You are closing an enterprise deal. The security team sends you a questionnaire. Two pages in, you hit: "Is your organization ISO 27001 certified?"
If the answer is no, some enterprise deals do not close. Here is what you need to know about getting certified - what it requires, how long it takes, and what the technical work actually involves.
What ISO 27001 Actually Is
ISO 27001 is an international standard for Information Security Management Systems (ISMS). It defines a framework for identifying, assessing, and managing information security risks across your organization.
The standard has two parts:
- •The management requirements (clauses 4–10): governance, risk assessment, objectives, leadership commitment, internal audit, management review
- •Annex A controls: 93 controls across 4 themes (Organizational, People, Physical, Technological) that you select based on your risk assessment
The key word in ISO 27001 is "management system." Certification is not just about having security controls - it is about having a documented, auditable process for managing security risks over time.
Certification vs SOC 2 - What Is the Difference?
This comes up constantly. Both are security certifications; both are requested by enterprise buyers.
ISO 27001 is an international standard with formal certification by an accredited registrar. Once certified, you have a certificate with your company name and a public registry listing. Certification is recognized globally.
SOC 2 is an audit standard specific to the United States. A SOC 2 report documents how an auditor assessed your controls. It is not a "certificate" - it is a report. SOC 2 is more common in US enterprise sales; ISO 27001 is more common in European and global enterprise deals.
For global B2B SaaS companies: ISO 27001 often unlocks more deals, especially in Europe, healthcare, and financial services. SOC 2 Type II is still commonly required by US buyers. Many mature companies hold both.
What Is Required: The High Level
ISO 27001 certification requires:
- •A documented ISMS scope: what systems, data, and business processes are in scope
- •A risk assessment methodology: how you identify and score risks
- •A risk register and risk treatment plan: what risks you have identified and what you are doing about them
- •A Statement of Applicability (SoA): which Annex A controls apply to you and why
- •Implemented controls with evidence: the controls you have selected must actually be in place
- •Policies and procedures: documented policies for all major areas (access control, change management, incident response, etc.)
- •Internal audit: at least one internal audit before your certification audit
- •Management review: a formal review by senior leadership of the ISMS performance
The certification audit has two stages:
- •Stage 1: Auditor reviews your documentation - is the ISMS design sound?
- •Stage 2: Auditor assesses implementation - are the controls actually in place?
The Technical Controls That Require Infrastructure Work
Most ISO 27001 controls are process-oriented (policies, procedures, reviews). But the Annex A technological controls require real infrastructure work.
Access control (A.8.2 – A.8.5)
- •Privileged access must be restricted and logged
- •All access must be based on business need
- •Access reviews must happen regularly (typically quarterly)
In practice: enforce MFA everywhere, implement IAM roles with least-privilege, set up automated access reviews, ensure admin access to production is behind a bastion with session logging.
Cryptography (A.8.24)
- •Encryption at rest and in transit must be documented
- •Key management policy required
In practice: enable encryption on all databases and storage, enforce TLS, document your KMS key management procedure.
Logging and monitoring (A.8.15 – A.8.16)
- •Security events must be logged
- •Logs must be protected from tampering
- •Anomalies must generate alerts
In practice: enable CloudTrail, VPC Flow Logs, and centralized logging. Set up alerts for privilege escalation, failed authentication, and configuration changes.
Vulnerability management (A.8.8)
- •Vulnerabilities in systems must be identified and remediated in a defined timeframe
In practice: run automated dependency scanning in your CI pipeline (Snyk, Dependabot), run infrastructure vulnerability scanning (AWS Inspector, Trivy for containers), and document your patching SLA.
Change management (A.8.32)
- •Changes to information systems must be controlled and documented
In practice: all changes go through pull requests with required reviewers. No manual changes to production without a ticket. This is the easiest control to demonstrate if you have a CI/CD pipeline.
Backup and recovery (A.8.13)
- •Backups must exist and must be tested
In practice: daily automated backups for all databases, documented and tested restore procedure, backup retention meeting your RPO requirements.
Timeline
A realistic ISO 27001 certification timeline for a startup with 10–50 employees:
Months 1–2: Gap assessment and documentation
- •Identify what controls you have and what you are missing
- •Write policies (information security policy, access control policy, incident response policy, etc.)
- •Conduct formal risk assessment and produce risk register
- •Write Statement of Applicability
Months 3–4: Control implementation
- •Close the technical gaps identified in the gap assessment
- •Implement missing processes (access reviews, change management, training program)
- •Collect evidence that controls are operating
Month 5: Internal audit
- •Conduct formal internal audit against the standard
- •Identify and remediate non-conformities before the certification audit
Month 6: Stage 1 + Stage 2 audit
- •Stage 1: documentation review (typically 1 day remote)
- •Stage 2: implementation assessment (2–3 days, on-site or remote)
- •Address minor non-conformities found
- •Receive certificate
Total: 6 months for a focused engagement. 12 months if you are doing it alongside normal product development with limited dedicated resources.
What It Costs
Certification costs have two components:
- •Registrar fees: the accredited certification body charges for the Stage 1 and Stage 2 audits. For a company under 50 employees, this is typically $8,000–$15,000 for initial certification and $4,000–$8,000/year for surveillance audits.
- •Implementation costs: the work to build the ISMS, write documentation, and implement missing controls. This varies significantly based on your starting point.
A startup with a modern cloud infrastructure (good logging, CI/CD in place, MFA enforced) typically has less infrastructure work and can focus on documentation. A startup with legacy infrastructure and manual processes has more work to do.
Is It Worth It?
If you are selling to enterprises in Europe, financial services, healthcare, or any regulated industry: yes, ISO 27001 is usually worth pursuing. It removes a consistent objection in the enterprise sales process and signals security maturity to large buyers.
If your buyers are primarily US SMBs, SOC 2 is often more relevant and can be completed in a similar timeframe.
We have taken multiple startups through ISO 27001 certification, handling both the technical infrastructure work and documentation. Book a free audit to get an honest assessment of your current gap and what it would take to close it.