Why UK startups get asked for ISO 27001
Security questionnaires usually arrive after a promising first call. They ask how you protect customer data, who has access, how you handle incidents and whether an independent party has checked. ISO 27001 lets you answer those questions once, with a certificate issued by an accredited certification body, instead of re-answering a different questionnaire for every deal.
It is especially common when you sell to financial institutions, public-sector buyers and large enterprises in the UK and Europe. It also supports your obligations under UK GDPR, because it shows you manage security risk in a structured, auditable way.
Do you need it now?
Not every startup does. Start when certification is slowing or blocking revenue, or when you can see it coming: a first enterprise pilot, a tender that names ISO 27001, or investors asking about security during a funding round.
If you mostly sell to US customers, SOC 2 may be the better first step. If you sell in both markets, plan them together, because the controls overlap significantly. See our SOC 2 page.
Start with scope, not with paperwork
The most important decision is the boundary of your certification. Include the product, the infrastructure and the people that actually touch customer data. A tight and honest scope is faster to build, cheaper to audit and can be widened later. Over-scoping, such as certifying every internal tool and every office process on day one, is the most common reason startup projects drag.
At kickoff we agree the scope, the timeline and who is responsible for what, so there are no surprises later.
What ISO 27001 actually requires
ISO 27001 does not certify a set of tools. It certifies that you run a management system for information security: you identify risks, choose controls to treat them, document your decisions in a Statement of Applicability, operate the controls and improve them over time.
The 2022 version of the standard has 93 Annex A controls in four themes: organisational, people, physical and technological. You select the ones relevant to your risks. Before the certification audit you must also complete an internal audit and a management review, which proves the system is operating rather than just written down.
How long does it take?
The industry norm is six to nine months. With a focused scope and a responsive team, ISONEX targets a complete Stage 2 audit within 75 days of kickoff, subject to certification-body scheduling. What sets the timeline is mostly your side: how quickly decisions are made, how mature your security practices already are, and how early the audit is booked.
The audit has two stages. Stage 1 reviews your documentation to check the system is designed correctly. Stage 2 checks that the controls are actually operating.
What does it cost?
Cost has three parts: consultancy support, any compliance tooling you choose, and the fees of the accredited certification body. Each depends on your size and scope, so a generic price list is rarely useful. A short scoping call is the fastest way to get a realistic figure for your situation.
Tooling such as a compliance automation platform can reduce manual evidence work, and we can run your programme on a platform like Drata. Whether it is worth it depends on your size and how much of your stack it can monitor.
Five mistakes that slow startups down
- Scoping too wide. Start with what handles customer data.
- Buying a stack of templates. Policies that do not match how you work fail the audit and are ignored by your team.
- Leaving evidence to the last month. Controls need time to operate and generate records.
- Skipping the internal audit. It is required, and it is the cheapest place to find problems.
- Choosing an unaccredited certification body. In the UK, use a body accredited by UKAS so buyers trust the certificate.
ISO 27001, SOC 2 and Cyber Essentials
ISO 27001 certifies an information security management system and is recognised internationally. SOC 2 is an attestation report issued by a CPA firm and is the default in the US. Cyber Essentials is a UK government-backed scheme covering a defined set of basic technical controls, often requested in public-sector supply chains. They complement each other, and many companies end up holding more than one.
What audit day looks like
The certification audit runs in two stages. Stage 1 is mostly a document review. The auditor reads your scope, risk assessment, Statement of Applicability and policies, and checks that you have done an internal audit and a management review. They may raise concerns to fix before Stage 2.
Stage 2 tests whether the system works in practice. The auditor interviews staff, samples records such as access reviews and change tickets, and checks that the controls you selected are operating. Findings come in two grades. A minor nonconformity needs a corrective action plan. A major nonconformity must be closed with evidence before the certificate is issued.
After a positive decision the certification body issues the certificate. It is valid for three years, with surveillance audits in between. If you sell to banks and payment firms, the same programme is covered in ISO 27001 for fintech companies, and the certification support page shows how we run it end to end.
Your next step
Start with a short scoping conversation. We will tell you honestly whether ISO 27001 is the right move now, what scope makes sense and what a realistic timeline looks like. You can read more about the process on our ISO 27001 page, or see how we work with startups and UK companies. Book a free advisory session.
