ISO 27001 is a voluntary international standard for an information security management system (ISMS). It is not generally legally mandatory in the UK or EU, but customers and tenders often require it as a condition of business. An accredited certification body can independently certify that your scoped ISMS meets the standard.
With bad actors targeting sensitive data, many organisations are looking for new ways to monitor and improve their data security — enter ISO/IEC 27001:2022. Earning certification is a useful way to establish credibility with stakeholders, customers and partners, but the real value is a working management system that makes security decisions repeatable.
Use this page as the map. It explains the standard and links to practical guides for startup scope, readiness, evidence, timelines, consultancy costs and the ISO 27001 versus SOC 2 decision. If you already know you need implementation support, see ISO 27001 implementation for startups.
On this page
Direct answer: ISO 27001 is an international standard for an information security management system (ISMS). It helps an organisation identify and treat security risk, operate proportionate controls and demonstrate that the system is independently certified against the standard.
The International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC) originally published ISO 27001 in October 2005, revised in 2013, and again in 2022. It focuses on building a strong information security management system (ISMS) within organisations.
As one of the most widely used security frameworks around the world, ISO 27001 is a risk-driven standard that focuses on data confidentiality, integrity, and availability. The standard aims to help organisations have a stronger, more holistic approach to data security.
ISO 27001 is an international ISMS standard often used as a framework for managing information security; certification is the independent assessment of an organisation's scoped ISMS against its requirements by an accredited certification body. You can implement the standard without obtaining a certificate.
No. ISO 27001 is not generally a legal requirement in the UK or EU, although a buyer or tender may make certification a contractual condition. Check the specific sector, customer and procurement requirements before deciding whether to certify.
Defines responsibilities and business processes for information security
Builds a culture of information security and diligence across the organisation
Reduces the potential for security incidents through implemented controls specific to your unique risks and assets
Meets additional security compliance requirements and satisfies customer due diligence
For a SaaS startup, certification should make the security of a defined service credible without pretending the entire company has the operating model of a multinational. Start with the product, its production environment, the people who develop and support it, and the information that customers entrust to it. A small scope is not a shortcut around risk: hosting providers, identity systems, support tooling and key suppliers still need to be understood where they affect the service.
At 10–50 people, founders and engineers often hold several control-owner roles. That is acceptable when responsibilities are explicit and conflicts are managed. A lightweight risk register, a clear access-review cadence, protected deployment pipeline, tested backup recovery and a supplier review process are more useful than dozens of policies no one follows. Keep evidence in the tools the team already uses, and assign a backup owner before the person with all the context goes on leave.
The common startup mistakes are certifying too much, buying a generic template pack, treating cloud-provider assurances as the whole control environment, and scheduling Stage 2 before controls have generated operating evidence. Our detailed ISO 27001 for startups guide explains a minimum viable scope and how to avoid those traps.
AI companies have the same ISMS requirements as other software businesses, but their risk context needs sharper questions. Document whether you are a developer, provider, deployer or user of each model; where prompts, training data and outputs flow; which suppliers process customer information; and how model changes are approved. ISO 27001 addresses confidentiality, integrity and availability, while model evaluation, human oversight and intended-use decisions may require additional AI governance.
Do not claim that ISO 27001 alone proves an AI system is safe or compliant with the EU AI Act. It can provide a disciplined security foundation. Teams considering an AI management system can also read how ISO 42001 builds on an existing ISMS.
ISO 27001 can help an AI company secure model inputs, outputs, infrastructure and supplier access through its ISMS, but it does not by itself establish EU AI Act compliance or address every AI-specific risk. Assess your role and each system's obligations separately, including applicable transition rules, and consider ISO 42001 for AI governance.
ISO 27001 isn't a legal requirement but may be a prerequisite to customers doing business with your organisation. Some industries are more likely to need ISO 27001 certification because of the type of data that companies store:
ISO 27001 and SOC 2 are two of the most popular cybersecurity assessments that verify an organisation's ability to mitigate risk and protect information. However, the two standards are not interchangeable.
| Dimension | ISO 27001 | SOC 2 |
|---|---|---|
| Output | Certification (issued by accredited CB, with IAF seal) | Attestation report (by licensed CPA firm) |
| Geographic reach | International standard, recognised globally | US-born; increasingly accepted globally |
| Framework | ISMS — pass/fail; all clauses and controls must be implemented | Five Trust Services Criteria; Security is mandatory, others optional |
| Renewal | Valid 3 years with annual surveillance audits | Valid 12 months; annual audit required |
| Report detail | One-page certificate | Detailed report with auditor opinion on each TSC |
Read our full ISO 27001 versus SOC 2 comparison for a buyer-led decision on overlap, order and US versus international demand. The SOC 2 guide covers the attestation route in more detail.
ISO 27001 provides a great foundation for ISO 42001, the newer standard for AI management systems. Here's how they differ:
Your organisation should take time to understand the standard, define goals, and research accredited certification bodies before jumping into an audit. Conducting a gap assessment to understand the state of your compliance journey is strongly recommended.
A credible assessment tests the boundary, risk method, policies, control operation and evidence — not just whether a document exists. See what to expect from an ISO 27001 readiness assessment before accepting a checklist or fixed quote.
Define the ISMS scope and buyer requirement, map assets and suppliers, review risks and the Statement of Applicability, then test whether policies and controls actually operate. Record evidence, owners and gaps, prioritise remediation, and use an independent internal audit and management review before seeking certification.
ProtectifyAI helps startup teams define a defensible scope, implement an ISMS and prepare evidence for an independent certification body.
Explore ISO 27001 implementation →A review of your organisation's scope, policies, procedures, and processes to identify any gaps in conformance that need remediation before the formal audit begins. Highly recommended for first-time certifications.
An auditor reviews your ISMS to confirm it has been established and implemented in conformance with ISO 27001. This audit checks whether mandatory ISMS activities have been completed and determines readiness for Stage 2.
Tests the conformance of your ISMS against the ISO 27001 standard. Any nonconformities identified must be remediated before a certificate can be issued.
For the two years following certification, annual surveillance audits ensure ongoing compliance with ISO 27001 standards. Typically commences approximately nine months after initial certification.
ISO 27001 certification is valid for three years. Organisations must recertify before the certificate's expiration date. Recertification audits review the entire management system, similar to the Stage 2 audit.
There is no universal “90-day ISO” route. A focused startup with mature cloud controls may reach Stage 1 in two to four months; a growing organisation with unclear ownership, legacy systems or several locations needs longer. Allow time for controls to operate and for the certification body to schedule both stages. Our week-by-week ISO 27001 timeline shows what should happen from kickoff to certificate.
Auditors look for a chain from risk to control to operation to review. Typical evidence includes an approved risk assessment and treatment plan; access review exports and joiner-mover-leaver tickets; secure development and code-review records; vulnerability scans and remediation decisions; backup restoration tests; supplier due diligence; incident records or exercises; security training completion; and minutes showing management reviewed ISMS performance.
Evidence should represent the actual scoped service. A policy dated the day before the audit does not demonstrate that a quarterly review happened. Keep exceptions and failed tests rather than deleting them: corrective action and follow-up often show that the management system is working. The existing guide Before you book your ISO 27001 audit demonstrates how to trace one control from risk to evidence.
Cost depends on the number of people, locations, systems, risk complexity, maturity and amount of implementation help required. It also includes certification-body audit fees, which are separate from consultancy and vary by scope and audit time. Reducing scope can reduce audit effort, but a narrow boundary that excludes a critical supplier or support process creates a credibility problem rather than a saving.
Ask any provider to separate assessment, implementation, internal audit, audit support, certification-body fees and ongoing maintenance. Clarify who owns remediation and evidence after handover. Our guide to comparing ISO 27001 consultancy scope and cost gives a practical quote checklist.
Start with the customer requirement: some UK procurement teams accept an accredited ISO 27001 certificate, while a US buyer may specifically request a SOC 2 Type 2 report. Select a certification body early and confirm accreditation and accepted scope. Build the ISMS around the service you actually sell, then complete internal audit and management review before the independent audit.
Certification is not a substitute for GDPR accountability, a data-processing analysis or an EU AI Act role assessment. It can provide evidence of systematic security management, but legal obligations remain. After certification, maintain the ISMS through surveillance audits, risk updates, corrective action and management review rather than treating the certificate as a one-off marketing asset.
Once an organisation decides to pursue ISO 27001, it must choose a certification body (CB). CBs come in two forms: accredited and unaccredited.
Accredited certification bodies must complete a rigorous evaluation process through an accreditation body. Organisations that use an accredited CB will receive their ISO 27001 certificate with the accreditation body represented on the certificate. For CBs that have entered the IAF Multilateral Recognition Arrangement (MLA), the IAF MLA mark will also appear — recognised globally for equivalency.
Unaccredited certification bodies are not audited to confirm compliance with IAF certification audit requirements. Many clients will only accept ISO 27001 certificates from accredited CBs. Always check your clients' specific accreditation requirements before starting the process.
Both the internal audit and management review are critical to the success of the ISMS. The internal audit and management review of the ISMS must be completed prior to the Stage 2 audit. Schedule these well in advance to allow time for continuous improvement activities.
If the person responsible for the ISMS leaves, the entire programme can fall apart. Ensure you have a redundant person with a basic understanding of the ISMS and maintain detailed documentation to support any transition.
ISO 27001 defines ongoing processes that should be in place throughout the year, not just during the audit itself. Management controls require maintenance for the ISMS to continue to function. Build the ISMS into your day-to-day operations.
ISO 27001 requires that all changes in the environment be considered through the risk assessment process. New or modified controls must be mentioned in the statement of applicability. If changes impact the scope of certification, notify your certification body and have a new certificate issued.
Acting as an extension of ISO 27001, ISO 27701 is the first international privacy standard to provide a certification path for organisations to demonstrate their privacy systems and controls. The ISO/IEC 27701:2019 standard details the requirements and guidance for establishing, implementing, maintaining, and continually improving a Privacy Information Management System (PIMS).
To receive an ISO 27701 accredited certificate, organisations must either already have ISO 27001 certification or must undergo the ISO 27001 certification audit with the ISO 27701 extension.
Combining ISO 27001 and ISO 27701:
In the 2022 update to ISO 27001, controls are placed into four themes (previously 14 domains in the 2013 version):
Key new controls introduced in the 2022 update (ISO Annex A):
Threat Intelligence — Requires organisations to gather and analyse threat information to take action and mitigate risk.
Information Security for Use of Cloud Services — Emphasises better information security in the cloud; requires organisations to set security standards and procedures specifically for cloud services.
ICT Readiness for Business Continuity — Requires organisations to ensure information and communication technology can be recovered when disruptions occur.
Physical Security Monitoring — Requires monitoring of sensitive physical areas (data centres, production facilities, etc.) to ensure only authorised access.
Configuration Management — Requires organisations to manage technology configuration to ensure it remains secure and to avoid unauthorised changes.
Information Deletion — Requires deletion of data when no longer needed to avoid sensitive information leaks and to comply with privacy requirements.
Data Masking — Requires use of data masking in accordance with the organisation's access control policy to protect sensitive information.
Data Leakage Prevention — Requires implementation of measures to prevent data leakage from systems, networks, and devices.
Monitoring Activities — Requires organisations to monitor systems for unusual activities and implement appropriate incident response procedures.
Web Filtering — Requires organisations to manage which websites users access to protect IT systems.
Secure Coding — Requires secure coding principles to be established within the software development process to reduce security vulnerabilities.
Achieving ISO 27001 certification can cover many aspects of the General Data Protection Regulation (GDPR) but it's impossible to fully swap a standard and a regulation. While ISO 27001 does not equal GDPR compliance, it's a great starting point. The two are complementary — ISO 27001 provides the security management framework, while GDPR adds specific requirements around personal data processing and individual rights.
Use this overview as your roadmap, then follow these focused guides for the decisions that tend to block startup certification:
A focused startup commonly needs around four to nine months from scoped kickoff to certificate, including time for controls to operate, an internal audit, management review, Stage 1 and Stage 2. Existing controls, scope, team availability and certification-body scheduling can shorten or extend that range.
Yes. The scope can focus on a product, service, location and supporting processes, but it cannot omit dependencies that materially affect information security. The boundary and exclusions must be documented and communicated honestly.
Not automatically. ISO 27001 is often the better first signal for international and enterprise buyers, while US technology buyers frequently request a SOC 2 report. The right order depends on buyer requirements, existing controls and whether a certification or annual attestation is the immediate commercial constraint.
Auditors test whether the ISMS and selected controls are implemented and effective. Evidence can include risk decisions, access reviews, joiner-mover-leaver records, vulnerability remediation, supplier reviews, incident exercises, backups, training and management-review records. Evidence should show real operation, not only policy text.
ISO 27001 certificates are normally valid for a three-year certification cycle, with surveillance audits during the first and second years and recertification in the third year.
ProtectifyAI helps UK and EU startups turn a defensible scope, practical controls and operating evidence into a certification-ready ISMS.
Discuss implementation →