ISO 27001 is not a legal requirement, but in many industries and for certain customer requirements it is often necessary to create trust and business opportunities.