ISO 27001 certification readiness, end to end.
An Information Security Management System aligned with the 2022 revision of ISO/IEC 27001. Scoping, risk treatment, Statement of Applicability, Annex A control rollout across all 93 controls and four themes, internal audit, and Stage 1 plus Stage 2 audit support with your accredited certification body.
Related from Petronella Technology Group: Full ISO 27001 certification consulting workflow, the broader multi-framework compliance hub, and for DoD-aligned manufacturers, CMMC Level 1, Level 2, and Level 3 readiness.
What ISO 27001 actually is
ISO/IEC 27001 is the international standard published jointly by the International Organization for Standardization and the International Electrotechnical Commission that specifies the requirements for an Information Security Management System, abbreviated ISMS. Certification is awarded after a third party accredited certification body completes a two-stage external audit and concludes that the organization conforms to the standard.
An ISMS is not a stack of tools and it is not a policy binder. It is a documented management system, in the same family of management-system standards as ISO 9001 for quality and ISO 14001 for environmental management. It defines how the organization identifies risks to the confidentiality, integrity, and availability of information, how those risks are treated, and how the management system is monitored, reviewed, and continually improved. The standard is built on the Plan-Do-Check-Act cycle and Clauses 4 through 10 are mandatory requirements every certified organization must satisfy.
The 2013 to 2022 transition
The current edition is ISO/IEC 27001:2022, published in October 2022 to replace the long-running 2013 edition. Organizations already certified against the 2013 edition were given a three-year transition window. That window closed on 31 October 2025, which means every certificate issued today is against the 2022 edition. If you are starting fresh, you start at 2022. If you held a 2013 certificate, you have either already transitioned or your certificate has lapsed.
The Annex A control set was restructured in the 2022 revision. The 2013 edition published 114 controls across 14 sections. The 2022 edition reorganized those into 93 controls across four themes - organizational, people, physical, and technological - and added 11 net-new controls that reflect modern operating realities such as cloud services, threat intelligence, ICT readiness for business continuity, data masking, secure coding, and configuration management.
Why this standard matters now
Three currents have made ISO 27001 the de facto information security certification for B2B customer security questionnaires and procurement gates. First, supply chain due diligence has tightened across nearly every regulated sector - financial services, healthcare, federal contracting, software-as-a-service - and buyers now want a third party attestation, not a self-attestation. Second, the EU NIS2 Directive and DORA have made management-system thinking the lingua franca for cyber resilience in Europe, and US buyers increasingly mirror those expectations. Third, ISO 27001 crosswalks cleanly to SOC 2 Type II, HIPAA Security Rule, NIST Cybersecurity Framework 2.0, NIST SP 800-171, and the Cybersecurity Maturity Model Certification - which means a single well-built ISMS reduces the marginal cost of every adjacent attestation.
Who actually needs ISO 27001
ISO 27001 is not the right starting framework for every organization. These six profiles are the ones that consistently see return on the investment, and the ones our intake conversation centers on.
SaaS and managed-service vendors
If your buyers are mid-market and enterprise, the security questionnaire that arrives with every renewal cycle asks one question first - "Are you ISO 27001 certified or SOC 2 attested?" Certification shortens sales cycles, deflects questionnaires, and replaces dozens of one-off attestations with a single audit report.
Financial services and fintech
Banks, payment processors, lenders, and broker-dealers carry overlapping obligations under the GLBA Safeguards Rule, FFIEC examination guidance, the New York DFS Part 500, and PCI DSS. ISO 27001 provides a single management-system spine that satisfies the management-system expectations baked into every one of those regimes.
Federal contractors and subcontractors
DoD primes flowing CMMC Level 2 and Level 3 down to their supply chain often ask for ISO 27001 in parallel. The Annex A control catalogue and the NIST SP 800-171 control set overlap heavily, and a single ISMS that maps to both reduces the audit burden on the contractor.
Healthcare technology and BAAs
Business associates serving HIPAA covered entities increasingly attach ISO 27001 certification to their Business Associate Agreement package. It is the cleanest way to demonstrate a documented, audited management system for ePHI handling beyond the administrative simplifications of the Security Rule.
International expansion candidates
US companies opening UK, EU, or APAC operations face buyers and regulators for whom ISO 27001 is the default common language. Showing up to a London or Frankfurt procurement conversation without an ISO 27001 certificate is an immediate trust deficit. With it, the conversation moves to scope and price.
Customer-questionnaire fatigue
If your security team is spending more than two days a month answering Excel questionnaires, the math has tipped. The annual cost of certification, amortized across every avoided questionnaire and every accelerated procurement cycle, has positive ROI for most teams above 25 people.
The Annex A control catalogue
The 2022 revision regrouped the Annex A controls under four themes. The "new in 2022" tag flags the 11 controls that did not exist in the 2013 edition - these are the controls that surprise organizations transitioning from the older standard and the controls that frame modern audit conversations.
Scope. Assess. Build. Audit. Certify. Maintain.
Every Petronella Technology Group ISO 27001 engagement runs through six phases. The middle four take the bulk of the timeline. Most organizations land between six and eighteen months from kick-off to Stage 2 audit, depending on starting maturity, scope size, and rate of management decision making.
Define the ISMS boundary
The most consequential decision in the entire engagement. Scope wrong and either the audit fails or the certificate is not worth printing. We define context per Clause 4, identify interested parties, draft the scope statement, and document business processes, locations, assets, and information flows inside the boundary.
- Clause 4 context analysis
- Interested-party register
- Scope statement and exclusions
- Asset, location, and information-flow inventory
- Management leadership commitment per Clause 5
Measure current versus required
A structured assessment against every clause from 4 through 10 and every applicable Annex A control. The output is a quantified gap register that becomes the project plan. We use the same ISO 27005-style risk methodology that will live inside the running ISMS, so the gap assessment doubles as the first formal risk assessment.
- Clause-by-clause conformance scoring
- Annex A control applicability draft
- Risk register seeded per ISO 27005
- Effort estimate and remediation roadmap
- Executive readout to the management team
Statement of Applicability and risk treatment plan
The Statement of Applicability is the single deliverable certification bodies scrutinize hardest. Every one of the 93 Annex A controls must be addressed - applicable or not, with justification. The risk treatment plan ties every identified risk to a chosen treatment - modify, retain, avoid, or share - and to specific Annex A control selections.
- Full 93-control SoA with applicability decisions
- Justification for each exclusion
- Risk treatment plan tied to control selections
- Risk owner assignments
- Residual risk acceptance by management
Build, document, and operate the controls
The phase where most of the calendar burns. Policies are authored for your environment, not pulled from a template library. Technical safeguards are deployed and validated. Training is rolled out. Records start accumulating, because by the time the certification body arrives, you need at least three months of operational evidence.
- Policy and procedure authorship
- Access management and identity rollout
- Logging, monitoring, and SIEM evidence pipeline
- Workforce training per Clause 7.2
- Supplier security per A.5.19 through A.5.23
Pre-certification dry run
Clause 9.2 requires the ISMS to be internally audited at planned intervals. Before the external audit, we run a full internal audit against every clause and every applicable control, write up nonconformities, drive remediation, and perform the management review required by Clause 9.3. This is the dress rehearsal that materially changes Stage 2 outcomes.
- Internal audit plan and audit program
- Audit execution against full ISMS scope
- Nonconformity register and corrective actions
- Management review meeting per Clause 9.3
- Readiness sign-off for Stage 1
Stage 1, Stage 2, surveillance, recertification
You select an accredited certification body. We do not perform the certification audit - that would be a conflict of interest under ISO/IEC 17021 - but we sit at the table during Stage 1 and Stage 2, manage findings, and operate the ISMS through the three-year certification cycle of two surveillance audits and one recertification audit at year three.
- Accredited certification body selection support
- Stage 1 documentation audit attendance
- Stage 2 on-site assessment support
- Year 1 and Year 2 surveillance audits
- Year 3 recertification preparation
Penny answers the phone. Craig signs the engagement letter.
Petronella Technology Group is headquartered at 5540 Centerview Dr., Suite 200, Raleigh, NC 27606. Our front-line AI agent answers before the third ring, asks three qualifying questions, and books your free 15-minute ISO 27001 readiness consult directly on Craig's calendar. From signed engagement letter to first scoping workshop is typically within five business days.
ISO 27001 and the adjacent frameworks
A well-built ISO 27001 ISMS does most of the heavy lifting for SOC 2, HIPAA, NIST CSF, NIST SP 800-171, and CMMC Levels 1 through 3. The marginal cost of each additional attestation drops sharply once the management system is in place. The overlap is not 100 percent - here is the honest crosswalk.
Stage 1 versus Stage 2 - what the auditors actually look for
The external certification audit happens in two distinct stages, separated by anywhere from two weeks to six months depending on findings. Both stages are conducted by the same accredited certification body, and the body cannot have been involved in building your ISMS.
Stage 1 - the documentation audit
Stage 1 is largely a documentation review. The auditor verifies that the ISMS exists on paper, that scope is defined, that mandatory documented information per Clauses 4 through 10 is present, that the Statement of Applicability is complete, and that the internal audit and management review have been performed. Stage 1 typically runs one to three days for a mid-sized scope.
Stage 1 findings usually fall into three buckets. Missing documents - the SoA is incomplete, the risk treatment plan is not signed off, an internal audit has not been performed. Inconsistencies between documents - the scope statement names a location the asset inventory does not include. Readiness concerns - controls are documented but no operational evidence exists yet. Major nonconformities at Stage 1 will block the move to Stage 2.
Stage 2 - the implementation audit
Stage 2 is the on-site implementation audit. The auditor verifies that the ISMS is being operated as documented - that controls are not just designed but actually running, that evidence is being captured, that nonconformities are being managed, that workforce members understand their security responsibilities, and that management is reviewing performance. Stage 2 typically runs three to ten days, depending on scope size and number of locations.
Common Stage 2 findings: workforce members cannot describe the security policies they have signed. Access reviews are scheduled but never executed. Supplier security clauses are in contracts but not in the supplier inventory. Audit logs exist but no one reviews them. Information classification is documented but the classification is not visible on actual documents. The recurring theme is the gap between documented intent and operational practice.
Surveillance years 1 and 2, recertification year 3
An ISO 27001 certificate is valid for three years. During year one and year two after issuance, the certification body returns to perform a surveillance audit - shorter than Stage 2, typically one to three days, sampling a subset of the ISMS. At year three the body performs a recertification audit - similar in scope to Stage 2 - and issues a new three-year certificate. Surveillance audits are not optional. Skipping or failing a surveillance audit can result in certificate suspension or withdrawal.
The Statement of Applicability - the most-missed deliverable
The Statement of Applicability, called the SoA, is required by Clause 6.1.3 part d. It is the document that lists every one of the 93 Annex A controls and states - for each one - whether it is applicable to the scope, what the justification is, and whether the control is currently implemented. The SoA is the single document the certification body will return to throughout both stages, and the document mid-tier auditors weight most heavily.
The most common SoA failure mode is treating it like a tick-box. An auditable SoA does four things. First, every applicable control has a justification rooted in the risk treatment plan, not a generic "industry best practice" line. Second, every excluded control has a defensible justification that does not undermine scope. Third, implementation status is honest - "implemented" is reserved for controls with operational evidence. Fourth, the SoA is versioned and reviewed at each management review per Clause 9.3.
The SoA is also the document that travels. When a customer asks for proof of your ISO 27001 posture and you do not yet have the certificate, the SoA is the artifact you send. A well-built SoA does more to advance enterprise sales conversations than the certificate itself.
Risk treatment and the risk register
Clause 6.1.2 requires a documented risk assessment process. ISO/IEC 27005 is the companion standard that walks through risk-management methodology in detail. The output is a risk register - a structured list of identified risks, each scored by likelihood and impact, each owned by a named risk owner, each tied to a treatment decision, and each tied to specific Annex A controls.
Petronella Technology Group operates risk assessments on a quantitative-enough basis to defend in audit. We score likelihood on a five-band scale tied to historical frequency or expert judgment, impact on a five-band scale tied to financial, regulatory, reputational, and operational consequence, and inherent risk as the product of the two. Treatment options under Clause 6.1.3 are modify (reduce), retain (accept), avoid, or share (transfer). Residual risk after treatment is calculated and accepted by named management with documented sign-off.
The risk register is not a one-time artifact. It is reviewed at every management review, updated when material change occurs - new product line, new geography, new supplier dependency, new regulation, new threat intelligence - and is the input to the SoA at every revision cycle.
What ISO 27001 costs
Honest answer first - there is no fixed price. ISO 27001 cost varies by scope, headcount inside scope, number of physical locations, current maturity, and the rate of management decision making. Here is the structure we quote against.
The four cost components
Every ISO 27001 program has four distinct cost centers, and any single quoted "ISO 27001 price" that does not break these out is hiding something:
- Consulting engagement. Petronella Technology Group fees for scoping, gap assessment, SoA build, risk treatment, controls implementation support, internal audit, and certification-stage support. Typically the largest line item in year one.
- Internal labor cost. Your team's time. Policy authorship review, evidence collection, audit interviews, training rollout. Counted in human-days, not dollars - but real.
- Technology investment. Any net-new tooling required by the SoA - SIEM, identity management, vulnerability scanning, DLP, MDM, configuration management. Many organizations already have most of these.
- Certification body fees. Paid directly to the accredited body that performs Stage 1, Stage 2, and the three-year surveillance and recertification cycle. Typically the smallest line item but the one most often overlooked.
Scope drivers
Scope is the single biggest cost variable. A 25-person SaaS company with a single AWS account, one office, and a clean asset boundary will quote dramatically lower than a 300-person hybrid-cloud organization with eight locations, three product lines, and an active acquisition pipeline. The scope statement is also the deliverable that decides whether the certificate is worth printing. We invest heavily in Phase 01 because every downstream dollar depends on getting it right.
ISO 27001 questions answered
The questions buyers actually ask on the discovery call. If yours is not here, book the consult and we will answer it on the call.
How long does ISO 27001 certification take?
Six to eighteen months from kickoff to a Stage 2 audit pass is the honest range. The most common timeline for a mid-sized organization with reasonable starting maturity is nine to twelve months. Organizations with mature security programs that need only the ISMS wrapper can compress to six. Organizations starting from a low baseline with multiple locations should plan for eighteen.
What is the difference between ISO 27001 and SOC 2?
ISO 27001 is an international standard that certifies the existence of an Information Security Management System. SOC 2 is an AICPA reporting standard that produces an attestation report on operating effectiveness of selected Trust Service Criteria. The two cover most of the same ground but produce different deliverables - ISO produces a certificate, SOC 2 produces a 50-to-150-page report. Most organizations doing business across both US and international markets pursue both. The work can be sequenced off a shared control evidence base. See our SOC compliance page for the SOC 2 side.
Can a small company realistically get ISO 27001 certified?
Yes, and increasingly often. Some of our smallest engagements are 10-to-25-person SaaS companies whose enterprise buyers refuse to renew without an ISO 27001 certificate. Cost scales with scope, not with revenue. A small company with a tight scope can pursue certification economically. The break-even point most often arrives when you have a deal worth at least the annual fully loaded cost of certification that you cannot close without it.
Do we have to implement every Annex A control?
No. You must address every Annex A control in the Statement of Applicability, but addressing a control includes the decision to exclude it. Exclusion must be justified - the control is not applicable to scope, the control is implemented through an equivalent compensating measure, or the risk it addresses is accepted. The justification has to hold up to auditor scrutiny.
Who issues the actual ISO 27001 certificate?
An accredited certification body. Examples in the US include Schellman, A-LIGN, Coalfire, BSI, TUV, DNV, and several others. We do not issue certificates - that would be a conflict of interest under ISO/IEC 17021, which prohibits the same firm from both building and auditing an ISMS. We help you select an accredited body, prepare for both audit stages, and operate the ISMS through the three-year cycle.
Is ISO 27001 the same as ISO 27002?
No, but they are intentionally paired. ISO 27001 is the certifiable standard that contains the management-system requirements and Annex A as a control catalogue. ISO 27002 is the implementation guidance document that provides detailed text on each Annex A control - what to do, how to do it, and how to evidence it. You are certified against 27001 but you implement using 27002.
What happens if we fail Stage 2?
A Stage 2 audit that produces major nonconformities does not issue a certificate. You have a defined window - usually 90 days - to close the nonconformities, and the certification body returns for a verification visit. Major nonconformities are not common on Stage 2 if the internal audit was honest and remediation was complete. They are common when an organization tries to certify against a half-built ISMS. Phase 05 in our roadmap exists specifically to prevent this.
How does ISO 27001 work with our CMMC compliance?
An ISO 27001 ISMS is a strong foundation for CMMC at every level. CMMC Level 1 covers FAR 52.204-21 basic safeguarding and maps to a subset of Annex A. CMMC Level 2 maps to NIST SP 800-171, which maps closely to Annex A. CMMC Level 3 adds NIST SP 800-172 enhancements on top. The ISMS feeds the CMMC System Security Plan directly. Petronella Technology Group consults on all three CMMC levels and the relationship to ISO 27001 is one of the most asked-about topics in our discovery conversations. See our CMMC compliance pillar.
Do we need to be ISO 27001 certified before we can sell to the EU?
Not legally, but practically yes for B2B sales above a certain deal size. The EU NIS2 Directive does not name ISO 27001 by reference, but it does require management-system thinking for cyber resilience, and ISO 27001 is the default common language. UK and EU procurement teams routinely ask for ISO 27001 by name in security questionnaires. The same is increasingly true of large Asia-Pacific procurement teams. If international expansion is on the roadmap, ISO 27001 belongs on the roadmap.
Can we get ISO 27001 if all our data is in the cloud?
Yes. Cloud-first organizations are the cleanest scope to certify. The 2022 revision added A.5.23 information security for use of cloud services specifically to address the modern cloud-native operating model. Your scope statement will name the cloud services in use, the shared-responsibility split will be documented, and the auditor will validate that you are operating your half of the responsibility. We help cloud-native organizations get certified every year.
How is ISO 27001 different from the NIST Cybersecurity Framework?
NIST CSF is a voluntary framework. It is not audited, not certified, and not externally attested. ISO 27001 is a certifiable management-system standard with mandatory third party audit. The two map cleanly to each other - the six CSF 2.0 functions tie to ISO Plan-Do-Check-Act and to specific Annex A control families. We frequently use CSF tier as an internal maturity gauge inside an ISO 27001 program. For the formal NIST mapping, see our NIST compliance page.
Who at Petronella Technology Group leads the engagement?
Craig Petronella, CMMC-RP, CCNA, CWNE, DFE #604180, MIT-Certified in AI and Blockchain, is engagement lead on every ISO 27001 program. Petronella Technology Group has been operating since 2002, holds a BBB A+ rating continuously since 2003, and is CyberAB RPO #1449. Engagement teams include CMMC Registered Practitioners and information security specialists. Office is at 5540 Centerview Dr., Suite 200, Raleigh, NC 27606.
Adjacent compliance and security work
ISO 27001 sits at the center of a broader compliance estate. These are the spokes our clients pair with their ISMS most often.
ISO 27001 Certification Consulting
Full implementation workflow, accredited body selection, Stage 1 and Stage 2 audit support, and surveillance-cycle operation.
Read more →Multi-framework compliance hub
CMMC, HIPAA, SOC 2, NIST, PCI DSS, FTC Safeguards, GDPR, and ISO/IEC family - the broader compliance estate Petronella delivers.
Read more →SOC 2 Type II
AICPA Trust Service Criteria attestation. Most efficiently run alongside ISO 27001 off a shared control evidence base.
Read more →HIPAA Compliance
Privacy and Security Rule alignment under 45 CFR 160 through 164. The full Petronella Technology Group HIPAA pillar.
Read more →CMMC Compliance L1 / L2 / L3
DoD Cybersecurity Maturity Model Certification at all three levels, including C3PAO and DIBCAC assessment readiness.
Read more →NIST CSF 2.0 and SP 800-171
NIST Cybersecurity Framework alignment and the SP 800-171 Rev 3 control set that underpins CMMC Level 2.
Read more →Cybersecurity Services
The underlying security operations, managed detection and response, and vCISO services that operate Annex A technological controls.
Read more →Managed IT Services
The day-to-day IT operations layer that runs identity, endpoints, networks, and backup against your ISMS policies.
Read more →Penetration Testing
Annex A 8.8 vulnerability management and 8.29 security testing in development - external pen testing and red-team services that produce auditable evidence.
Read more →Digital Forensics and IR
Annex A 5.24 through 5.28 incident management readiness. DFE-led breach response and BYOD mobile incident scoping under your ISMS.
Read more →Start your ISO 27001 journey with a 15-minute call
Free scoping conversation with Craig Petronella. Honest answer on timeline and cost, an outline of the four phases that take the most calendar, and a recommendation on whether ISO 27001 is the right next compliance investment for your organization.