ISO 27001 Compliance Guide

ISO/IEC 27001:2022 is the international standard for an Information Security Management System (ISMS). It defines the requirements for establishing, implementing, maintaining, and continually improving information security in an organisation. It is not legally required, but it is the most widely recognised international security certification — frequently demanded by enterprise buyers in Europe, Asia, the Middle East, and increasingly in North America. Common adopters: SaaS, cloud providers, MSPs, financial services, healthtech, government suppliers.

ISO 27001 is the certifiable standard — it specifies the requirements for an ISMS and is the document audited against. ISO 27002 is a guidance standard that provides implementation advice for the controls listed in ISO 27001 Annex A. You get certified to ISO 27001; you read ISO 27002 to learn how to implement the controls. The 2022 revision of ISO 27002 reorganised controls from 14 domains into 4 themes (organisational, people, physical, technological).

93 controls organised into 4 themes: A.5 Organisational (37 controls), A.6 People (8 controls), A.7 Physical (14 controls), and A.8 Technological (34 controls). The 2022 revision reduced the count from 114 in the 2013 version by merging similar controls and adding 11 new ones — including threat intelligence, cloud security, ICT readiness for business continuity, data masking, monitoring activities, web filtering, and secure coding.

The SoA is the cornerstone document of your ISMS. It lists every Annex A control, states whether you have implemented it (and how) or excluded it (with justification). Auditors reference your SoA continuously during fieldwork. The SoA must be tied to your risk treatment plan — every control inclusion or exclusion must be justified by the risk assessment.

Stage 1 is a documentation review where the certification body checks your ISMS design — scope, policies, SoA, risk assessment, internal audit, management review. Stage 2 is the certification audit proper: on-site (or remote) fieldwork where the auditor tests control implementation and evidence. There's typically 4–8 weeks between Stage 1 and Stage 2 to address minor findings. Pass Stage 2 and you get your certificate.

For a startup or small organisation starting from scratch: 9–12 months from kickoff to certificate. For an organisation with mature security practices (e.g. existing SOC 2): 6–9 months. For complex multi-site enterprises: 12–18 months. The slowest constraint is operational evidence — auditors expect to see at least 3 months of ISMS operation (records, internal audits, management reviews) before Stage 2.

For a small SaaS organisation: $30K–$80K total. Breakdown: certification body fees $15K–$35K (depends on org size and complexity), advisory/consulting $10K–$30K, internal labour 300–600 hours (the largest hidden cost). Annual surveillance audits in years 2 and 3 add roughly half the certification body fee per year. Recertification every 3 years costs roughly the same as initial certification.

ISO 27001 certificates are valid for 3 years. Annual surveillance audits in years 1 and 2 confirm your ISMS continues to operate effectively. A full recertification audit is required at the end of year 3. Skipping a surveillance audit or a major non-conformity can result in suspension or withdrawal of the certificate — so this is genuinely continuous, not a one-time achievement.

Depends on your buyers. If your prospects are mostly US-based enterprise SaaS buyers, start with SOC 2 — it is faster, cheaper, and the format US procurement teams expect. If your buyers are global enterprises, EU/UK organisations, or you operate in multiple jurisdictions, start with ISO 27001 — its global recognition matters more. Many companies eventually do both; ~80% of the control work overlaps and the certifications can share evidence.

Security Pulse covers the full ISMS lifecycle. RunWay implements the foundational programme: scope definition, risk assessment, SoA, policy library aligned to all 93 Annex A controls, internal audit programme. Autopilot then runs continuously: identity, endpoint, change management, monitoring, incident response, vendor risk, with an evidence vault that produces certification-body-ready exports. We support both initial certification and ongoing surveillance audits.