ISO 27001 matters for web3 data because it is an outside audit of the part of a vendor that a buyer cannot see: how the systems that produce and deliver a number are accessed, changed and protected. A certificate says that a certification body audited an organisation’s information security management system against ISO/IEC 27001:2022, within a scope the organisation defined. It does not say the number is right.
The gap between what a certificate covers and what buyers assume it covers is where most of its value and most of the confusion sits. This article explains what the standard is, how to read a certificate and which questions to put to a vendor that quotes one.
The part of a data vendor you cannot check from outside
You can compare one vendor’s number with another number. You cannot see who is allowed to change the pipeline that produces it, how a change is reviewed before it reaches production or what the vendor does at three in the morning when a source misbehaves. Those are properties of an organisation, not of a data point.
An ISO/IEC 27001 certificate adds an independent view. An external body examines the organisation’s own description of how it manages information security risk, then checks whether the organisation operates that way. For a vendor whose product is data, the risks that matter are easy to name: access to production systems, change control on the pipeline and handling of incidents. Whether a particular certificate reaches them depends on its scope, which is the opening question for any buyer.
What the standard is
ISO/IEC 27001 sets out the requirements an information security management system (ISMS) must meet. The current edition is ISO/IEC 27001:2022, published in October 2022. ISO describes conformity as having put in place a system to manage risks to the security of data an organisation owns or handles, with attention to people, policies and technology. A certification body’s guide makes the same point from the other side: an ISMS is a management system, not a technical product you install.
ISO does not issue certificates. Certification comes from an external certification body. Accredited bodies issue ISO 27001 certificates, which is why a buyer asks who the issuer is. National accreditation bodies such as UKAS in the United Kingdom accredit them, within an international framework of mutual recognition.
The 2022 edition replaced the 2013 edition. Certification bodies had until 31 October 2025 to finish transitioning certified clients. The International Accreditation Forum rules say that certificates based on the 2013 edition expire or are withdrawn at the end of that period. That date has passed. A certificate that still names the 2013 edition today deserves a direct question.
How the standard is organised
The main text has clauses 4 to 10. A certification body’s summary names them: context of the organisation, leadership, planning, support, operation, performance evaluation and improvement. Read in order, they describe a loop: understand the context, assess risk, run the controls, evaluate the result and correct what is wrong.
Annex A is a catalogue of controls. The 2022 edition lists 93 of them in four themes: organizational, people, physical and technological. The 2013 edition had 114 controls in 14 clauses.
An organisation does not apply all 93 by default. The standard takes a risk-based approach: the organisation selects the controls that fit its own risks and records the choice in a document called the Statement of Applicability. Two consequences follow for a buyer:
- Two certified organisations can run different sets of controls.
- The certificate alone tells you less than the Statement of Applicability behind it.
What an audit looks at in practice
The initial certification audit has two stages. Stage 1 assesses readiness, scope and the design of the ISMS. Stage 2 evaluates how effectively the ISMS is implemented and operating in practice. Stage 2 speaks to a buyer’s concern most directly, because it tests whether the organisation does what its own documents say.
For a data vendor, the controls worth looking for are the ones that map to the opening section: who can reach production systems, how a change to the pipeline is approved and recorded; how an incident is detected, handled and reviewed. Whether the vendor selected controls for these areas sits in the Statement of Applicability. The scope documents show which systems those controls apply to.
What a certificate does not say
It does not say the price is accurate. By ISO’s own description, conformity is about managing risks to the security of data. Nothing in that description is about how a figure is calculated. Which markets are read, at which moment, with what handling of outliers: those are methodology questions. How an on-chain price is measured is covered in how DEX-native price feeds work. The checklist for evaluating a data provider treats provenance as a separate question from security.
It does not set a service level. Nothing in ISO’s description of conformity is a promise about uptime or latency. Availability targets are a separate question, answered in contract terms.
It does not cover everything the vendor does. The organisation defines the scope before the audit. It can include or exclude functions, locations and systems. A change of scope adds or removes them. A certificate for one part of a company is not a statement about another part.
It is not a ranking. A certificate means a management system was audited. It does not place one vendor’s data above another’s.
A team that evaluates data can read the numbers themselves, for instance on the page of a feed such as BTC/USD with the method beside it. The certificate answers a different question: how the systems behind those numbers are run.
Six questions to ask about a certificate
Certificate databases such as the IAF’s exist but are not complete, so the check starts with a request for a copy of the certificate. Teams can then go through it line by line:
- What is the scope? Ask whether the systems that produce and deliver the data fall inside it, in those words.
- Which legal entity holds it? The certificate names an organisation and the sites it covers. Compare both with the party you would contract with.
- Who issued it? The issuer should be an accredited certification body, accredited by a member of the International Accreditation Forum.
- Which edition, valid until when? The edition should be ISO/IEC 27001:2022. Note the expiry date.
- Are surveillance audits happening? A certificate is valid for three years and kept alive by annual surveillance audits, with a full recertification audit every third year. Ask when the latest one took place.
- Which controls were selected? The Statement of Applicability shows them and the reasons for any that were left out.
Some of these answers may arrive under a non-disclosure agreement, because scope documents describe how a vendor runs its systems.
ISO 27001 and SOC 2
The two answer different questions. ISO/IEC 27001 is a standard for a management system, with certificates issued by a certification body. SOC 2 is an examination of a service organisation’s description of its system and the controls around it, set out by the AICPA. One is a certificate against a standard. The other is a report from an examination.
A vendor can hold one while the other is in progress. The useful questions are the same for both: what is covered, who performed the work and where the documents can be read.
How ML Data states its position
The trust page says ML Data is operated by Matrixedlabs Technologies - FZCO, whose information security management system is certified to ISO/IEC 27001:2022. The same page names the certificate holder, the certificate number, the certification body, the certified scope and the dates. For SOC 2, the page says: “A SOC 2 Type II examination is in progress with an independent audit firm.” That is a status, not yet a report.
The six questions above apply to that statement as they apply to any other. The trust page lists ISO/IEC 27001:2022 scoping documents, SOC 2 examination status, sub-processor lists and incident response procedures as available under NDA to qualified enterprise clients. Requests go through the contact page. For how a certificate sits next to licence terms in a purchase, see how crypto market data licensing works.
Sources
- ISO/IEC 27001:2022 - Information security management systems
- ISO - Conformity assessment
- IAF MD 26:2023 Issue 2, Transition Requirements for ISO/IEC 27001:2022
- UKAS Technical Bulletin, Transition arrangements for ISO/IEC 27001:2022
- TUV SUD, ISO/IEC 27001 Information security management system (white paper)
- BSI Knowledge, The 4 pillars of control
- SGS, ISO/IEC 27001 Transition: What You Should Know
- NQA, Your Complete Guide To ISO 27001
- NQA, ISO 27001 for Information Security
- AICPA and CIMA, SOC 2 Reporting on an Examination of Controls at a Service Organization
