SaaS companies selling internationally
Your US buyers ask for SOC 2 and your European and Asian buyers ask for ISO 27001. Readiness builds one ISMS whose controls and evidence serve both, so you are not running two disconnected compliance programs.
Certifications & attestations
ISO 27001 readiness assessment
A customer in Europe, a global procurement team or a partner’s security questionnaire has asked for your ISO 27001 certificate, and you don’t have one yet. Readiness turns that request into a working information security management system that is scoped sensibly, driven by your real risks and documented the way the standard expects. You walk into the certification body’s audit with the evidence already in hand.
Formal outcome from
An accredited certification body you choose, accredited by an IAF-member accreditation body such as ANAB in the United States or UKAS in the United Kingdom
Who asks for it
Enterprise and multinational procurement teams · Customers in the UK, EU and Asia-Pacific
Our role
Readiness — we prepare you; your assessor decides
Your organization — readiness viewEvery requirement, an owner and its evidence
Readiness- SCOPEScope and system boundaryReady
- RISKRisk assessment and registerReady
- ACCESSAccess reviews, with evidenceGap · owner set
- CHANGEChange managementClosing
- VENDORVendor managementGap · owner set
- TESTPenetration test evidenceReport in hand
Handed to the assessor you choose — the opinion is theirs
Gaps found before the audit
Who it’s for
Why ISO 27001 lands on your desk.
ISO/IEC 27001:2022 is the international standard for an information security management system (ISMS). Its requirements sit in clauses 4 to 10: understanding your context and interested parties; leadership commitment and an information security policy; planning through risk assessment and risk treatment; the support that makes the system run, from resources and competence to awareness, communication and documented information; operation; performance evaluation through monitoring, internal audit and management review; and improvement through corrective action. Annex A then lists 93 reference controls in four themes, organizational, people, physical and technological, that you compare your risk treatment against.
What sets ISO 27001 apart from a checklist is that it certifies a management system, not a control set. The auditor wants to see that you decided what is in scope and why, identified risks with a repeatable method, chose treatments, justified every Annex A control you include or exclude in a Statement of Applicability, and then actually ran the system: measured it, audited it, reviewed it at leadership level and fixed what you found. A company with strong technical security can still struggle in the audit because the management system around that security was never built, or was built and never operated.
Teams come to ISO 27001 because it is the security credential that travels. Buyers outside the US expect it, many multinational procurement teams accept it in place of their own questionnaire, and it sits comfortably beside SOC 2 when you sell into both markets. The 2022 revision reorganized Annex A and added controls for threat intelligence, information security for use of cloud services, ICT readiness for business continuity, physical security monitoring, configuration management, information deletion, data masking, data leakage prevention, monitoring activities, web filtering and secure coding, so even organizations certified to the 2013 edition have had real work to do.
Who asks for it
Enterprise and multinational procurement teamsCustomers in the UK, EU and Asia-PacificChannel partners and resellersInvestors and acquirersBoards wanting a recognized benchmark
Companies with a certificate written into a contract
A signed deal or a tender requires certification by a set date. You need a scope the certification body will accept and a management system that has genuinely operated, internal audit and management review included, before the auditor arrives.
Teams moving from informal security to a managed one
You have capable engineers and reasonable controls, but no risk register, no Statement of Applicability and policies nobody has read. Readiness gives the work you already do the structure and records the standard recognizes.
Certified organizations under strain
You hold a certificate, but nonconformities keep recurring, a scope change is coming, or the 2022 controls were adopted on paper only. A readiness review shows where your next surveillance or recertification audit is most likely to find problems.
Who certifies
We prepare you. Your assessor decides.
Formal outcome from
An accredited certification body you choose, accredited by an IAF-member accreditation body such as ANAB in the United States or UKAS in the United Kingdom
What they produce
ISO/IEC 27001:2022 certificate for your defined ISMS scope, kept in force through surveillance audits and recertification
Where readiness fits
Certification bodies are not permitted to consult for the organizations they certify, which is why readiness is separate work. We sit on your side of the table, helping you build and evidence the ISMS, and the certification body you select reaches its own independent decision.
ISO/IEC 27001:2022 Information security management systems — Requirements ISO/IEC 27001:2022/Amd 1:2024 Climate action changes ISO/IEC 27002:2022 Information security controls ISO/IEC 27005:2022 Guidance on managing information security risks ISO/IEC 27017:2015 Information security controls for cloud services ISO/IEC 27701 Privacy information management ISO/IEC 17021-1:2015 Requirements for bodies providing audit and certification of management systems ISO/IEC 27006-1 Requirements for bodies providing audit and certification of information security management systems
What it covers
What ISO 27001 readiness covers.
- ISMS scope and boundaries: which locations, products, teams and cloud environments are in, and the interfaces with what is out
- Context of the organization: internal and external issues, interested parties and their requirements, including the climate-change consideration added by the 2024 amendment
- Leadership commitment, the information security policy, and assigned roles, responsibilities and authorities
- Risk assessment methodology: risk acceptance criteria, likelihood and consequence scales, and named risk owners
- Risk assessment and a risk register for the scoped assets, processes and suppliers
- Risk treatment plan and acceptance of residual risk by risk owners
- Statement of Applicability for all 93 Annex A controls, with justification for each inclusion and exclusion and its implementation status
- Information security objectives, and how each is measured and reported
- Competence, awareness and communication requirements for everyone in scope
- Documented information: policies, procedures, and the records that prove they operate
- Organizational controls: asset inventory, access control, supplier and cloud-service security, incident management, business continuity, legal and contractual requirements
- People and physical controls: screening, terms of employment, awareness training, remote working, secure areas and physical security monitoring
- Technological controls: endpoints, privileged access, configuration management, logging and monitoring, vulnerability management, backup, cryptography, secure development and secure coding
- Internal audit program, management review, nonconformity and corrective action
What you receive
What you have in hand when readiness is done.
Gap assessment against clauses 4–10 and Annex A
Every requirement of the standard and every Annex A control rated against what you have today, with the evidence that already exists and what is missing.
Recommended ISMS scope statement
A scope description and boundary diagram written the way certification bodies expect to read them, with the reasoning for what is in and what is out.
Risk methodology and risk register
A documented, repeatable risk assessment method and a populated register tied to your own assets, threats and owners, rather than a generic template with your logo on it.
Statement of Applicability
A draft SoA covering all 93 controls, linked to your risk treatment plan, with justifications an auditor can follow from risk to control to record.
Policy and procedure set
The information security policy and the topic-specific policies your chosen controls require, written for how your organization actually works and mapped to Annex A.
Prioritized remediation plan
Gaps ranked by audit impact and risk, each with a proposed owner, so you close the issues that would become major nonconformities first.
Internal audit program
An audit plan, criteria and checklists that satisfy clause 9.2, structured so that whoever performs the internal audit is not auditing their own work.
Management review pack
An agenda and input set for clause 9.3, so leadership review covers every item the standard lists and leaves a record the certification body can sample.
Evidence index for the certification audit
A map from each requirement and applicable control to the record that proves it, ready for the certification body’s document review and its main audit.
Common gaps
What a ISO 27001 readiness review tends to surface.
Better found now, by people on your side, than by your assessor.
A scope too broad to evidence, or too narrow to satisfy the customer who asked for the certificate
A risk register copied from a template, with risks nobody owns and no link to the controls chosen
A Statement of Applicability that excludes controls without justification, or marks controls implemented that have no records behind them
No internal audit or management review completed before the certification audit
Policies approved but never communicated, with no evidence that staff have read them or been trained on them
Supplier and cloud-service security handled informally, without the agreements and monitoring Annex A expects
Information security objectives that cannot be measured, or are never measured
Vulnerability scanning and logging running technically, with no record of review, triage or follow-up
Where testing fits
The tests ISO 27001 calls for, from the same team.
Vulnerability assessment
Annex A control 8.8 asks you to identify technical vulnerabilities, evaluate your exposure and act on it; regular, recorded scanning is the most direct evidence.
What the test coversExternal network pentest
An independent test of your internet-facing perimeter gives the certification body evidence that your network security and vulnerability controls work as your SoA states.
What the test coversWeb application pentest
Control 8.29 calls for security testing in development and acceptance; an independent application test is how many organizations evidence it for customer-facing systems.
What the test coversCloud configuration review
The 2022 control on information security for use of cloud services expects deliberate management of cloud security; a configuration review shows where your setup departs from your own policy.
What the test coversInternal network pentest
Network security, security of network services and segregation of networks (controls 8.20 to 8.22) are easier to defend in audit when an internal test has checked them.
What the test coversSocial engineering
Awareness controls in the people theme carry more weight when you can show how staff respond to phishing, not only that training was delivered.
What the test covers Questions
What buyers ask about ISO 27001.
Can the certification body also help us get ready?
No. ISO/IEC 17021-1, the standard that governs certification bodies, prohibits them from providing management-system consultancy to the clients they certify, because they would end up auditing their own advice. That is why readiness is a separate, open market. We help you build and evidence the ISMS; the certification body you choose audits it independently, and neither of us decides the outcome for the other.
Does ISO 27001 require a penetration test?
The standard does not name penetration testing as a mandatory activity. It does require you to manage technical vulnerabilities, to test security in development and acceptance, and to evaluate whether your controls are effective. Many certification bodies look for independent technical testing as evidence for those controls, and many customers ask for a recent pen test report alongside the certificate.
Do we have to implement all 93 Annex A controls?
No. Annex A is a reference list you compare your risk treatment against. You include the controls your risks and obligations call for and justify each exclusion in the Statement of Applicability. For a typical technology company few controls are genuinely irrelevant, but every exclusion needs a reason an auditor will accept, and every inclusion needs records showing it operates.
How is ISO 27001 different from SOC 2?
SOC 2 is a US attestation: a CPA firm issues a report with its opinion on your controls against the AICPA Trust Services Criteria. ISO 27001 is an international certification: an accredited certification body certifies that your management system conforms to the standard. A SOC 2 report describes your controls in detail; an ISO 27001 certificate speaks to the system that chooses, runs and improves them. The controls overlap heavily, so one well-built program can produce evidence for both.
What happens once the certificate is issued?
Certification is maintained, not earned once. The certification body returns for surveillance audits at least annually and performs a full recertification audit at the end of each certification cycle. In between, your internal audits, management reviews, risk reviews and corrective actions have to keep running, because the auditor samples records from the whole period, not just the weeks before a visit.
Does it matter which certification body we pick?
It matters that the certificate is accredited. Look for a certification body accredited for ISO/IEC 27001 by an accreditation body that belongs to the IAF multilateral recognition arrangement, such as ANAB in the US or UKAS in the UK, so buyers in other countries recognize the certificate. Procurement teams often reject certificates from unaccredited bodies, and many check accredited certificates through the IAF CertSearch database.
Can we start with a narrow scope?
Yes. A focused scope, such as one product and the teams and infrastructure that run it, is common and legitimate, provided its boundaries and interfaces are documented. Make sure it covers what your customers actually care about: a scope that leaves out the systems a buyer relies on tends to be challenged in procurement even when the certification body accepts it.
Is ISO 27001 on your desk?
One conversation with someone who does this work. You leave knowing where you likely stand and what readiness would involve for you.