The short answer
ISO 27001 gives a biotech or life-science startup independent proof that it manages the security of research data and IP. A focused project typically takes 4 to 8 weeks, not a year, and the audit itself can be quick: Orbion, a Berlin startup that builds AI models for protein engineering, received its UKAS-accredited certificate 39 days after its Stage 1 audit, with zero non-conformities at Stage 2.
It's the same standard SaaS companies use. What changes in biotech is what you protect: sequences, assay results, models, partner IP and sometimes patient or genetic data. And partners often mention other frameworks in the same breath, such as GDPR and GxP. This guide covers each.
Talk to a founder about your ISO route · Read the Orbion case study
Why biotech partners ask for ISO 27001
Biotech startups get data that took their partners years to produce. A pharma or biotech partner sharing protein sequences or experimental results wants to know who can see them, where they're stored and what happens if something goes wrong.
Orbion's co-founder put it this way in Tempo Audits' case study:
"Our customers and partners entrust us with sensitive research data and valuable intellectual property. We wanted an independent, recognised standard to demonstrate how we protect that information."
Aniruddh Goteti, Co-Founder, Orbion
ISO 27001 answers that with a certificate from an accredited certification body, which a partner's procurement team can check on UKAS CertCheck or IAF CertSearch. It won't stop the questions: partners still send security questionnaires. But many answers can then point to policies and evidence an independent auditor has reviewed.
What to put in scope
Scope is the first real decision, and the biggest lever on audit days and cost. Start from what partners buy and the data they send you, not from the whole company.
- The platform and its data. Orbion's certificate covers the people, processes, systems, vendors, facilities and information assets that run its protein engineering SaaS platform, production APIs, ML compute workflows, customer support and supporting business operations (Tempo Audits).
- Compute and other suppliers. GPU and cloud providers that process partner data are suppliers you assess and list. Orbion's Trust Center lists 8 subprocessors.
- The lab, if it holds the data. ISO 27001 protects information, not lab processes. If instruments, electronic lab notebooks or a LIMS store in-scope data, include them. If the lab never touches it, leave it out.
- Physical security, even in a remote audit. The Stage 2 auditor checks the controls in practice. Orbion's remote Stage 2 covered physical security too.
What partners ask, and what they accept
Questions life-science buyers often ask, and what usually satisfies them.
| What they ask | What they accept |
|---|---|
| "Are you ISO 27001 certified?" | A certificate from an accredited certification body, with a scope that covers what they buy |
| "Is a UK certificate valid for us?" | Yes, if it's accredited: UKAS and DAkkS both signed the EA agreement that treats their accreditation as equivalent |
| "How do you protect our data and IP?" | Your policies, such as data classification, access control and encryption, plus evidence that you follow them |
| "Who else touches our data?" | A subprocessor list that says what each one does |
| "Can we see your documents?" | A Trust Center where they request policies and certificates, with an NDA if you need one |
| "Do you have a recent pen test?" | A penetration test report for the product they use |
| "Do you process patient or genetic data?" | Your GDPR role (controller or processor), the legal basis and Article 9 condition where you're the controller, and a data processing agreement |
| "Is your system validated for GxP?" | Only relevant if your software is part of their GxP-regulated work, such as GMP under Annex 11 or FDA records under Part 11. That's validation documentation, not ISO 27001 |
Orbion answers the document questions in its Trust Center: its ISO 27001 status, 33 policy titles and 8 subprocessors are public, and partners request the certificate, policy PDFs and other documents, which Orbion reviews.
ISO 27001, GDPR and GxP: what each one covers
Life-science founders often hear these together. They answer different questions.
| Framework | What it covers | What you get |
|---|---|---|
| ISO 27001 | How you manage information security: risks, controls and evidence | A certificate from an accredited certification body, valid for three years with yearly audits |
| GDPR | Personal data, including health and genetic data as special category data | No certificate buyers usually ask for: records, policies, data processing agreements and, often, impact assessments |
| EU GMP Annex 11, FDA 21 CFR Part 11 | Computerised systems and electronic records used in GMP or FDA-regulated work | Validation documentation, not a certificate |
| SOC 2 | Security controls examined by a CPA firm, asked for mostly by US buyers | A SOC 2 report, not a certificate |
Two details matter for biotech:
- Genetic data isn't always personal data. The ICO notes that a sample isn't personal data until you analyse it, and genetic results count as personal data only if you can link them to an identifiable person. But results linked to a specific sample, or detailed enough to be unique to a person, are usually personal data even with names removed. Check what you actually hold before you scope your GDPR work.
- ISO 27001 doesn't validate your system. Annex 11 says applications used in GMP work should be validated. ISO 27001 controls such as access control, logging and backups help, but validation is a separate project.
Orbion: what the audit looked like
Founded in 2025, Berlin-based Orbion builds AI models that predict protein expression, stability and developability, and works with biotech companies and academic researchers. Its team adapted the Kantis draft policies to its biotech work, implemented the controls and prepared the evidence. Tempo Audits, a UKAS-accredited certification body, ran the audit.
- Booking: both audit stages booked within 8 days of Orbion's first call with Tempo.
- Stage 1, 16 July 2026: a review of policies and documents. The report came the next day with five opportunities for improvement.
- Stage 2, 17-18 August 2026: controls and evidence in detail, including physical security. Zero non-conformities.
- Certificate, 24 August 2026: ISO/IEC 27001:2022, 6 days after Stage 2 and 39 days after Stage 1.
- How: a remote audit, with the auditor reviewing documents and evidence in Kantis.
Its certification now shows on Orbion's website and Trust Center. Read the Orbion case study.
How a biotech startup gets there
- Ask what the partner needs, and by when. ISO 27001, a SOC 2 report, a questionnaire or GxP validation are different jobs. Ask whether "in progress" is enough for now. In our experience, it often is.
- Set the scope around the data. The platform, the data partners send and the systems that touch it.
- Name one owner and budget the time. Orbion's team did substantial hands-on work. Even with a platform and support, someone has to make decisions and run the controls.
- Book the certification body early. Good ones fill up. Orbion's first call with Tempo was on 22 June and its Stage 1 audit on 16 July. In our experience, the biggest names are busier and can stretch the project to three or four months.
- Collect evidence as you go, not the week before Stage 2.
- Give partners one place to look. A Trust Center with your certificate, policies and subprocessors answers many questions before they're asked.
For the full process from scope to certificate, read our ISO 27001 for startups guide. For the budget, line by line, read the ISO 27001 cost guide.
Where Kantis fits
Kantis combines the software with hands-on support: the gap assessment, draft policies you adapt to how your team actually works, evidence collection, the internal audit, coordination with your certification body and a Trust Center for your partners. The certification body runs the audit and issues the certificate.
Talk to a founder about your ISO route and you'll leave with your scope, what your partners will ask for and the fastest credible route to the certificate. Calls are in English.