements in der Bundesverwaltung [Act implementing the NIS 2 Directive and regulating essential principles of information security management in the federal administration]. (2025, December 5). Bundesgesetzblatt, 2025 I(301). https://www.recht.bund.de/eli/bund/bgbl-1/2025/301
Last updated on 4 November 2026.
