To get ISO 27001 as a startup, you build an information security management system (ISMS), define its scope, assess risks, select controls from Annex A, run them for a period, audit yourself and then pass a two stage audit by an accredited certification body. A focused startup scope can be small, and the work is mostly decisions and records.
Key takeaways
- ISO 27001 certifies a management system, not a product. Scope decides how big the effort is.
- The standard has seven mandatory clauses (4 to 10) and an Annex A of 93 controls in four themes.
- You choose Annex A controls by risk and record the choice in a Statement of Applicability.
- Certification comes from an accredited certification body after a Stage 1 and Stage 2 audit.
- Do not call a company certified until the certificate exists. Do not call a tool certified.
What is ISO 27001, in plain terms?
ISO 27001 is an international standard for running information security as a managed process. You decide what to protect, assess the risks, apply controls, check they work and improve. The 2022 edition has management clauses 4 to 10 (context, leadership, planning, support, operation, performance evaluation, improvement) and an Annex A with 93 controls.
Annex A groups its controls into four themes: organizational (37), people (8), physical (14) and technological (34). These counts and the clause list come from secondary summaries of the standard, so check them against your copy of ISO/IEC 27001:2022, which you can buy from ISO or a national body.
How do you get ISO 27001 as a startup, step by step?
Follow these ten steps in order.
- Get a reason and a sponsor. Name the customer or market need. Pick an executive sponsor and a day to day owner.
- Define the scope. Decide which products, locations, teams and systems the ISMS covers. A startup often scopes one product and the staff who build and run it.
- List interested parties and requirements. Customers, regulators, contracts, employees. This is clause 4 work.
- Write the security policy and set objectives. Keep them short and approved by leadership.
- Run a risk assessment. List assets and threats, rate likelihood and impact, and decide on treatment: reduce, accept, transfer or avoid. A risk register holds the result.
- Write the Statement of Applicability. For every Annex A control, say whether it applies, why, and how it is met.
- Implement the controls. Access control, backups, change management, supplier checks, awareness training, incident handling, secure development and the rest of your selected set.
- Run the ISMS and collect records. Hold the management review, do access reviews, track incidents and keep dated evidence.
- Run an internal audit. Someone independent of the work checks the ISMS against the standard and your own rules. Fix the findings.
- Book the certification audit. Stage 1 reviews your documentation and readiness. Stage 2 checks that the controls operate.
How long does it take?
It depends on scope, existing controls and how much time the owner has. Beyond the stages above, we did not fetch a primary source with a standard duration, so we do not give a number. Ask two or three certification bodies for their typical lead times and plan backwards from the date your customer needs the certificate.
What does the Statement of Applicability look like?
It is a table with one row per Annex A control. Keep it plain.
| Control | Applies | Reason | How it is met |
|---|---|---|---|
| Access control to code repositories | Yes | Source code is a core asset | SSO, MFA and quarterly access review |
| Physical security of offices | Limited | Remote first team | Policy for home and shared workspaces |
| Supplier security | Yes | We process customer data in cloud services | Vendor review at onboarding and yearly |
A control marked as not applicable needs a reason an auditor can accept.
What do startups get wrong?
The most common mistakes are scope too wide, policies copied without changes, and controls that exist on paper only. Auditors test whether you do what your documents say.
Other traps: no internal audit before Stage 1, no management review record, and a risk register nobody updates after the first month.
Do you need a tool or a consultant?
You can do it with documents and a shared drive. Tools help with recurring evidence and reminders, and a consultant helps if nobody on staff has run an ISMS. You choose the certification body independently of either.
How does ISO 27001 relate to SOC 2?
Both ask you to define controls and prove they run, but ISO 27001 certifies a management system through an accredited body, while SOC 2 is an attestation report from a CPA firm. Controls overlap, so framework mapping can save repeated work.
Click through it at your own pace, or open it full screen.
Frequently asked questions
Is ISO 27001 mandatory for startups?
No. It is voluntary. Customers or tenders may ask for it.
What is the difference between Stage 1 and Stage 2?
Stage 1 reviews your documentation and readiness. Stage 2 audits whether the ISMS and selected controls are implemented and working.
Can we scope only one product?
Yes. The scope is your choice, but it must be honest and match how the business actually runs.
Can a company say it is ISO 27001 compliant?
Say what is true: certified once an accredited body has issued the certificate, and state the scope. Before that, say you are working toward it.
How is it different from SOC 2?
ISO 27001 is a certification of a management system. SOC 2 is a report by a CPA firm on controls against the Trust Services Criteria.
Sources
- NIST Risk Management Framework overview
- Search summaries of ISO/IEC 27001:2022 structure (clauses 4 to 10, Annex A themes and counts), reviewed 19 October 2026. ISO's own pages returned an access error, so verify against the standard.
Last reviewed: 19 October 2026.
