What is ISO 27001 Certification?
ISO 27001 is the internationally recognized standard for Information Security Management Systems (ISMS). It provides a systematic framework for protecting sensitive data, managing cybersecurity risks, and demonstrating security excellence to clients, partners, and regulators. Whether you're a SaaS company, healthcare provider, financial services firm, or government contractor, ISO 27001 helps you prove your commitment to information security while reducing breach risks and winning security-conscious customers.
Why companies pursue ISO 27001:
- Required for enterprise sales, government contracts, and vendor approval processes
- Lower cyber insurance costs through demonstrated security controls
- Accelerate sales cycles by eliminating repetitive security questionnaires
- Support HIPAA, GDPR, CCPA, CMMC, and other regulatory compliance requirements
What an ISO 27001 consulting engagement actually involves
Most buyers searching for an ISO 27001 consultant want to know what happens after the contract is signed. Here is the sequence on a small to mid-size engagement. The order is the same on every project; the pace depends on company size, how many systems and locations are in scope, and how many security controls already exist.
Weeks 1-2: Gap analysis
We start with what you already run: access management, backups, device management, vendor reviews, incident handling, and whatever policies exist. The gap analysis measures all of it against clauses 4 through 10 of ISO 27001 and the Annex A controls, and produces a findings report that separates what already conforms, what partly conforms, and what is missing. Mature IT practices cover many of the technical controls. The management system around them, from the risk assessment and objectives to internal audit and management review, is where most of the new work sits.
Weeks 2-4: Scope and risk assessment
Next we define what the certificate covers: which business units, locations, systems, and services. Scope sets both cost and timeline, so it has to be tight and honest. Then comes the information security risk assessment (clause 6.1.2): what information you hold, what could happen to its confidentiality, integrity, and availability, how likely that is, and what it would cost you. The assessment is the foundation for every control decision that follows, so it has to reflect your real systems and data flows rather than a generic threat list.
Months 2-3: Risk treatment and controls
Risk treatment (clause 6.1.3) decides what you do about each risk: reduce it with controls, avoid it, transfer it, or accept it with a named owner. The outputs are the risk treatment plan and the Statement of Applicability, which lists the necessary controls, why each is included, whether it is implemented, and why any Annex A control is excluded. The current edition of the standard has 93 Annex A controls in four themes: organizational, people, physical, and technological. We build the policies and procedures with the people who own each control, so IT documents access control, HR documents onboarding and offboarding, and leadership approves the risk decisions.
Months 3-4: Internal audit and management review
ISO 27001 requires internal audits (clause 9.2) and management reviews (clause 9.3), and the certification body checks that both have happened before it certifies. We run the internal audit with your team or train your people to run it, record the findings, and close them out. Management review follows, with top management reviewing risk treatment progress, audit results, nonconformities and corrective actions, and the performance of the controls.
Months 3-6: Certification audit
The certification audit runs in two stages. Stage one reviews your documentation, scope, risk assessment, and Statement of Applicability; stage two tests whether the controls operate as described, through interviews, system walkthroughs, and sampled records. We prepare your team for what auditors ask, attend the audit, and help you close any findings with evidence. From kickoff to certificate, ISO 27001 takes 3 to 6 months for most small and mid-size companies.
What we do versus what stays with you
A consulting engagement works when the split is explicit.
We handle: the gap analysis and its findings report, the implementation plan, the risk assessment method, structure and drafting support for policies and procedures, the Statement of Applicability, internal audit execution or co-execution, management review facilitation, corrective action design, certification body selection and scheduling, audit preparation, and attending the certification audit.
You handle: knowledge of your systems and data, the people who own each control, document approvals, and the decisions only leadership can make. Accepting a risk is one of them: the standard expects risk owners to approve the treatment plan and accept the risks that remain. A consultant can frame those decisions, but cannot make them for you.
Who an ISO 27001 consultant is right for
Consulting earns its cost when a customer, prime contractor, or tender requires ISO 27001 by a date you cannot move. It also fits companies whose security knowledge sits with one IT lead, whose leadership has never run a management system, or whose team keeps answering the same security questionnaires by hand. It also applies well outside software: manufacturers and industrial suppliers get asked for it by their customers too, and our guide to ISO 27001 for manufacturing covers that case.
A consultant is the wrong call when you already have a security lead with ISMS experience, a realistic timeline, and leadership willing to fund their time. Be wary of anyone who promises certification from a template pack alone: the certificate comes from an accredited certification body, and its auditors test whether controls operate, not whether documents exist.
What goes wrong when companies do it without help
Self-built systems tend to fail in the same places, and every one of these costs more to fix after an audit than to avoid before it.
A risk assessment copied from a template. A generic threat list that does not name your systems, data, or suppliers gives the auditor nothing to trace controls back to. Our article on ISO 27001 risk assessment shows what a working one looks like.
A Statement of Applicability without reasons. Every excluded control needs a justification, and every included control needs to exist in practice. A list of controls marked "applicable" with no evidence behind them is what a stage one auditor questions.
Security treated as an IT project. Annex A covers HR, supplier management, physical security, and business continuity as well as technology. A system owned only by IT leaves those areas without owners.
Scope chosen to look small. A scope that excludes the systems customers actually care about produces a certificate that does not answer their question, and procurement teams read scope statements.
ISO 27001 vs SOC 2: which one your customers mean
ISO 27001 is a certification; SOC 2 is an attestation report. An accredited certification body certifies your ISMS against ISO 27001 and issues a certificate that is recognized internationally. A SOC 2 report is issued by a CPA firm under AICPA standards and describes your controls and, in a Type II report, how they operated over a period. SOC 2 is most common with U.S. technology buyers; ISO 27001 is an international standard with a certificate recognized worldwide.
The two overlap heavily, so the work is not wasted either way. If your customers ask for both, a single control set can support both, with the ISO 27001 risk assessment and Statement of Applicability as the backbone. The first conversation is the right place to sort out which one your customers actually require.
What ISO 27001 auditors actually check
The certification audit tests whether the system reaches the work. These are the areas where auditors dig.
The thread from risk to control. Auditors pick a risk from your assessment, follow it to the treatment plan and the Statement of Applicability, and then ask to see the control working (clauses 6.1.2 and 6.1.3).
Access control in practice. Auditors sample joiners, movers, and leavers and check that access was granted, changed, and removed as the procedure says, including for privileged accounts.
Supplier security. Cloud providers and software vendors hold your data, so auditors ask how you assess suppliers and what your contracts require of them.
Incidents and corrective action. Auditors read incident records for how events were reported, assessed, and closed, and look for corrective actions (clause 10.2) that were checked for effectiveness.
Competence and awareness. Auditors ask staff about the security policy and their own responsibilities, and check that training matches each role (clauses 7.2 and 7.3).
How long ISO 27001 certification takes
ISO 27001 certification takes 3 to 6 months from kickoff for most small and mid-size companies. Three things set the pace:
- How many security controls already operate and leave records
- The size of the scope: business units, locations, systems, and suppliers
- How quickly control owners and leadership make decisions, and how early the certification body is booked
Certification bodies also expect controls to have operated for a period before stage two, so that there are records to sample. Planning for that from the start avoids a gap between a finished system and an audit it cannot yet pass.
What drives the cost of ISO 27001
The cost of ISO 27001 depends on the same factors that set the timeline: scope, the number of people and systems involved, and how many controls already exist. Technical remediation, such as new tooling or encryption, is often a separate budget line from consulting and certification fees. Quotes far below the field usually leave out the certification body, and the registrar's fees are not optional.
We quote the gap analysis up front, and the implementation once its findings show what the work involves. What we will not do is lowball the consulting number and leave the registrar, surveillance, and recertification costs for you to discover later.
Adding ISO 27001 to ISO 9001 or ISO 14001
ISO 27001 shares its structure with ISO 9001 and ISO 14001: the same clause numbers, the same plan-do-check-act loop, and the same internal audit and management review requirements. A company already certified to either one adds ISO 27001 faster, because document control, the audit program, and the management review rhythm already exist. Our article on integrating ISO 27001 with an existing quality system explains the overlap, and an integrated management system with one internal audit program is less work to run than separate systems.
Choosing a certification body (registrar)
Choose a certification body accredited by a recognized accreditation body, such as ANAB in the United States; a certificate from an unaccredited source will not survive a customer's supplier security review. Beyond accreditation, compare auditor experience in your industry and technology stack, scheduling flexibility, and price. We help you select and schedule the certification body and prepare your team for its audit style.
On-site versus remote consulting
Much of ISO 27001 work runs well remotely: policy drafting, the risk assessment workshops, Statement of Applicability reviews, and management review preparation. Physical security, office and data room walkthroughs, and some internal audit interviews benefit from being on site. Our engagements mix the two, which keeps travel cost out of the quote without putting the audit program at arm's length.
What happens after certification: the three-year cycle
Certification runs on a three-year cycle. The certificate follows the two-stage initial audit. Surveillance audits come in years one and two; they are shorter than the initial audit and check whether the system still runs: risk assessments updated, internal audits completed, incidents handled, and management reviews held. Year three brings a recertification audit that renews the certificate for another three years.
Companies that pass surveillance audits without drama review their risk assessment when systems or suppliers change, keep a standing internal audit schedule, and treat security incidents as inputs to improvement. We offer ongoing support for this: periodic internal audits, management review facilitation, and a check before each surveillance visit.
How the gap analysis works, and what it tells you
The gap analysis is the first paid step of most engagements, so it is worth describing precisely. We assess every clause of ISO 27001 and the Annex A controls three ways: document review shows what the system claims, interviews show what people actually do, and system walkthroughs show how controls are configured. The findings that matter most sit in the gaps between the three.
The output is a findings report organized by clause and control, with each item classified as conforming, partially conforming, or nonconforming, written so that your own IT lead, or any competent consultant, could build the same remediation plan from it. For a first look before paying for anything, the free ISO 27001 gap analysis tool scores your current system clause by clause.
Working with Kaizen on ISO 27001
Kaizen ISO Consulting is a small consultancy based in Salt Lake City and led by Trenton Steadman, who implements ISO 27001 systems alongside ISO 9001, ISO 14001, and ISO 45001. The team brings more than 25 years of combined experience, and not a single client has failed a certification audit. You work with the consultant directly, from the first call through the certification audit.
Every engagement starts with a free consultation. We ask what is driving the decision, which customers or contracts require the certificate, which systems and locations are involved, and when you need it. You get a straight read on readiness and a realistic timeline whether or not you hire us.
