ISO 27001 readiness and implementation

What's included

• Scoping: which parts of the business the certificate covers
• Risk assessment and a risk treatment plan
• The Statement of Applicability
• Policies and procedures for the Annex A controls that apply to you
• Running the management system: management review, metrics, corrective actions
• Preparation for the Stage 1 and Stage 2 certification audits, and support during them

Not included

• The certification audit, billed by an accredited certification body. Typically $5,000 to $15,000, plus a yearly surveillance audit at about a third of that.
• The internal audit. The standard requires it to be independent of whoever built the system, so you engage a separate internal auditor.

How long it takes

Four to nine months to certification, depending on how much is already in place.

What changes the price

• Number of people and devices
• Regulatory exposure: SEC or FINRA oversight, payments, banks as customers
• How many SaaS tools and cloud accounts you run
• How much cleanup your environment needs before we can run it
• Which frameworks and how much of the business are in scope
• Deadlines, such as a customer who needs a SOC 2 report this quarter

Questions

SOC 2 or ISO 27001?

US customers usually ask for SOC 2. Customers in Europe and many large enterprises ask for ISO 27001. If you need both, build once: most controls overlap, and the second framework costs much less than the first.

Is it a one-time cost?

The certificate lasts three years, with a surveillance audit each year. Our upkeep service, or the Compliance plan, covers the work between audits.