ISO 27001 consulting that unlocks enterprise sales — without slowing engineering down.

SOC 2 is a US-centric attestation report describing your security controls and an auditor's opinion on them. ISO 27001 is a globally recognized certification that you operate an information security management system meeting an international standard. They overlap heavily (roughly 60% of controls and evidence) but differ in framing, audit format, and audience. The decision usually comes down to your buyer pool: US enterprise customers default to asking for SOC 2; international customers and security-mature buyers prefer ISO 27001; many enterprise customers now want both. If you need only one and your buyers are primarily US-domestic, SOC 2 is faster. If you need both, do them together from day one — we'll integrate the evidence base.

Yes, and increasingly required. Most ISO 27001-certified companies under our care for first certification are 15 to 75 person SaaS and platform companies, often pursuing certification to unlock enterprise sales motion. The standard scales: a 25-person startup runs roughly 30 pages of policy documentation and 30 to 50 controls actively evidenced. Cloud-native architecture actually makes implementation easier because most technical controls inherit from the cloud provider's own ISO 27001-certified infrastructure.

Five to eight months from kickoff to Stage 2 is typical for a US SaaS or services company starting from a partial baseline (cloud-native infrastructure, modern IAM/SSO, some existing security policies). Companies starting from a near-zero baseline take longer — eight to twelve months. Companies that already hold SOC 2 Type 2 can often add ISO 27001 in three to four months because most evidence already exists. The Stage 2 audit itself is typically scheduled three to four weeks after Stage 1.

You implement the ones applicable to your scope and skip the ones that aren't, with documented rationale in the Statement of Applicability. Most SMB SaaS companies end up applying 70 to 85 of the 93 controls. The 'we don't have physical media so we exclude these physical controls' arguments are perfectly acceptable when documented honestly. Auditors look for clear, defensible scoping — not maximalism.

Yes, you must certify against ISO 27001:2022 now. The 2013 version reached its transition deadline in October 2025; any active certificate is now on 2022. The 2022 update reorganized Annex A into four control themes (organizational, people, physical, technological) and added 11 new controls covering threat intelligence, cloud services, ICT readiness for business continuity, data leakage prevention, and others. All our engagements are 2022-current.

We handle the management-system work end to end: scope, risk, policy, Annex A control design, SoA, internal audit, management review, and certification body liaison. We advise on technical implementation and review your team's work, but we don't replace your engineering team for actual configuration work (deploying EDR, configuring IAM, hardening cloud infrastructure). When deeper technical implementation help is needed, we coordinate with technical partners we trust rather than expanding scope.

Engagement scope dominates: gap analysis alone runs low five figures; full implementation from scratch ranges considerably higher and depends on your existing security maturity, scope complexity, and how much you want us to do directly. Certification body fees add roughly $8,000 to $20,000 for initial certification depending on size and audit days, plus surveillance audits in years one and two. We don't publish rate cards; we publish honest scope conversations.

Yes — and should. Modern ISMS design treats cloud-provider native controls as inherited evidence. AWS, GCP, and Azure are themselves ISO 27001 certified, and their shared-responsibility model means many physical, environmental, and infrastructure controls flow down to you automatically. We design the ISMS to leverage native controls (CloudTrail, GuardDuty, IAM, Config; equivalent on GCP/Azure) rather than bolt parallel security tooling onto a cloud-native architecture. This is the difference between a 30-control and a 90-control implementation effort.