Automate ISO 27001 readiness with adaptive compliance

ISO/IEC 27001 is published jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC)

ISO writes the standard but does not certify anyone against it. Certification is issued by independent certification bodies, which are in turn accredited by national accreditation bodies such as ANAB in the United States and UKAS in the United Kingdom.

ISO 27001 specifies the requirements for establishing, implementing, maintaining, and continually improving an information security management system (ISMS).

Differing from other standards such as SOC 2, ISO 27001 evaluates whether you are actually running a management system — leadership involvement, risk assessment, defined objectives, internal audit, management review, and corrective action.  The standard is built from two parts: management system requirements in Clauses 4 through 10, and a normative reference set of information security controls in Annex A.

They answer the same buyer question in different markets, and most companies selling internationally end up with both.

Geography. SOC 2 is the default in US enterprise procurement. ISO 27001 is the default nearly everywhere else — Europe, the UK, Japan — and is recognized internationally through the IAF Multilateral Recognition Arrangement.

What they evaluate. SOC 2 tests whether your controls met defined criteria over a period. ISO 27001 tests whether you run a management system — leadership, risk assessment, internal audit, management review, continual improvement — with Annex A as a reference set to check your controls against.

Who performs it. SOC 2 is an examination by an independent licensed CPA firm under AICPA professional standards. ISO 27001 is an audit by a certification body accredited by a national accreditation body such as ANAB or UKAS.

What you get. SOC 2 produces a report containing an opinion, usually shared under NDA. ISO 27001 produces a certificate you can publish.

How you can fail. A SOC 2 opinion is either unmodified or modified, and a clean report can still contain exceptions. ISO 27001 records nonconformities, and a major one blocks certification until it's corrected and verified.

How long it lasts. A SOC 2 report covers a historical window and buyers treat it as credible for about a year, bridged by a gap letter. An ISO 27001 certificate runs a three-year cycle with annual surveillance audits.

The good news is that the underlying evidence overlaps heavily. Most of what you collect for one is reusable for the other, which is why doing the second one is considerably less work than doing the first.

No — and this is the single most common misconception about ISO 27001.

Annex A is a reference set, not a mandatory checklist. The standard asks you to determine the controls you need from your own risk assessment, then compare that set against Annex A to confirm you have not inadvertently left out something necessary. If the comparison surfaces a gap, you update your risk treatment plan and implement it. If it does not, you have satisfied the requirement.

You then document the results in a Statement of Applicability — which controls apply, why they apply, whether they are implemented, and your justification for excluding any that do not.

ISO 27001 is the requirements standard, and what you actually certify against. ISO 27002 is the companion guidance document: it describes each control in depth, with purpose, attributes, and implementation advice.

You cannot be certified to ISO 27002. Teams still buy it, because Annex A of 27001 gives you control titles while 27002 tells you what implementing each one actually involves.

Initial certification runs in two stages, both performed by an accredited certification body.

• Stage 1 is a readiness and design review. The auditor examines your ISMS documentation, your defined scope, your Statement of Applicability, and your risk assessment — and confirms you are ready to be audited properly.
  
• Stage 2 tests whether the ISMS is actually implemented and operating effectively across your scope, through evidence sampling and interviews.

Gaps found at Stage 1 are your chance to fix things before they count against you. Note also, you must complete an internal audit and a management review before Stage 2 (clauses 9.2 and 9.3). 

A certificate issued by the certification body, plus an audit report.

The certificate names your scope statement, which matters more than most buyers realize: a certificate covering one product line is not a certificate covering your whole company.

Clause 4.3 requires you to determine the boundaries and applicability of the ISMS, taking account of internal and external issues, interested-party requirements, and the interfaces and dependencies between what you do and what other organizations do on your behalf. The scope has to exist as documented information.

In practice the scope statement names five things:

1. What it protects: the products, services, or business activities the ISMS covers.

2. Which part of the organisation: the legal entity, and whether it's the whole entity or specific divisions, teams, or functions.

3. Where: physical locations. Offices, data centers, and increasingly a statement about remote working.

4. Which systems: the technology boundary. Networks, infrastructure, applications, and which cloud services are inside it.

5. What's excluded, and why: anything carved out needs justification you can defend to an auditor.

By convention the statement also references your Statement of Applicability by version and date, which ties the scope to the specific set of controls you declared applicable at the time.

This matters because the scope statement is printed on the certificate, and it's chosen by you. A certificate covering one product line, one office, or one subsidiary is entirely legitimate — and it isn't a certificate covering your company. Sophisticated buyers read it before they read the badge, which is why it's worth writing a scope you'd be comfortable having quoted back at you rather than the narrowest one you can certify.

No standards body publishes a timeline, so treat any specific number — including this one — as an estimate rather than a fact.

For a first-time certification, most organizations take somewhere between three and twelve months from decision to certificate. Where you land depends on three things:

• How much you already do. If you're already running SOC 2, a lot of the control and evidence work transfers.
• How large your scope is. More entities, locations, and systems means longer.
• Your certification body's availability. Booking Stage 1 and Stage 2 is often the constraint, not your readiness.

The part teams underestimate: you can't certify a management system that started last week. Before Stage 2, you need to have actually run the ISMS — completed at least one internal audit and one management review, and accumulated records showing the controls operating over a period. That's a floor on the timeline no amount of implementation speed removes.

The audit itself is shorter than most people expect, and it isn't negotiated. Audit duration is set by the standard according to the effective number of people within your scope.

Audit findings are recorded as nonconformities, and the distinction between the two types is critical:

• Major nonconformity — a systemic failure, or an absent required element. Certification cannot be granted or maintained until you correct it and the certification body verifies the correction.
• Minor nonconformity — an isolated lapse. Typically resolved through a corrective action plan without blocking certification.

Auditors may also raise observations or opportunities for improvement, which carry no obligation.

So unlike examinations for other frameworks, like SOC 2, you can straightforwardly fail to achieve certification — and an existing certificate can be suspended or withdrawn if major nonconformities go unresolved.

Three years, on a defined cycle.

• The certificate is issued for a three-year term.
• Surveillance audits happen at least annually during that term. The first one must take place within 12 months of the certification decision.
• A full recertification audit happens before the three years expire, restarting the cycle.

Certification is a continuous obligation, not a one-time event. Skipping a surveillance audit can cause the certificate to be suspended.

No. ISO 27001 is a voluntary international standard, and no general law requires it.

In practice it functions as a commercial requirement rather than a legal one — particularly for selling into Europe, the UK, Japan, and enterprise procurement generally, where it is often the default expectation the way SOC 2 is in the US market.

No. Those certificates are no longer valid.

ISO/IEC 27001:2022 was published on 25 October 2022, and the transition period ran three years. All certifications issued against the 2013 edition expired or were withdrawn on 31 October 2025. If your certificate still references 2013, you are not currently certified and will need to complete a transition audit with your certification body.

The most visible change is Annex A. The control set was restructured from 114 controls across 14 clauses into 93 controls across 4 themes — Organizational, People, Physical, and Technological.

Of those 93: 11 are new, 24 are merged from existing controls, and 58 were updated. Each control now carries a stated purpose and a set of attributes, replacing the old grouped control objectives.

The management system clauses changed less. The notable addition is Clause 6.3, Planning for changes, which requires changes to the ISMS to be made in a planned way. Clause 4.2 also gained a requirement to determine which interested-party requirements will be addressed through the ISMS.

Only marginally.

ISO published a 2024 amendment adding climate change consideration to the context-of-the-organization clauses across its management system standards, ISO 27001 included.

It adds no new controls and no new documentation requirement — your context analysis simply needs to consider whether climate change is a relevant issue.

No compliance software can issue an ISO 27001 certificate. Certification must come from an independent certification body, accredited by a recognized accreditation body — that independence is the entire basis of the certificate's value.

Our platform acts as the engine room. It connects to your systems, gathers evidence continuously, manages your policies and Statement of Applicability, and hands your auditor an organized package instead of a scramble. If you would like to work with one of the certification bodies we partner with, please book a demo to explore the compliance solution. Existing customers can reach out to their rep for info about our audit partners. 

No, and if you sell into the UK, this one catches people off guard.

The Cabinet Office is explicit that organizations holding ISO 27001 "will not automatically conform to Cyber Essentials." The reason is structural: the five Cyber Essentials technical controls typically aren't all inside an ISO 27001 scope, and even where they are, they generally aren't tested as part of an ISO 27001 audit. Most organizations need Cyber Essentials in addition, or have to demonstrate equivalent controls to the buyer's satisfaction.

The good news is that most of the work is already done. If you're running an ISMS, you almost certainly operate the five controls —the gap is evidencing them in the form Cyber Essentials asks for.