Scoping call
Frameworks / ISO 27001

ISO 27001 for companies whose customers want an international certificate.

ISO/IEC 27001 is the international standard for an information security management system. An accredited certification body audits it in two stages and issues a certificate on a three-year cycle. Customers outside the US, and many enterprise buyers, ask for it alongside SOC 2 or instead of it.

93
Annex A controls, in four themes
2022
Current edition, amended in 2024
3 years
Certificate cycle, with annual surveillance audits
Stage 1 · 2
Two-stage initial certification audit
Sources: ISO/IEC 27001:2022 and Amd 1:2024; IAF MD 26; ISO/IEC 17021-1. Status as of October 2026.
How we help

Built from your SOC 2 program, or from the start.

ISO 27001 asks for two things: a management system, meaning the scope, risk assessment, Statement of Applicability, internal audit, and management review; and the Annex A controls your risk assessment selects. We build both. The technical controls go into your own accounts, and the management system becomes a set of documents and routines your team can keep running.

If you already have SOC 2, most of the technical controls carry over. The new work is the management system itself: risk treatment, internal audit, and management review.

Certification cycle

From Stage 1 to recertification.

Year 1
Stage 1
Readiness review
Stage 2
Certification audit · Certificate issued
Surveillance audit
Within 12 months of certification
Year 2
Surveillance audit
Year 2
Year 3
Recertification
Before the certificate expires, year 3
Back to the start of the next cycle
Audited by an accredited certification body, which may not consult on the system it certifies.
ISO/IEC 27001:2022; ISO/IEC 17021-1.

Certification bodies are accredited against ISO/IEC 17021-1 and ISO/IEC 27006-1. In the US, ANAB accredits them, and accreditations are recognized internationally through the Global Accreditation Cooperation, which replaced the IAF and ILAC in January 2026.

Common questions

ISO 27001 questions.

Who issues the certificate?

An accredited certification body. Under ISO/IEC 17021-1, a certification body may not consult on a system it certifies, and anyone who consulted for you is barred from auditing it for two years. We build the system; the certification body audits it.

How is it different from SOC 2?

A SOC 2 report is an attestation by a CPA firm, read mostly by US customers. ISO 27001 is a certificate against an international standard. The technical controls overlap heavily. ISO 27001 adds a formal management system around them.

Is a 2013 certificate still valid?

No. The transition to the 2022 edition ended on October 31, 2025. Certificates issued against the 2013 edition have expired or been withdrawn.

How long does it take?

It depends on scope and on what is already in place. After the Assessment we give you a specific date for Stage 1.

Customer asking for ISO 27001?

On a scoping call we’ll confirm your scope and estimate the work.

Book a scoping call