ISO 27001 without the parallel paperwork universe

For a 30-150 person SaaS company starting from a reasonable security baseline, expect 4-7 months to certification. Roughly 6-10 weeks to build the ISMS, scope, policies, risk register, and SoA. Then a 3-month operating window so the auditor has evidence of controls running. Then Stage 1 and Stage 2, typically 3-6 weeks apart. Companies starting from zero — no SSO, no formal change management — should plan closer to 9 months.

SOC 2 is a US attestation report against the AICPA Trust Services Criteria, written by a CPA firm, and it's prescriptive about controls. ISO 27001 is an international certification of a management system, issued by an accredited certification body, and it's risk-driven — you justify which controls apply via the SoA. SOC 2 reports are read by US buyers; ISO certificates open doors in EMEA, APAC, and federal. They share roughly 70% control overlap, so doing both is far cheaper than 2x.

No. The 2022 revision consolidated the old 114 controls into 93 across four themes: Organizational (37), People (8), Physical (14), and Technological (34). You apply only the controls relevant to your scope and risks, and you document the rest as not applicable in the SoA with justification. A pure-SaaS company with no offices typically excludes most physical controls. Auditors care that exclusions are reasoned, not that the count is high.

Yes, and we routinely integrate with all three. They're useful for evidence collection — pulling configs from AWS, GitHub, Okta, Jira — and for SoA tracking. They are not a substitute for the management system itself: risk methodology, internal audit, management review, and the actual control design still need real work. Treat the GRC platform as evidence plumbing, not as the ISMS. Auditors notice when a company outsourced thinking to a dashboard.

After a successful Stage 2 audit, your certification body issues a 3-year certificate. Year 1 and Year 2 you get surveillance audits — shorter, focused on a subset of controls plus any nonconformities. Year 3 is the recertification audit, a full re-examination. Pick an accredited body (UKAS, ANAB, etc.) — non-accredited certificates exist and are not respected by enterprise procurement. Budget roughly $15-40k/year for audit fees depending on scope and headcount.

The technological controls — A.8.25 secure SDLC, A.8.28 secure coding, A.8.29 security testing, A.8.31 separation of environments, A.8.32 change management — should map directly to GitHub branch protection, required reviewers, CodeQL/Semgrep in CI, separate AWS accounts per environment, and your Jira change workflow. We don't add a parallel approval process. We document the workflow you already run and produce evidence artifacts (PR exports, CI logs, Terraform plans) the auditor can sample.

ISO 27001 isn't a federal requirement on its own — FedRAMP, CMMC, and NIST 800-171 are the gatekeepers there. But for SDVOSB primes and subs handling CUI or selling commercial SaaS to agencies, ISO 27001 is increasingly listed as a preferred or required qualification, especially for DoD-adjacent and intelligence community work. As a veteran-owned firm, we map ISO controls to NIST 800-53 and 800-171 so a single ISMS supports both commercial enterprise sales and federal pursuits.

There must be a named ISMS owner with authority — usually a CISO, head of security, or VP engineering at smaller companies. Compliance staff or fractional CISOs can run day-to-day operations, but ownership cannot live in legal or HR alone because most controls are technical. We recommend a small ISMS steering committee: ISMS owner, head of engineering, head of IT, and a business representative, meeting monthly. Management review happens at least annually with the executive team and is mandatory.

Four patterns: risk register that doesn't tie to the SoA or to real treatments; internal audit done as a checkbox by someone unqualified; management review that never happened or has no minutes; and evidence gaps where a control is documented but not actually operating — usually access reviews, supplier reviews, or change approvals. Auditors sample. If quarterly access reviews are a policy but you only ran one, that's a major nonconformity and certification gets delayed.