← ComplianceCertification

The standard
the rest of
the world reads.

ISO 27001 at a glance
Issued by
An accredited certification body
Current version
ISO/IEC 27001:2022
Controls
93 in Annex A, across 4 themes
Audit stages
Stage 1 documentation, Stage 2 effectiveness
Cycle
3 years, with annual surveillance audits
What it actually is

ISO 27001, without the sales gloss.

ISO/IEC 27001 certifies that you run a working Information Security Management System — an ISMS. The distinction matters: SOC 2 reports on controls, ISO 27001 certifies the management system that decides, runs and improves those controls. Auditors are looking for a company that governs security deliberately, not one that bought some tools.

The 2022 revision reorganised Annex A into 93 controls across four themes — organisational, people, physical and technological. You are not required to implement all of them. You are required to justify, in a Statement of Applicability, which apply to you and why the rest do not. That document is the spine of the whole certification.

Certification is a three-year cycle. A Stage 1 audit checks your documentation is real and coherent. Stage 2 checks the system actually operates. After that, surveillance audits each year and a full recertification in year three.

When you need it

Any one of these is enough.

  • European, Middle Eastern or APAC buyers are asking for it by name
  • You are answering RFPs or public-sector tenders that mandate it
  • You already have SOC 2 and your international pipeline wants the equivalent
  • A parent company or major customer has pushed it down their supply chain
  • You want one certification recognised in every market you sell into
How long it takes

The route to ISO 27001.

Typical spans for a company starting from a normal engineering baseline. Your scoping call replaces these with real dates.

Weeks 1–3
Scope & gap
ISMS boundary defined, gap assessment against Annex A, risk methodology agreed.
Weeks 4–12
Build the ISMS
Risk assessment and treatment plan, Statement of Applicability, policies, and the controls themselves.
6–12 weeks
Operate
The system has to run and produce records before an auditor can certify it. We keep it running.
2–3 weeks
Internal audit & review
Mandatory internal audit and management review — both are clause requirements, both get checked.
4–8 weeks
Stage 1 & Stage 2
Certification body appointed and managed. Nonconformities triaged and closed. Certificate issued.
What lands in your hands

Deliverables, not a slide deck.

ISMS scope statement

The boundary, defended — the single most common place certifications go wrong.

Risk assessment & treatment plan

A repeatable methodology your team can run again next year without us.

Statement of Applicability

All 93 Annex A controls, each one included or excluded with a written justification.

Full document set

Policies, procedures and records against every mandatory clause from 4 through 10.

Internal audit & management review

Run and evidenced, because the certification body will ask for both.

Certification body management

Selection, scheduling, Stage 1 and Stage 2 attendance, nonconformity closure.

Packages

Three ways in.

Readiness
Scoped on the call
one-off

You need to know exactly how far you are, and what it will cost to close the gap.

  • Scoping workshop — systems, people and data in scope
  • Gap assessment against every applicable control
  • Written policy pack, tailored, not templated
  • Evidence map: what to collect, from where, how often
  • Remediation plan with owners and dates
  • Readout with your leadership team
Talk it through
Certification
Most chosen
Scoped on the call
to report

You have a deal, a customer or a board deadline and you need the report in hand.

  • Everything in Readiness
  • Hands-on control implementation with your engineers
  • Evidence collection run by us, not homework for your team
  • Auditor selection from our partner panel, plus fee negotiation
  • We sit in the audit and answer the auditor's questions
  • Findings triaged and closed through to clean report
Start here
Managed
$3,000
from · per month

You are certified and you want to stay that way without hiring a compliance team.

  • Everything in Certification
  • Continuous control monitoring and evidence capture
  • Annual surveillance audits and re-certification managed end to end
  • Vendor and sub-processor risk reviews
  • Security questionnaires and customer due-diligence answered for you
  • Named compliance lead on your Slack
Talk it through

Every engagement is quoted as two separate numbers: our fee, and the external auditor's fee. We negotiate theirs on your behalf and never bundle the two into one price.

ISO 27001 questions

Straight answers.

How long does ISO 27001 certification take?
Typically four to nine months from kickoff to certificate. The gating factor is rarely the paperwork — it is that an ISMS has to actually operate for a period and generate real records before a certification body can audit its effectiveness. Companies that already have SOC 2 usually move faster because much of the control work overlaps.
Can you certify us yourselves?
No. ISO 27001 certificates can only be issued by an accredited certification body, and a body that consulted on your ISMS is not permitted to certify it. That separation protects the value of your certificate. We do the consulting and manage the certification body; they do the audit.
We already have SOC 2. How much of it carries over?
A lot of the underlying control work does — access management, change control, logging, vendor management, incident response. What does not carry over is the management-system layer: the ISMS scope, risk methodology, Statement of Applicability, internal audit and management review. That is where our ISO engagements for SOC 2 companies concentrate.
Do we need to implement all 93 Annex A controls?
No. You need to consider all 93 and justify your decision on each in the Statement of Applicability. Excluding a control is completely legitimate when you have a defensible reason. Excluding one you clearly need, or excluding it with no reasoning, is what auditors write up.
What happens after we are certified?
The certificate runs three years, with a surveillance audit each year to confirm the ISMS is still operating, and a full recertification at the end of the cycle. Our Managed package covers those so you are not rebuilding evidence from scratch every twelve months.
Often needed alongside

Rarely just one framework.

Attestation report

SOC 2

The report North American enterprise buyers ask for before they sign. Type I proves your controls are designed right; Type II proves they actually ran.

SaaS and B2B software selling into US enterprise
SOC 2 in detailUS regulation

HIPAA

US law governing protected health information. There is no official HIPAA certificate — there is a compliance programme, and independent validation of it.

Health tech, and any vendor touching US patient data
HIPAA in detailEU regulation

GDPR

The EU's data protection regulation. It applies by where your users are, not where your company is — which catches more companies than expect it.

Anyone with users, customers or staff in the EU or UK
GDPR in detail

Get ISO 27001 scoped properly.

Thirty minutes, a founder on the line, and an honest read on scope, sequence and the date you can realistically promise your customer.

Book a scoping callcontact@binaryvlue.com