ISO27001 Compliance Guide

ISO/IEC 27001:2022 was published in October 2022, with a short climate action amendment in 2024 (Amd 1:2024) that adds climate change to the context questions in Clause 4. The standard has two parts that matter to you.

Clauses 4 to 10 are the management system: scope, leadership, risk assessment and treatment, objectives, competence, document control, internal audit, management review and corrective action. These are not optional. Every certified company must meet all of them, whatever its size.

Annex A is the control catalogue. The 2022 edition has 93 controls in four themes: Organizational (37), People (8), Physical (14) and Technological (34). You do not have to implement all 93. You must consider each one, decide whether it applies to your risks, and record that decision with a reason in the Statement of Applicability (SoA). For a cloud-native SaaS company with no data centre, several physical controls are often covered by your hosting provider's own attestations, which you reference rather than rebuild.

The part teams underestimate is the management system, not the controls. Many SaaS teams we assess already have MFA, encrypted storage and code review. Few have a written risk methodology, a risk register with named owners, or minutes from a management review. In our experience, the management system gap is often larger than the technical one.

Certification is issued by an accredited certification body, which audits you under the rules in ISO/IEC 17021-1. In Canada, accreditation is overseen by the Standards Council of Canada; US certification bodies are typically accredited by ANAB. Check that your auditor's certificate will carry an accreditation mark your customers recognize.

The sequence looks like this:

Audit time is set by rules the certification bodies follow (based mainly on how many people work inside your scope), so a tight scope directly shortens the audit. Under the accreditation rules, the first surveillance audit falls within 12 months of the certification decision.

One date matters if you already hold a certificate. The transition from the 2013 edition closed on 31 October 2025, the deadline accreditation bodies applied under IAF MD 26. A 2013 certificate is no longer a valid answer on a questionnaire.

The honest answer depends on who signs your contracts, not on which framework is "better."

Our opinion, which some audit firms will dispute: if your pipeline is genuinely mixed, do ISO27001 first. The ISMS gives you the risk register, ownership and review cadence that a SOC2 audit then samples, so the second audit mostly reuses evidence. Going the other way, teams often discover that a SOC2 report did not leave them with a management system, and they build Clauses 4 to 10 from scratch.

We also think a SOC2 Type I report is usually a detour. It tests design at one point in time, many enterprise buyers ask for Type II anyway, and the Type I effort rarely shortens the Type II timeline. Take it only when a specific deal needs a document within weeks. For the SOC2 side in more detail, see our SOC2 compliance guide or the free SOC2 readiness assessment.

This plan assumes a cloud-native SaaS company, one internal owner with about a day a week to give, and outside help for the parts that need an auditor's eye. Owners are named by role.

Teams that already run mature engineering practices can compress months 3 to 5. Teams that start without an asset inventory or a single owner for security usually stretch past nine months. The bottleneck is almost never writing policies. It is the weeks of evidence an auditor needs to see.

We do not quote certification body fees here: they vary by scope, headcount, sites and the body you choose. Ask at least two accredited bodies for a three-year quote that includes Stage 1, Stage 2 and both surveillance audits, since the surveillance years are where comparisons break down.

The larger costs are internal. Expect a meaningful share of one senior person's time for six to nine months, plus engineering time to close technical gaps and produce evidence. A compliance platform can automate evidence collection, but it will not write your risk methodology or chair your management review.

Scope is the single biggest lever. Certifying the product platform and the people who run it is normal and acceptable to most buyers. Certifying the whole company on day one, including sales offices and every internal tool, multiplies the evidence for little commercial gain.

If you want an outside owner for the programme, our virtual CISO service tiers are listed on the pricing page, from US$2,000 a month for 15 to 20 hours. In our experience, a certification push with an audit date fits the Walking tier, from US$4,250 a month for 20 to 40 hours, until the first surveillance audit is behind you.

ISO27001 is not a law in Canada or the US, and no certificate makes you compliant with one. It is good evidence that you take reasonable security measures, which is what several laws ask for.

In Canada, PIPEDA's safeguards principle requires security safeguards appropriate to the sensitivity of the information. Quebec's Law 25 adds obligations that sit outside ISO27001, such as keeping a register of confidentiality incidents and notifying the Commission d'accès à l'information and affected people when an incident presents a risk of serious injury. Your ISMS incident process should produce that register; the certificate will not do it for you. Our data security and privacy work usually maps these duties into the same risk register.

In the US, health data brings the HIPAA Security Rule if you act as a business associate, and its risk analysis requirement is separate from your ISO risk assessment, though one can feed the other. State breach notification laws still apply on their own terms. In the EU, the NIS2 Directive pushes cybersecurity risk management and supply chain security onto in-scope entities, which is one reason European customers ask suppliers for ISO27001.

Certification is the right answer when a customer, partner or regulator asks for it by name. It is the wrong next step more often than vendors admit.

Short version: buy the certificate your customers will read.

Before you sign a readiness contract, find out where you stand. Our free ISO27001 gap assessment scores you against the 25 requirements in Clauses 4 to 10, and optionally all 93 Annex A controls, then produces a report you can share with your leadership team. It runs in your browser.

If the gaps look larger than your team can close before a deal deadline, our ISO27001 consulting team can take on the risk assessment, SoA, internal audit and audit-day support. You can also book a consultation to talk through whether ISO27001 or SOC2 should come first for your pipeline.