The global gold standard for information security. ISO 27001 proves that your organisation manages sensitive data through a structured, audited Information Security Management System — the certification enterprise buyers ask for first.
ISO/IEC 27001:2022 is the international standard for an Information Security Management System (ISMS). Rather than a checklist of technical controls, it certifies that you run a repeatable management system for identifying risk, applying controls, and improving over time.
The 2022 revision organises 93 Annex A controls into four themes — organisational, people, physical, and technological. You select the controls relevant to your risk profile and justify them in a Statement of Applicability, the document that sits at the heart of every ISO 27001 audit.
Certification is granted by an accredited certification body after a two-stage audit, and is valid for three years with annual surveillance audits in between.
The single most requested certification in enterprise procurement and security questionnaires.
Recognised in every market, and the foundation most other security frameworks build on.
Any organisation whose customers need assurance that their data is systematically protected.
ISO 27001 is our core in-house practice. For a focused scope and a responsive team, we take you to a complete Stage 2 audit in 75 days — against an industry norm of six to nine months — subject to certification-body scheduling.
We define the boundary of your programme — systems, locations, and teams in scope — and agree the timeline and responsibilities up front, so there are no surprises later.
A structured assessment of your current posture against every requirement, producing a prioritised remediation plan with realistic effort estimates.
We write the policies, procedures, and controls, and work alongside your engineering team on a weekly cadence to implement them — not a stack of templates left for you to figure out.
The management system runs and generates evidence. We drive the internal audit and management review so the programme is demonstrably working before any external scrutiny.
We prepare the evidence package and sit alongside you through assessment, answering the assessor's questions directly rather than leaving you to defend the work alone.
*Subject to certification-body scheduling. Timeline confirmed against your specific scope at kickoff.
If you sell software or services to enterprise customers, sooner or later a security questionnaire arrives asking one thing: are you ISO 27001 certified? For startups and growing companies in the UK, the US and across Europe, certification has become a standard way to show that customer data is protected, and a common requirement in procurement and vendor-review processes.
Why UK and European companies choose it. ISO 27001 is widely recognised across the UK and Europe, and is frequently requested by financial institutions, public-sector buyers and large enterprises. It supports your obligations under UK GDPR and EU GDPR by showing that you manage risk in a structured, auditable way, and it pairs well with regulations such as DORA for companies serving regulated European customers.
Why US companies pursue it. In the US, SOC 2 is often the first report customers ask for. ISO 27001 becomes important when you expand into the UK, Europe or other international markets, or when global customers want an internationally recognised certificate. Because the two frameworks share many controls, doing one makes the other faster, and we can plan both together.
Remote-first delivery. ISONEX works remotely with clients across the GCC, UK, EU and US. Calls and workshops are scheduled around your working hours, and documents and evidence are managed in shared online workspaces. We work with SaaS, fintech and legal companies, and with small and mid-sized teams that do not have a dedicated security department.
Timeline and cost. The industry norm is six to nine months. For a focused scope and a responsive team, we take you to a complete Stage 2 audit in 75 days, subject to certification-body scheduling. Total cost has three parts: consultancy support, optional tooling, and the audit fees of the accredited certification body. It depends on your size and scope, so we quote after a short scoping call. Book a free advisory session.
More guides: ISO 27001 for startups, ISO 27001 for UK companies and ISO 27001 for fintech.
Yes, for a well-scoped engagement with a cooperative team and the certification body booked early. The standard requires the ISMS to have operated — including an internal audit and management review — before Stage 2, which sets the practical floor. We confirm an achievable date against your specific scope at kickoff rather than promising a number blind.
Stage 1 is a documentation review where the auditor checks your ISMS is designed correctly. Stage 2 is the implementation audit, where they verify the controls are actually operating. We attend both alongside you.
Yes. ISONEX is a remote-first consultancy and we deliver ISO 27001 projects for clients in the UK, the US, Europe and the GCC. Everything is done online, with calls and workshops scheduled around UK and US working hours.
The industry norm is six to nine months. For a focused scope and a responsive team, we take you to a complete Stage 2 audit in 75 days, subject to certification-body scheduling. We confirm the date against your scope at kickoff.
It depends on your company size, scope and existing controls. The total has three parts: consultancy support, any tooling you choose, and the fees of the accredited certification body that audits you. After a short scoping call we can give you a clear quote for your situation.
US customers most often ask for SOC 2. ISO 27001 is the better fit if you sell to UK, European or international customers. Many companies end up holding both, and the controls overlap significantly. See our SOC 2 page for more.
It does not replace GDPR compliance, but it gives you a structured security framework that supports the security requirements of UK and EU GDPR. See our GDPR page for how the two fit together.
Book a free advisory session and we'll map your fastest credible route to compliance.
Book a free advisory session