The ISO 27001 certification process is not a single audit. It is a sequence: define the information security management system, assess risk, implement and operate controls, perform an internal audit and management review, then complete the certification body’s Stage 1 and Stage 2 audits.
For SaaS companies, the biggest mistake is treating ISO 27001 as a documentation project. ISO/IEC 27001:2022 is a management-system standard. It expects the company to run an ISMS that identifies information security risk, selects controls, monitors performance, handles nonconformities, and continually improves.
ISO/IEC 27001 is the requirements standard for information security management systems. The certification process below translates those requirements into a practical project plan for a growing technology company.
Step 1: Define the ISMS Scope
Your ISMS scope determines which products, teams, locations, systems, processes, and information are included. A vague scope creates confusion later, while an unnecessarily broad scope creates extra work.
Document the boundaries, interfaces, interested parties, and business context. A focused gap analysis at this stage helps separate existing strengths from the work needed before certification. For a SaaS company, the ISMS scope might cover the platform, production cloud environment, engineering, customer support, and the corporate systems that materially affect security.
The scope should also account for relevant requirements such as customer contracts, GDPR, HIPAA, SOC 2 commitments, and other regulatory obligations.
A certification body will review the ISMS scope during the audit, so it should be defensible and match how the business actually operates.
Step 2: Build the ISMS Structure and Documentation
An information security management system needs more than an information security policy. It includes governance, roles, risk processes, objectives, operating procedures, evidence, monitoring, internal audit, management review, and corrective action.
Define who owns the ISMS, who approves risk, how security objectives are set, how policies are controlled, how changes are managed, and how performance is reviewed.
Documentation should be proportional to the business. ISO 27001 compliance does not require a giant binder of policies. It requires enough controlled information to show that the system is defined and operating.
Step 3: Perform the ISO 27001 Risk Assessment
The ISO 27001 risk assessment is central to the ISMS. Identify information assets, threats, vulnerabilities, business impacts, existing controls, and the method used to rate risk.
The method must be repeatable. Teams should be able to explain why one risk is high and another is low, who owns each risk, and how risk acceptance works.
The output becomes the basis for the risk treatment plan. Treatment options usually include reducing the risk through controls, avoiding the activity, transferring risk, or accepting it within defined criteria.
Do not make the risk register an audit artifact that gets updated once a year. It should reflect meaningful changes in systems, vendors, products, and the threat environment.
Step 4: Create the Statement of Applicability
The Statement of Applicability, often shortened to SOA, explains which Annex A controls are applicable, which are not, and the reasons for those decisions. It also records implementation status.
The SOA connects the risk treatment process to the control set. A control may be selected because it addresses a risk, satisfies a legal or contractual requirement, or supports the security program more broadly.
ISO 27001:2022 organizes Annex A controls into organizational, people, physical, and technological themes. ISO 27002 provides additional guidance on those controls, but ISO 27002 is guidance rather than the certification requirements standard.
Avoid copying an SOA from another company. Applicability should follow your own risks and context.
Step 5: Implement and Operate the Controls
This is where ISO 27001 implementation becomes real data security work. Security controls may include access control, logging, supplier management, vulnerability management, backup, cryptography, incident response, secure development, physical security, and workforce practices.
For a cloud SaaS company, a policy that requires least privilege needs IAM configuration and access reviews. A cryptography requirement needs actual encryption configuration and key management. An incident response process needs roles, communication paths, exercises, and evidence.
The certification audit will look for operation, not just policy text. Build evidence as the controls run.
Step 6: Monitor the ISMS and Correct Problems
Define what you measure and how often. The program should also account for changing cyberattacks and threat patterns rather than assuming last year’s risk picture is still current. Useful measures may include overdue risk treatments, security incidents, access-review completion, vulnerability remediation, training completion, supplier reviews, or security objectives.
When the ISMS identifies a problem, record the issue, evaluate cause and impact, take corrective action, and verify the fix. That corrective action plan becomes part of continuous improvement.
Continuous compliance does not mean every ISO activity is automated. It means the management system continues to operate between audits.
Step 7: Complete the Internal Audit
An internal audit evaluates whether the ISMS conforms to the organization’s own requirements and ISO 27001 and whether it is effectively implemented and maintained.
The auditor needs sufficient independence from the work being audited. In a small company, that can be difficult, which is why some SaaS teams use an external firm for the internal audit.
The internal audit should cover the ISMS scope, requirements, control operation, and evidence. Findings may include major nonconformities, minor nonconformities, or opportunities for improvement depending on the audit context and classification method.
SCI provides stand-alone internal audits for teams that need an independent assessment before certification or surveillance. The SCI ISO Internal Audit Guide explains the role in more detail.
Step 8: Hold the Management Review
Management review is a formal part of the ISMS. Leadership reviews security performance, audit results, risk changes, objectives, incidents, corrective actions, resources, and opportunities for improvement.
This is not a status meeting created for the auditor. It is where management demonstrates oversight and makes decisions about the ISMS.
Document inputs, decisions, actions, and owners. If leadership approves changes to security objectives or resources, make sure those decisions are reflected in the program.
Step 9: Select an Accredited Certification Body
Certification must be performed by an independent certification body. When comparing providers, ask about accreditation, SaaS experience, audit approach, scheduling, geography, and costs.
Accredited certification bodies are assessed by national or recognized accreditation organizations. UKAS is the United Kingdom Accreditation Service and is one example of an accreditation body; other countries have their own recognized bodies.
Do not confuse an ISO consultant, internal auditor, external auditor, and certification body. They play different roles. A consultant can help implement the ISMS. An internal auditor tests it before certification. The certification body performs the external audit that can lead to ISO 27001 certification.
Step 10: Complete the Stage 1 Audit
The Stage 1 audit is primarily a readiness and documentation review. The auditor evaluates whether the ISMS is sufficiently developed to proceed to Stage 2.
Expect review of the ISMS scope, policies, risk assessment, risk treatment plan, SOA, internal audit, management review, and other required documented information.
The Stage 1 audit can identify readiness issues or documentation gaps that need remediation before Stage 2. Treat those findings seriously; rushing into Stage 2 without closing material issues creates unnecessary risk.
Step 11: Complete the Stage 2 Audit
The Stage 2 audit evaluates implementation and effectiveness. The external auditor interviews people, reviews records, samples evidence, and checks whether the ISMS and applicable security controls operate as described.
This is the main ISO 27001 certification audit. The auditor may identify nonconformities. A major nonconformity typically reflects a significant breakdown or absence of a required system element. Minor nonconformities are narrower issues that still require corrective action.
The exact certification decision process belongs to the certification body. Your job is to provide accurate evidence, respond to findings, and complete required remediation.
Step 12: Maintain Certification Through Surveillance Audits
ISO 27001 certification is not permanent. Certification cycles include surveillance audits and a later recertification audit.
Annual surveillance audits sample the ISMS between recertification cycles. The company still needs to run risk management, internal audit, management review, corrective actions, training, supplier reviews, incident response, and other recurring controls.
The recertification audit is broader and evaluates whether the management system should continue to be certified for the next cycle.
This maintenance stage is often easier than initial implementation if the ISMS has been operated consistently.
How Long Does ISO 27001 Certification Take?
There is no credible universal timeline. The answer depends on ISMS scope, existing security posture, number of gaps, company size, technical remediation, availability of evidence, internal audit readiness, and certification-body scheduling.
A company with mature security controls and SOC 2 experience may reuse much of its evidence. A company starting from scratch may need significant implementation work before Stage 1.
Be skeptical of “certified in a few weeks” claims that skip the operating work. The better question is how many controls and management-system activities are already functioning.
What Drives ISO 27001 Certification Cost?
ISO 27001 certification cost includes more than the certification audit. Budget for internal time, implementation support, GRC tooling if used, internal audit, certification-body fees, technical remediation, penetration testing when appropriate, and ongoing surveillance.
Costs vary with scope, headcount, locations, complexity, and auditor pricing. Ask for transparent separation between consulting, internal audit, certification, software, and other third-party costs.
Related ISO Standards You May Encounter
ISO 27002 provides control guidance. ISO 27701 extends privacy information management. ISO 42001 addresses AI management systems. These standards may complement an ISO 27001 program but should not distract from the requirements in ISO/IEC 27001:2022 when certification is the immediate goal.
The Certification Process Works Best as an Operating System, Not a Project
The ISO 27001 certification process becomes much more predictable when risk assessment, control operation, internal audit, management review, remediation, and evidence collection are treated as normal business routines.
SCI supports the full path from ISMS implementation through audit readiness and ongoing operations, while also offering independent ISO internal audits as a stand-alone service when independence is required. If your team needs an owner for the implementation work rather than another list of recommendations, SCI’s Embedded Compliance service is built to run the program with you.