In the first 90 days of ISO 27001, a startup should set the scope, assign an owner, run a risk assessment, write the Statement of Applicability, start operating the controls and collect evidence. Certification comes later, from an accredited body, after a two-stage audit. The standard certifies your management system for a defined scope, not your product.
The 90-day sequence below is our suggestion, not part of the standard.
What is the standard asking for?
The sources we read (the standard itself is paywalled and its ISO page blocked our fetch, so we used a reference summary, listed below) describe it this way. ISO/IEC 27001 was first published in 2005, revised in 2013, and the current edition is from October 2022, with an amendment in February 2024 about climate change as a relevant issue. Clauses 4 to 10 hold the requirements: context, leadership, planning, support, operation, performance evaluation and improvement. You cannot skip them and claim conformity. Annex A lists a reference set of 93 controls in four themes: organizational, people, physical and technological. You justify choices in a Statement of Applicability.
Certification is voluntary unless a law, contract or scheme requires it, and it covers only the stated scope.
Days 1 to 30: scope and ownership
- Write the scope in plain words: which products, teams, offices and data are in, and what is out. Smaller is fine for a first certificate if customers accept it.
- Name an owner with authority, and get leadership to sign a short information security policy.
- List assets and suppliers inside the scope.
- Decide on a risk method you can run in a spreadsheet: how you score likelihood and impact, and what level you accept.
Days 31 to 60: risks and controls
- Run the first risk assessment with the people who run the systems.
- Draft the risk treatment plan. Each risk gets a decision: reduce, accept, avoid or transfer.
- Build the Statement of Applicability from Annex A. For every control say whether it applies, why, and its status.
- Close the cheap gaps: multi-factor sign-in, access reviews, endpoint encryption, backup tests, a vendor review process, onboarding and offboarding checklists.
Days 61 to 90: operate and prove it
- Start producing records: access review results, change tickets, vulnerability scan results, training attendance, incident log.
- Run an internal audit against the clauses and controls, using someone independent of the work being audited.
- Hold a management review and keep minutes.
- Choose an accredited certification body and agree scope and dates.
Evidence automation helps here: exports of users, scans and change records on a schedule. Safeguard's compliance automation can help organize dependency and vulnerability evidence, and it does not certify you or replace a certification body. See how framework mapping looks below.
Open the full version at /demos/framework-mapping.
What happens at the audit?
An accredited certification body runs two stages. Stage 1 is a readiness review of documents such as the policy, the Statement of Applicability and the risk treatment plan, plus scope and context. Stage 2 is a detailed test that the system is designed, implemented and operating, where auditors sample controls and report findings. The decision is made by staff who did not do the audit. The first surveillance audit comes within 12 months and surveillance is annual, with recertification on a three year cycle.
Because Stage 2 tests operation, you need some weeks or months of records before it. Ninety days gets you ready to operate, not usually ready to certify.
What to do
- Write the scope and sign the policy this week.
- Pick the risk method and run the assessment by day 45.
- Finish the Statement of Applicability by day 60.
- Schedule evidence exports and name owners for each control.
- Run the internal audit and management review by day 90.
- Request quotes from two accredited certification bodies.
Quick check
Does ISO 27001 certify our product?
No. It covers your information security management system within the stated scope. It does not guarantee against incidents.
Can we skip Annex A controls?
You can exclude controls that do not apply, if you justify it in the Statement of Applicability. Clauses 4 to 10 cannot be skipped.
Sources
- Wikipedia: ISO/IEC 27001, used as a reference summary because the ISO page returned an access error when we fetched it
Last reviewed: 18 October 2026.
