What is ISO 27001?
ISO 27001 is the international standard for information security management systems (ISMS). It specifies how an organization should establish, implement, maintain, and continually improve the system that protects its information assets. Certification is granted by an accredited certification body after an independent audit.
The short version: ISO 27001 is proof that your company has a structured, documented, and audited approach to information security.
What Does ISO 27001 Cover?
ISO 27001 is organized around two components:
The ISMS clauses (Clauses 4 to 10) define the management framework: leadership commitment, risk assessment, planning, support, operational controls, performance evaluation, and continual improvement. These clauses are mandatory.
Annex A controls are a reference set of 93 controls across four themes: Organizational, People, Physical, and Technological. You do not need to implement all 93. You select controls based on a risk assessment and document why you included or excluded each in a Statement of Applicability (SoA).
A worked example
A startup selling into the EU runs a risk assessment and finds that supplier relationships are its weakest area, since it relies on several subprocessors. It selects the relevant Annex A supplier-security controls, writes a vendor risk policy, and documents why it excluded controls that do not apply, like physical media handling for a company with no on-prem hardware. That reasoning goes into the Statement of Applicability an auditor reviews first.
A common mistake
The most common mistake is writing the ISMS documentation without actually running it. A risk register that exists as a one-time document, never revisited, will not survive a surveillance audit. ISO 27001 certification lasts three years, but it comes with annual surveillance audits that check whether the ISMS is a living process, not paperwork produced once for Stage 1.
ISO 27001 vs SOC 2
These two frameworks are often compared because they both address information security. The key differences:
| ISO 27001 | SOC 2 | |
|---|---|---|
| Origin | International (ISO/IEC) | United States (AICPA) |
| Buyers who require it | European buyers, global enterprise | US enterprise buyers |
| Structure | Risk-based ISMS framework | Trust Services Criteria |
| Audit output | Certificate (3-year + surveillance) | Point-in-time or period report |
| Audit frequency | Surveillance audits every 12 months | Annual renewal |
| Scope | Entire ISMS | Defined system scope |
If you sell into Europe, ISO 27001 is often required. If you sell primarily in the US, SOC 2 is more common. Many companies pursue both.
How Long Does ISO 27001 Take?
Building an ISMS that meets ISO 27001 requirements typically takes four to nine months for a startup. The certification audit itself adds another one to three months. Total timeline from starting your program to holding the certificate: six to twelve months.
Tooling can help map your existing controls to Annex A, but the Statement of Applicability still needs a person to decide and justify every inclusion and exclusion.
Who Grants ISO 27001 Certification?
ISO 27001 certification is issued by accredited certification bodies (CBs), such as BSI, Bureau Veritas, SGS, or LRQA. The certification body must itself be accredited by a national accreditation authority (such as UKAS in the UK or DAkkS in Germany).
The certificate is valid for three years, with mandatory surveillance audits at twelve months and twenty-four months to confirm you are maintaining the ISMS.
How it maps to an audit
Certification happens in two stages. Stage 1 is a documentation review: does the ISMS exist and cover the right scope. Stage 2 tests whether the controls in the Statement of Applicability are actually operating, similar to how a SOC 2 auditor tests evidence. An accredited certification body issues the certificate, valid for three years with surveillance audits at year one and year two.
The Annex A Control Themes
The 2022 update (ISO 27001:2022) reorganized controls into four themes:
- Organizational controls (37) - Policies, roles, supplier relationships, information classification, incident management
- People controls (8) - Screening, onboarding, awareness, remote working
- Physical controls (14) - Physical security, equipment protection, media handling
- Technological controls (34) - Access control, encryption, logging, vulnerability management, data protection
Related: ISO 27001 readiness, SOC 2 vs ISO 27001 comparison, ISO 27001 Statement of Applicability, and ISO 27001 checklist for SaaS startups.
Frequently Asked Questions
Do I need ISO 27001 if I already have SOC 2? Not necessarily, but many global customers prefer ISO 27001 because it is internationally recognized. If you sell into Europe or APAC, it is worth pursuing alongside SOC 2.
Is ISO 27001 harder than SOC 2? They are different in scope and structure. ISO 27001 requires a formal ISMS with documented risk management processes, which can be more demanding than SOC 2 for teams without a security program. Someone who has built an ISMS before closes that gap faster.
How much does ISO 27001 certification cost? Certification body fees typically range from $15,000 to $40,000 depending on your size and scope. Add in consulting and tooling, and total program costs are similar to a SOC 2 Type II.
Can I use the same controls for ISO 27001 and SOC 2? Yes. There is significant overlap between the two frameworks. A compliance platform can map a single control to both frameworks so you collect evidence once and satisfy both audits.