ISO/IEC 27001
Vendor-neutral guidance for founders, CTOs, CISOs, and compliance owners on ISO/IEC 27001:2022 — what the standard is, who typically seeks certification, how the accredited audit cycle works, and how it differs from a SOC 2 report. Not legal advice. Does not determine your obligations. Does not start a clock. Does not issue a certificate.
What is ISO/IEC 27001?
ISO/IEC 27001:2022 is a voluntary ISMS standard. Clauses 4–10 are certifiable; Annex A lists 93 selectable controls across four themes. Not legal advice.
Who needs ISO 27001?
ISO 27001 is rarely a legal mandate. Buyer RFPs, EU markets, and sector pressure usually drive demand; SOC 2 may suffice for some US buyers. Not legal advice.
How do you get ISO 27001 certified?
A numbered path to ISO/IEC 27001:2022: scope the ISMS, assess risk, write the SoA, operate controls, then accredited Stage 1 and Stage 2. Not legal advice.
What is the ISO 27001 certification process?
Stage 1 reviews documentation and readiness; Stage 2 tests implementation and effectiveness. Only an IAF-MLA accredited body issues the certificate. Not legal advice.
What is an ISO 27001 readiness assessment?
An ISO 27001 readiness (gap) assessment is industry best practice, not a mandatory clause. It is not Stage 1 and not an accredited certificate. Not legal advice.
What are the ISO 27001 Annex A controls?
All 93 ISO/IEC 27001:2022 Annex A controls in four themes (37 / 8 / 14 / 34), and how the SoA selects the ones that apply.
What evidence does an ISO 27001 auditor request?
ISO 27001 auditors sample mandatory documented information (scope, policy, risk, SoA, audits, reviews, corrective actions) plus supporting operating records. Not legal advice.
How long does ISO 27001 certification take?
Typical ISO 27001 elapsed time is often several months to more than a year, driven by scope, maturity, and the Stage 1 to Stage 2 gap. Illustrative, not a guarantee.
How much does ISO 27001 cost?
ISO 27001 cost is certification-body fees plus internal time, tooling, consultants, and remediation. Figures here are typical and illustrative, not quotes. Not legal advice.
What is an ISO 27001 surveillance audit?
ISO 27001 surveillance audits usually sample the ISMS in years 1 and 2 of a three-year cycle. They are partial, not recertification. Not legal advice.
What is ISO 27001 recertification?
ISO 27001 recertification is the full reassessment before a typical three-year expiry. It is not surveillance and not a first-time Stage 1/2. Not legal advice.
How do you choose an ISO certification body?
Choose an IAF-MLA accredited ISO/IEC 27001 certification body and verify it in IAF CertSearch. This page ranks no one. Unaccredited certificates are a red flag.
Do you need both SOC 2 and ISO 27001?
Running SOC 2 and ISO 27001 together is a business decision driven by mixed buyers. Controls overlap; the report and the certificate do not. Not a requirement.
What are the best ISO 27001 certification bodies?
Major ISO/IEC 27001 certification bodies by stated criteria: ISO/IEC 17021-1 accreditation, IAF MLA, scope, sector fit. Not a ranking. Not legal advice.