ISO 27001 for young and small companies selling to larger customers: when to start, what a small team can realistically run, answering customer demands and questionnaires, and how SaaS, remote and software vendors scope the ISMS.
When a startup should start ISO 27001 and what the first certification asks of a small company: optional versus customer-driven certification, scaling the ISMS to a small team, how headcount drives audit time, the SME guide and the three-year audit cycle.
How a SaaS company scopes and runs ISO 27001 around its product: scoping by service, the cloud services control A.5.23, using the cloud provider's own certificates without being certified by association, ISO/IEC 27017 and 27018 guidance, and what enterprise buyers check on the certificate.
What to do when a customer contract or RFP asks for ISO 27001 certification: confirming what the customer will accept, how certificates are verified, the earliest realistic path through stage 1 and stage 2, and what can be shared before the certificate exists.
How a company with a handful of staff meets ISO 27001 roles and oversight requirements: top management duties under clause 5, segregation of duties under A.5.3 when people hold several roles, competence evidence, and how far a scaled ISMS can go.
Running ISO 27001 without an office: the remote working control A.6.7, how physical controls are justified in the Statement of Applicability, certificates and audit reports that state activities are remote, remote audits, and counting people for audit time.
Whether an ISO 27001 certificate reduces the security questionnaires customers send: what a certificate shows and what it does not, the Statement of Applicability, CSA STAR registry entries and STAR Certification, and when buyers still ask for more.
ISO 27001 for companies that ship software customers run themselves: scoping development and support instead of hosting, the secure development and outsourced development controls, supplier controls customers apply to you, and how NIS2 supply chain rules relate.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.