ISO 27001 for startups: a realistic path to certification

Sooner or later an enterprise prospect sends the dreaded security questionnaire, or asks straight out: "Are you ISO 27001 certified?" Here's what that really means for a small team — and how to get there without stalling the business.

Why enterprise clients ask for it

ISO 27001 is the international standard for an Information Security Management System (ISMS). For a big customer, asking whether you're certified is a shortcut: instead of trusting your word, they trust an independent auditor who has checked that you manage security systematically. It de-risks the deal. That's why certification increasingly unlocks enterprise contracts, shortens procurement, and replaces endless one-off security questionnaires.

What ISO 27001 actually involves

It is not a firewall you buy or a scan you run. It's a management system — a set of repeatable processes wrapped around a risk assessment:

• Scope — what parts of the business and which systems are covered.
• Risk assessment and treatment — identify your information security risks and decide how to handle each.
• Controls — select and implement safeguards from Annex A (access control, encryption, supplier security, incident response, and more) based on your risks.
• Policies and evidence — document how you work, then generate records that prove you actually do it.
• Internal audit and management review — check yourselves and improve.

How long does it really take?

For a startup beginning from scratch, a realistic timeline to certification is roughly four to eight months, covering gap analysis, documentation, implementation, internal audit, and the two-stage certification audit. Teams that already have some controls in place can move faster. Be sceptical of anyone promising a certificate in six to eight weeks — corners cut there tend to surface during the audit.

How much effort — and how to keep it light

The biggest cost for a startup is usually attention, not licence fees. A few principles keep it manageable:

• Scope tightly. Certify the product and the team that builds it — not every corner of the company on day one.
• Right-size the controls. A 20-person SaaS doesn't need a 200-page policy library. Controls should fit your actual risk and stack.
• Use what you already have. Your cloud provider, identity system and code review process already cover many controls; ISO just asks you to formalise and evidence them.
• Automate evidence. Wherever possible, let tooling collect logs and records so audits don't become a manual scramble.
• Build it to be used. A system your team actually follows is easier to certify — and to keep certified — than shelfware.

ISO 27001 and ISO 42001 together

If you build or deploy AI, it's worth knowing that ISO 27001 is the natural foundation for ISO 42001 (AI management) and for EU AI Act readiness. The governance, risk process and documentation you build once can serve all three — which is why doing them as one integrated system is far more efficient than tackling each in isolation.

You don't get certified by buying tools. You get certified by running a system — and the point is a system that protects the business, not just satisfies the auditor.