ISO 27001 consulting and certification

What ISO 27001 asks for and who issues the certificate

ISO/IEC 27001 asks for an information security management system (ISMS): a documented, verifiable way of deciding which information matters, which risks affect it and which controls keep those risks below a threshold the company has chosen. The current edition is ISO/IEC 27001:2022 with Amendment 1:2024.

Two features of the standard shape how the work is done. First, the requirements in clauses 4 to 10 (context, leadership, planning, support, operation, performance evaluation, improvement) cannot be excluded when claiming conformity, as clause 1 of the standard itself states. Second, the Annex A controls are not a list to tick off one hundred per cent. They are selected on the basis of risk and justified in the Statement of Applicability. The detailed implementation guidance for each control is in the companion standard, ISO/IEC 27002.

The certificate is not issued by the consultant, nor by a piece of software. It is issued by an accredited certification body. Under Regulation (EC) No 765/2008, each EU Member State appoints a single national accreditation body, and for management systems accreditation is granted against ISO/IEC 17021-1, with information security among the schemes covered.

When it makes sense: why companies start

Hardly anyone starts ISO 27001 out of passion. The reasons we see are four, and each one changes how the project is set up.

• An enterprise customer asks for it. It turns up in the supplier questionnaire or the contract, and the deal stops there. The date is what counts: you work backwards from the commercial date.
• A tender lists it as a requirement or an award criterion. You need a certificate with the right scope: the scope on the certificate has to cover the service you offer.
• A customer subject to NIS2 assesses you as a supplier. The NIS2 Directive lists supply chain security among the minimum cybersecurity risk-management measures (Article 21(2)(d)), and the requests travel down the supply chain.
• Start-ups and SaaS companies selling to large customers. Here the real question is ISO 27001, SOC 2 or both, and the answer depends on where your customers are.

Companies that already hold a certified system under another scheme, such as ISO 9001, start with an advantage. ISO 27001 adopts the common structure of management system standards (as its introduction states in clause 0.2), so management reviews, internal audits and document control can be shared in an integrated management system.

The path from gap to certificate, phase by phase

The phases partly overlap, but the order matters: each step produces documents that the next step uses and that the certification body will ask to see.

1. Gap analysis and scope

We measure the distance between what the company already does and what the standard asks for, requirement by requirement, with the evidence next to each status. At the same time the scope is decided: which services, sites, systems and suppliers are in. It is the choice that weighs most on the time and cost of the whole journey. What you end up with: a proposed scope with its rationale, the outcome for each requirement, and a remediation plan with owners and dates.

2. Risk assessment and Statement of Applicability

A methodology is chosen, applied to the scope, and a decision is made on how to treat each risk: reduce, transfer, avoid or accept it. This produces the Statement of Applicability, which lists the Annex A controls, says which apply and why the others are left out. What you end up with: methodology, risk register, risk treatment plan, Statement of Applicability. For the method, the reference standard in the family is ISO/IEC 27005.

3. Controls, policies and people

The policies that are genuinely needed are written and the selected controls are put into operation: access management, backup and restore, incident management, supplier assessment, secure development where there is software. Staff working within the scope are trained. What you end up with: approved policies, procedures, configurations, training records.

4. Running the controls and collecting evidence

A control that has just been written proves nothing. The auditor wants to see it running: the access review carried out, the restore test with date and outcome, the supplier assessed, the incident logged and closed. This phase can only be compressed so far, because evidence builds up over time. It is also the phase where manual collection costs most, and where a platform like Vanta changes the work (more on this below).

5. Internal audit and management review

These are requirements of the standard (clauses 9.2 and 9.3), so they have to be carried out before the certification audit, not promised. The internal audit checks that the system works and produces findings to close; the management review brings the results to management, which decides resources and priorities.

6. Certification audit: Stage 1 and Stage 2

The accredited body works in two stages. In Stage 1 it reviews the documentation and the company's readiness; in Stage 2 it checks on site that the controls are applied and effective, interviewing the people who run them. Any nonconformities raised are handled with the body before the certification decision.

7. After the certificate

The certificate lives within a certification cycle: the body returns for surveillance audits and, before expiry, for a recertification audit. In the meantime the system needs feeding: risks reviewed, internal audits, management reviews, training. Companies that treat the certificate as a finish line reach the first surveillance audit with months of evidence missing.

Time and cost: what they depend on

There is no standard duration, and a duration promised before seeing the scope describes a sales format, not your project. The factors that move the timeline, however, are known in advance:

• the breadth of the scope: services, sites, legal entities, systems and suppliers;
• the starting point: how many policies, roles and records already exist, and whether there is a certified management system to reuse;
• the running time new controls need to produce credible evidence;
• the availability of the people who actually run the systems, the most frequent constraint;
• the certification body's calendar for Stage 1 and Stage 2, which needs booking early.

As an external reference, Vanta states in the FAQ on its ISO 27001 page that most teams get certified in 12 to 24 weeks (vanta.com, page read on 14 October 2026). It is the vendor's figure about its own customers: not a market average and not a promise of ours.

Cost follows the same factors. There are four items: consulting support, the evidence platform, the certification body's audit and maintenance over the years of the cycle. The audit item is not discretionary: the body sets the audit days according to ISO/IEC 27006-1, starting from the number of people working within the scope. The item almost nobody puts in the quote is the time of your own people. We do not publish price lists: after the assessment we give you an estimate that separates our support from the cost of the certification body.

Where Vanta speeds things up and where it stops

The slow part of a certification is not writing the policies: it is proving, month after month, that the controls work. Vanta connects to the systems the company already uses (cloud, identity provider, HR, code repositories), runs hourly tests on the controls, collects the evidence and generates and updates the Statement of Applicability, linking each control to real tests and documents (ISO 27001 page on vanta.com, read on 14 October 2026). When a control stops being met, you know the next day, not on the eve of the audit.

Where it stops is just as clear:

• it does not certify: the certificate remains the accredited body's;
• it does not decide the scope or which risk to accept;
• it does not fix the controls it finds failing: remediation is done by whoever administers the systems;
• it does not see systems without an integration, where evidence collection remains manual work to plan.

The value grows when there is more than one framework, because the same vendor page points to reusing ISO 27001 evidence for SOC 2, GDPR and HIPAA.

What the company needs to provide

An advisor guides the journey, builds the documents with you and prepares the audit. Some things, however, stay inside the company, and the calendar depends on them more than on any tool:

1. A sponsor in management who approves the scope, the policy and the risk treatment plan, and takes part in the management review. Leadership is a requirement of the standard (clause 5) and the auditor checks it.
2. An internal point of contact, even part-time, who keeps the thread between advisor, IT and management.
3. The people who run the systems, available for interviews, configuration and remediation.
4. Access to the systems to connect to the platform, agreed with IT and with whoever handles personal data.
5. Time for training the staff within the scope, with a record of who has completed it.
6. The risk decisions: which risk is accepted is signed off by the company, not by whoever supports it.

The mistakes that make the journey longer

• Scope too broad. Declaring the whole company in the first round multiplies evidence, interviews and audit days. A scope that covers what customers ask for, to be widened later, works better.
• Documents instead of evidence. An approved policy proves that the policy exists, not that it is applied.
• A Statement of Applicability copied from a template. If the exclusions do not follow from the risks, Stage 1 brings it out straight away.
• The consultant writes everything alone. A system the people don't know does not hold up in the Stage 2 interviews.
• The certification body chosen at the last minute. Audit dates have to be booked: if they fall after the date the deal depends on, the work done is not enough.
• The certificate treated as a finish line. A system that stops after Stage 2 turns the first surveillance audit into a scramble.

How to choose a consultant and a certification body

They are two distinct roles, and they need to stay that way. ISO/IEC 17021-1, the standard against which bodies certifying management systems are accredited, requires them to safeguard impartiality and to keep certification separate from management system consultancy. In practice: whoever prepares you does not certify you, and a package that promises both from the same hand deserves a few more questions.

For the certification body

• check its accreditation for ISO/IEC 27001 in the public register of the national accreditation body that accredited it;
• ask for the quote in audit days, so proposals become comparable;
• ask for the available dates for Stage 1 and Stage 2 before fixing the rest of the plan.

For the consultant

• starts from a gap analysis with evidence, not from a pack of pre-filled documents;
• proposes a scope and explains the rationale;
• leaves the system in the hands of your people, with a trained internal point of contact;
• says clearly what stays with you, what with them and what with the certification body;
• has a plan for the whole certification cycle, not just the first audit.

What changes in 2026

• The transition to the 2022 version is over. The mandatory document IAF MD 26 set 31 October 2025 as the date by which certification bodies had to complete their clients' transition, and established that at the end of that period certifications based on ISO/IEC 27001:2013 expire or are withdrawn. Anyone certifying today works on the 2022 edition with the 2024 amendment.
• International coordination of accreditation has a new home. IAF ceased its activities on 1 January 2026 and its work continues in Global Accreditation Cooperation Incorporated, together with that of ILAC (notice on iaf.nu). For companies the substance does not change: accreditation stays with each country's national accreditation body.
• NIS2 and ISO 27001 overlap, but they are not the same thing. The NIS2 Directive asks for risk-management measures that take into account, where applicable, relevant European and international standards (Article 21(1)), and when it talks about certification it refers to the European cybersecurity certification schemes of Regulation (EU) 2019/881 for ICT products, services and processes (Article 24). An ISMS covers much of the work on risk, incidents, continuity and suppliers; registration, incident reporting and the accountability of management bodies remain obligations to handle separately. The full picture is on our NIS2 page.