We build and operate your Information Security Management System — from gap assessment through implementation to certification preparation.
Need help with ISO 27001? ProtectifyAI supports readiness assessments, ISMS implementation and preparation for independent certification. We work with UK and European organisations to define a useful scope, assess security risks and put controls into everyday operation.
You can engage us for a gap assessment, a full implementation or targeted remediation before an audit. The deliverables and responsibilities are agreed upfront, including what your internal owners must approve and operate.
An independent gap assessment against ISO/IEC 27001:2022, scoped to your actual systems — not a generic checklist.
We help build and embed the ISMS with your team, so your people can run it day to day, not just pass an audit once.
A readiness review ahead of Stage 1 or Stage 2, with findings reported honestly — including where we are not the right people to also sign off, if we built the controls being reviewed.
Where we have also implemented the controls being assessed, we will say so plainly rather than presenting a readiness review as fully independent; a genuinely independent internal audit function or third party should perform that specific check before certification.
Start with the ISO 27001 startup guide hub for the overall certification route. Then use the ISO 27001 for startups guide to set a proportionate scope, the readiness assessment guide to evaluate your starting point, and the implementation timeline to plan owners and audit dependencies.
ISO 27001 implementation means designing, building, and embedding an Information Security Management System (ISMS) that meets the requirements of ISO/IEC 27001:2022. It covers policy creation, risk assessment, Annex A control selection and deployment, internal audit, management review, and preparation for Stage 1 and Stage 2 certification audits conducted by an accredited, independent certification body. ISO 27001 concerns the ISMS specifically — it is not a blanket guarantee that every product is free of security issues. See ISO's overview of the standard.
ISO 27001 has 93 controls across 4 themes in Annex A. The standard requires a documented Statement of Applicability explaining which controls you implement and why. It requires a formal risk assessment methodology, a risk register, and evidence that management reviews the ISMS at defined intervals.
None of this is intuitive if you have not done it before. Many teams download a policy template pack, rename the company name, and discover months later that their auditor considers it inadequate — because the policies were not tailored to their actual systems, and there is no evidence the controls are actually operating.
ProtectifyAI works with your team to implement the ISMS, not just hand over documents. We help wire controls into your existing tooling, build processes your team can actually run, and support you through both audit stages.
Scope definition, context of the organisation, interested parties analysis, and ISMS boundary documentation.
Risk methodology, asset inventory, threat and vulnerability identification, risk scoring, and risk treatment plan.
Full suite of ISO 27001-aligned policies tailored to your stack — not renamed templates.
Statement of Applicability, control selection rationale, and implementation evidence for all applicable controls.
Internal audit programme, audit plan, and findings report — required before Stage 2 can proceed.
Management review agenda, inputs, and documented outputs — a mandatory ISO 27001 requirement.
Supplier inventory, risk classification, contractual security requirements, and annual review process.
Certification body selection, Stage 1 and Stage 2 facilitation, nonconformity response, and certificate procurement.
| Phase | Duration | What happens |
|---|---|---|
| 01 | Weeks 1–3 | Gap assessment, scope definition, ISMS design, certification body shortlisting and selection |
| 02 | Weeks 4–7 | Risk assessment and risk treatment plan, Statement of Applicability, policy library creation |
| 03 | Weeks 8–13 | Annex A control implementation — access control, cryptography, physical security, supplier management, incident management, and remaining controls |
| 04 | Weeks 14–16 | Internal audit, management review, nonconformity remediation, Stage 1 preparation |
| 05 | Week 17–18 | Stage 1 audit (documentation review by certification body). Any nonconformities addressed. |
| 06 | Weeks 19–21 | Stage 2 audit (on-site or remote controls testing). Certificate issued on successful completion. |
| Factor | ISO 27001 | SOC 2 |
|---|---|---|
| Standard body | ISO/IEC (international) | AICPA (US) |
| Dominant market | UK, Europe, Middle East, Asia | US |
| Output | Certification (pass/fail) | Attestation report (auditor opinion) |
| Observation period | Not required for certification | 3–12 months for Type 2 |
| Time to first certificate | Scope-dependent — estimated after assessment | Scope-dependent, including a Type II observation period |
| Control overlap | ~70% overlap — the second standard is significantly faster once the first is complete | |
The 52-point checklist we use internally before every ISO 27001 engagement. Covers ISMS design, risk assessment, Annex A controls, internal audit, and Stage 1/2 preparation. Enter your email to receive it.
Outcome-based pricing — fixed fee agreed upfront, payable on certification. No hourly meters, no scope-creep change orders.
Certification body fees are separate and quoted independently. We are vendor-neutral.
Timelines vary with organisation size, existing controls and team availability. We provide a scoped estimate after an initial assessment rather than a universal figure — and Stage 1/Stage 2 audit scheduling with your certification body is a separate variable from implementation time.
Stage 1 is a documentation review — the auditor confirms your ISMS is designed correctly and your policies are in place. Stage 2 is the main certification audit, where the auditor tests whether controls are actually operating as documented. You must pass Stage 1 before Stage 2 can proceed. Nonconformities from Stage 1 must be closed before Stage 2 begins.
We agree a clear scope, deliverables and fee upfront once we understand your organisation's size and starting point. Certification body fees are separate, vary by provider and scope, and are quoted independently — we do not control or benefit from the certification body's fee.
An ISMS is a documented framework of policies, processes, and controls for managing information security risk. ISO 27001 requires one. For a startup, an ISMS does not need to be complex — a well-designed lean ISMS for a 10–50 person company can be operated by the existing team without a dedicated security hire.
ISO 27001 is an internationally recognised certification (pass/fail) governed by ISO/IEC. SOC 2 is a US attestation standard governed by the AICPA. ISO 27001 is dominant in UK and European procurement; SOC 2 is dominant in US enterprise procurement. Both are worth pursuing for AI startups targeting global enterprise deals — the control overlap is ~70%, making the second certification much faster.
No. A compliance platform helps automate evidence collection but is not required for ISO 27001 certification. ProtectifyAI is entirely vendor-neutral. We will recommend whether a platform makes financial and operational sense for your team, and work with whichever you choose — or build a manual evidence process if that is the better fit.
45 minutes on your actual ISO 27001 situation. No follow-up sequences if we're not the right fit.
Book a working session →