A customer or partner requires certification
Buyers outside the US, and many large US enterprises, ask for an ISO 27001 certificate the way others ask for a SOC 2 report.
- Home
- Frameworks
- ISO 27001
ISO 27001, from scoping to certification.
For companies whose customers, partners, or overseas buyers now require certification. I build the ISMS to ISO/IEC 27001:2022 with your team and stay with you through both audit stages.
- CISSP
- CISA
- GSLC
- CISO and vCISO
- USMC veteran
- 30 years in IT and security
01 — When it comes up
Why companies call me about ISO 27001
ISO 27001 is the internationally recognized certification for an information security management system.
You hold a certificate to the 2013 version
The transition period to ISO/IEC 27001:2022 ended on October 31, 2025. A certificate still issued against the 2013 version needs to be recertified to the current standard.
You want one program that answers many questionnaires
A certified ISMS gives you a defensible answer to a large share of customer security questions, and its controls map well to SOC 2 and other frameworks.
02 — How the work runs
How I build it
Five steps, built with your team so the system keeps running after the certificate is issued.
01
Scope and gap assessment
Define what the ISMS covers and measure where you stand against the standard and Annex A. You get a gap report and a realistic timeline to certification.
02
Risk assessment and treatment
A documented risk methodology, a risk register, and a treatment plan. This decides which controls you need and why, and it’s the first thing an auditor tests.
03
Build the ISMS
Policies, procedures, and controls written for how your company actually operates, plus a Statement of Applicability that ties each of the 93 Annex A controls to a decision.
04
Internal audit and management review
Both are required before certification, and both are commonly left too late. They’re completed and documented before the certification body arrives.
05
Stage 1 and Stage 2 audit support
I prepare you for both stages, support you during the audits, and work through any nonconformities until the certificate is issued.
03 — Fixed fees
What it costs
Fixed fees, agreed in writing before work starts. If you already have SOC 2, much of the control work carries over and the project is usually shorter.
Readiness Assessment
$6,500 fixed
Know exactly where you stand against one framework, with a 90-day plan.
- Gap report against ISO/IEC 27001:2022 and Annex A
- Risk summary
- 90-day roadmap to certification readiness
- Readout call
100% of the assessment fee is credited toward an implementation signed within 30 days.
Start with an assessmentProgram Implementation
From $30,000 fixed
ISO 27001 or SOC 2 built and audit-ready.
- Scope and gap assessment
- Risk assessment and treatment
- Policies, procedures, and controls written for how you operate
- Internal audit and management review
- Support through the certification or attestation audit
Virtual CISO retainer
From $2,000 / month
Someone accountable for running the program after it is built.
- Runs the ISMS between audits
- Prepares you for annual surveillance audits
- Keeps risk register and evidence current
04 — Questions
Common questions
Straight answers to what clients usually ask first. Anything else, bring it to the call.
Do you issue the certificate?
No. Certification is issued by an accredited certification body after its own Stage 1 and Stage 2 audits. My role is getting you ready to pass, and keeping the consulting and certifying roles separate is what an accredited body requires.
What happens after certification?
A certificate runs on a three-year cycle, with surveillance audits in the intervening years and a recertification audit at the end. The ISMS has to keep operating between audits, which is where a retainer usually fits.
What changed in the 2022 version?
Annex A was reorganized into 93 controls in four themes (organizational, people, physical, and technological), with new controls such as threat intelligence, cloud services, and secure coding.
How long does ISO 27001 take?
It depends on scope and starting point. The Readiness Assessment gives you a realistic timeline, including when to book the certification body.
Next step
Book a discovery call
Thirty minutes, no pitch. Pick a time below, bring your deadline and whatever you’ve got so far, and we’ll scope it honestly.
Loading available times… If nothing appears, open the calendar in a new tab.
Prefer email? jason@ineedaciso.com