What Is ISO 27001? The ISMS Standard Explained: Mongolia
Published
ISO 27001 certification is an independent audit result showing that an organisation’s information security management system meets ISO/IEC 27001. Certification is voluntary under the standard. A bank in Mongolia earns it by passing two audit stages run by a certification body.
What is ISO 27001?
ISO 27001 is an international standard for an information security management system (ISMS). An ISMS is a set of policies, risk checks and controls that protect information. The standard checks the management system, not individual products or IT tools. The ISO 27001 requirements apply to any organisation.
What does an ISMS cover in a Bank in Mongolia?
A Mongolian bank’s ISMS covers five areas that an auditor checks closely:
● Risk assessment: The bank lists threats to its information and scores them. An auditor traces one risk from the register to a control to evidence.
● Statement of Applicability: This document lists which controls apply and why. An auditor checks that it matches real practice.
● Annex A controls: Annex A is a list of possible security measures. The ISO 27001 Annex A controls fall into four themes: organisational, people, physical and technological.
● Supplier and outsourcing control: Banks depend on vendors. An auditor asks how each outsourced service is checked.
● Incident management: The bank records, handles and learns from incidents. An auditor reads the incident log.
Is ISO 27001 Mandatory for Banks in Mongolia?
No. ISO 27001 for banks is voluntary under the standard. Regulators, partners, card schemes or customers may still ask for it, so check what your counterparties expect. Legal duties in Mongolia apply whether or not a bank is certified (VERIFY with the Bank of Mongolia and the Financial Regulatory Commission).
Does ISO 27001 Replace Bank of Mongolia Requirements?
ISO 27001 certification is not a regulatory approval or licence. It does not replace any legal or regulator requirement in Mongolia. A certificate doesn’t prove that a bank meets every Mongolian obligation, including cyber security or personal data rules.
Key takeaway: Certification is optional and separate from regulation. Meet your legal duties first, then use the standard to manage them.
How does ISO 27001 Certification Work?
ISO 27001 certification Mongolia follows the same steps as anywhere else. The bank builds its own system. The certification body only audits it.
Define the scope.
Assess risks.
Choose controls and write the Statement of Applicability.
Run the ISMS and keep records.
Hold an internal audit.
Hold a management review.
Stage 1: the auditor reviews documents and readiness.
Stage 2: the ISO 27001 audit checks that the system works in practice.
Certificate decision.
Surveillance audits each year.
Recertification, usually every three years.
What do Banks Often get Wrong About ISO 27001?
● Treating it as an IT-only project.
● Copying policies that don’t match daily work.
● Rushing the risk assessment.
● Writing a Statement of Applicability that doesn’t match real controls.
● Choosing a certification body without checking that it is an accredited certification body.
Example: a policy says access is reviewed quarterly, but staff can’t show one review record.
Key takeaway: Auditors trust records, not documents. Write only what your teams actually do.
Is your Bank Ready for ISO 27001 Certification? A quick Checklist
● Scope agreed by top management
● Risk register current
● Statement of Applicability approved
● Supplier risks reviewed
● Incident log kept
● Internal audit done
● Management review recorded
● Staff trained
Need help getting certified?
Talk to a SIS Certifications specialist about the standards covered in this blog.
Get My Free Quote →