ISO 27001 for startups: when to start and what to expect

When should a startup start ISO 27001?

ISO/IEC 27001 certification is optional. Some organizations implement the standard only for its best practices, while others certify to show customers and clients that its recommendations are followed. For a startup, the trigger is usually a contract, RFP or enterprise pipeline that requires a certificate, or a deliberate decision by leadership to build a structured security program before customers ask. If neither applies yet, the standard still gives a useful checklist for building that program. The answer depends on headcount, the systems that hold customer data, what buyers have already asked for, and how much security evidence already exists. A company with a few people, one cloud account and no written policies faces a different job than one that already runs centralized logging and access reviews.

Every organization must consider information security risks, whatever its size. The standard does not require a large team or a large budget. It lets an organization apply a risk management process suited to its size and needs, so a small company can document a simple method, keep the risk register short and scale the management system to what it actually operates. Before committing, a startup should list the systems that store or process customer data, identify who administers them, and check which existing controls already produce records, such as identity provider logs, code review history and backup reports. Those records are the raw material for the evidence an assessor will sample later.

Confirm the requirement with the customer in writing before starting. Ask whether the customer requires a certificate issued by an accredited certification body, or whether a documented ISMS, a Statement of Applicability and a recent risk assessment would be accepted for now. Ask which scope the customer expects to see, since a certificate covers only the services named in it. Also ask whether the customer will accept an in-progress program. The answers decide whether the company should start certification now, run an internal program first, or do both. The ISO FAQ for ISO/IEC 27001 is a neutral starting point for explaining the optional nature of certification to a non-specialist board.

Optional certification versus customer-driven certification

ISO's own FAQ describes two valid reasons to adopt ISO/IEC 27001: implementing it for its best practices, or certifying to reassure customers that its recommendations are followed. The cards below separate those paths from contract, regulator and late-deal situations, because each one changes who sets the timeline, what evidence gets requested and how much rework a startup faces.

Implementing for best practice only

The company adopts the standard's risk process, policies and Statement of Applicability without seeking certification. It owns every decision about scope, risk appetite and which Annex A controls apply, and it can scale the ISMS to a small team. Buyers rarely accept this as proof on its own, so the internal records must be ready to show if a prospect asks. The main risk is drift: without an external deadline, reviews and internal audits slip and the ISMS stops reflecting how the product runs.

Certifying to reassure customers

The company pursues certification because prospects and existing clients want independent assurance that the recommendations are followed. The company owns the ISMS and the decision to certify, while an accredited certification body issues the certificate after stage 1 and stage 2 audits. Buyers will ask for the certificate, its scope and the Statement of Applicability. The main risk is choosing a scope too narrow to cover the product customers actually buy.

Certifying because a contract requires it

A signed contract, order form or RFP names ISO/IEC 27001 certification as a condition, often with a date attached. The company owns the commercial commitment and must confirm what the customer will accept, such as an accredited certificate or an equivalent. The buyer checks the certificate against the certification body's public register. The main risk is discovering after signing that the earliest realistic path through both audit stages runs past the contract date.

Certifying for a regulator

A regulator or sector rule expects an information security management system, and ISO/IEC 27001 is one way to show it. The company owns the regulatory relationship and must check whether the regulator accepts certification as evidence or expects specific additional controls. Examiners ask for the risk assessment, the treatment plan and records of internal audit and management review. The main risk is assuming the certificate satisfies every regulatory expectation when it covers only the scope stated on the certificate.

Waiting until a deal forces it

The company delays any structured ISMS work until a prospect or renewal makes certification urgent. Work that normally runs across many months is compressed into weeks, and the company owns every gap it finds during the readiness review. Evidence that should have accumulated over time, such as access reviews, incident records and management review minutes, does not yet exist. The main risk is that the audit finds nonconformities that cannot be closed before the commercial deadline, so the company loses the deal anyway.

How a small team scales the ISMS without skipping clauses

A small team can scale an ISO 27001 management system, but it cannot scale away the management system clauses. Clause 1 of ISO/IEC 27001:2022 states that an organization claiming conformity may not exclude any requirement in clauses 4 to 10, so context, leadership, planning, support, operation, performance evaluation and improvement are all audited, whatever the headcount. The flexibility sits elsewhere. The 93 Annex A controls are not all mandatory in the same way. You decide which ones apply through risk assessment and risk treatment, and you record the result in the Statement of Applicability under clause 6.1.3, with a justification for each inclusion and exclusion. Your first job is to show the auditor that every clause is addressed in proportion to your business, not to write a control library the size of an enterprise's.

The standard's introduction expects the ISMS to be integrated with the organization's processes and overall management structure, and to be scaled to its needs. In practice this means the security process should run through existing routines such as sprint reviews, hiring, supplier onboarding and board updates, rather than sitting in a separate binder. Illustrative example: a five-person SaaS company might keep one short information security policy, a risk register with a handful of entries reviewed each quarter, and a single leader who holds the security responsibility and reports to the founders. The auditor will look for evidence that these routines happen and that their outputs change decisions, not for a particular document count.

ISO publishes a companion handbook, *ISO/IEC 27001:2022, A practical guide for SMEs* (PUB100484, published 2024), which summarizes each clause for organizations with limited staff and budgets. ISO lists its price at CHF 44, compared with CHF 155 for the standard itself. Confirm current availability and price on the ISO publication page before you budget for it, because ISO may change either. Ask your implementation partner or certification body whether they expect you to follow that guide's structure, since a consistent approach across clauses makes stage 1 review faster.

What a first ISO 27001 certification costs a startup

This table compares the main cost components of a first ISO 27001 certification for a small company, showing who is paid, whether each cost is one-time or recurring, and what moves it up or down. Only the ISO list prices are supplied, so every certification body fee must come from a written quote. Audit time scales with the number of people in scope, so headcount is the first number to settle before asking for quotes.

Cost component	Who is paid, and for what	One-time or recurring, and what drives it
Certification body, stage 1 and stage 2 audits	The accredited certification body, for the initial two-stage audit that issues the certificate. The organization does not pay ISO for this.	One-time for the initial audit. Fees are not supplied here and must come from written quotes. Audit time is driven by the persons in scope under ISO/IEC 27006-1, so headcount and scope are the main levers.
Certification body, surveillance and recertification audits	The same certification body, for annual surveillance audits and the recertification audit at the end of the three-year cycle.	Recurring. ISO/IEC 17021-1 requires at least one audit in every calendar year. Scope changes, new sites and new services can increase audit days.
ISO/IEC 27001:2022 standard	ISO, which sells the standard at CHF 155 (iso.org).	One-time purchase. The organization must own the text to build the ISMS, but the price is fixed by ISO and does not depend on headcount.
ISO/IEC 27001:2022 practical guide for SMEs	ISO, which sells PUB100484 at CHF 44 (iso.org).	One-time purchase. Useful for a small team that needs a clause-by-clause walkthrough before writing policies.
Internal staff time	No external payee. Founders, engineers and operations staff take on the policies, risk assessment, Statement of Applicability and evidence collection.	Recurring through the cycle. Effort rises with the number of systems, suppliers and people in scope and falls when controls are built into daily tooling.
Implementation partner support	An outside firm, paid under a written, fixed-scope agreement, to prepare systems, controls and evidence. It does not issue the certificate.	Optional and scope-dependent. Costs rise with the number of controls to build and the depth of hands-on work. Ask for deliverables and what the internal team must still own.
Tooling and infrastructure	Vendors of GRC, identity, logging or device management tools, and the cloud or hosting provider where the systems run.	Recurring subscriptions or hosting, with some one-time setup. Open-source and self-hosted options can reduce licence fees but add operating effort for the team.
Pre-audit and readiness review	Often bundled with the implementation partner or the certification body's own pre-assessment, where offered.	Confirm in writing whether a readiness review is included, how many days it covers and whether it counts toward the initial audit.

How headcount drives audit time

Headcount is the starting point for how a certification body sizes an ISMS audit, but the count is not simply every employee. The cards below cover who is counted, how the count can be reduced for identical roles, and how scope choices change the number a startup should expect to discuss with its certification body.

Start with every person under control

The starting point is the total number of persons doing work under the organization's control, counted across all shifts. That includes full-time staff, part-time staff and others working for the company. Ask the certification body to confirm in writing how it counts founders, interns and people on fixed-term contracts before you accept a quote, because the starting number sets the audit time for the whole engagement.

Contractors and remote staff count

Contractors, agency workers and remote staff who do work under the company's control generally fall within the count, not only employees on payroll. A small team that relies heavily on outside developers or an offshore support desk may find its counted headcount is higher than expected. List every such worker during scoping so the number is not revised midway through the audit.

Identical roles can be reduced

Under clause C.3.4 of ISO/IEC 27006-1:2024, the count for a group of people performing identical activities may be reduced according to the risk of their tasks. The reduction cannot go below the square root of that group's head count. For example, a group of 16 identical roles could not be reduced below 4 (illustrative). Ask the certification body which roles it treats as identical and why.

Certification body must document criteria

A reduction is not automatic. The certification body must justify and document the criteria it applies when it reduces the count for a group, so the company can see the reasoning behind its audit time. Request that written justification as part of the proposal and check that the criteria match the actual risk of each role, such as developers with production access versus marketing staff.

Sites and locations change the count

Each site where ISMS activities take place adds audit effort, and a fully remote company still has to say where its work and information are held. Clarify whether the company has an office, a co-working desk, or only cloud-hosted operations and home workers. Confirm how the certification body applies its multi-site rules to these locations before you agree the scope.

A narrow scope keeps the count low

Headcount only matters for the people and sites inside the certificate scope. A startup that certifies one product, its engineering team and its hosting environment may have a much smaller counted population than one that certifies the whole company. Agree the scope in writing first, then recount, because a clear, small scope is usually the most effective way to control audit time.

What the first certification process looks like

The first certification runs in a fixed order, with each step producing a document or a check that the next step depends on. The organization owns the controls and the work, and an independent certification body alone decides whether the certificate is issued.

Confirm scope and run the gap assessment
Define which products, services, systems, locations and people fall inside the ISMS, then compare current practice against each clause of the standard and the Annex A controls. The organization's own leadership owns this work, and a partner can help map existing evidence. The step closes with a written scope statement and a gap list ranked by what is missing, so you know how much work sits ahead of you before committing to a certification body.
Complete the risk assessment and Statement of Applicability
Identify information security risks to the scoped services, decide how each will be treated, and record for every Annex A control whether it applies, why, and where its evidence lives. Clause 6.1.3 requires this as the Statement of Applicability. The output is a risk register and a signed-off SoA approved by top management. Auditors read these two documents first, so they should match the systems you actually run.
Implement policies, controls and evidence
Write the policies the scoped controls rely on, put the technical and organizational controls into operation, and keep dated records that show each control works as described. Evidence includes access reviews, change records, training completions, backup restores and incident tickets. The step is done when each control in the SoA has an owner and at least one piece of evidence that a third party could inspect. Open-source tooling can generate and store much of this, but the organization must confirm each tool reflects its real configuration.
Run internal audit and management review
Check the ISMS against the standard and your own procedures, record nonconformities and their root causes, and then hold a management review where top management examines results, risks and objectives. The output is an internal audit report and minutes of the management review. Certification bodies test whether this loop actually runs, so it should show real findings and real decisions rather than a single sign-off.
Pass the stage 1 documentation review
The certification body reviews whether the ISMS documentation, scope, risk assessment and Statement of Applicability are complete and conform to the standard, and whether the organization is ready for the detailed assessment. The stage 1 output is a written report listing gaps to fix before stage 2. The two-stage initial audit described in European Accreditation FAQ 32.4 is the basis for this sequence. Ask the body how it plans stage 1 and what it expects you to have ready.
Resolve findings through corrective actions
Address the gaps and any nonconformities from stage 1 and internal audit, record the cause and the fix, and provide evidence that the fix works. European Accreditation FAQ 36.14 describes how corrections and corrective actions are handled. The output is a closed action log with evidence attached to each item. Unresolved items can prevent the certificate decision, so the log should be complete before stage 2 begins.
Complete the stage 2 implementation audit
The certification body tests whether the ISMS operates in practice across the scope, by sampling records, interviewing staff and observing systems. The output is a stage 2 report that records any nonconformities, graded by the body. Minor findings can be closed later, while major findings must be fixed before a certificate can be issued. Expect the auditor to follow evidence trails from policy to system to record.
Receive the certificate decision
The certification body reviews the audit report and the corrective action evidence, then makes an independent certification decision. Only the certification body issues the certificate, and it states the scope, the standard edition and the validity period. The organization does not issue or extend its own certificate. Once issued, the certificate is listed in the IAF CertSearch database, where customers can verify it. Ongoing surveillance audits then follow within the certification cycle.

What the three-year cycle means after the first certificate

The first ISO 27001 certificate is not the end of the audit work. Under ISO/IEC 17021-1, which accredited certification bodies apply, a management system certification runs on a three-year cycle, and the certification body must carry out at least one audit in every calendar year, either a surveillance audit or a recertification audit. A certificate that is valid for only one year does not conform to that standard. For a startup, the practical consequence is that the first certificate sets a recurring calendar: plan the surveillance audits with the certification body from the start, and confirm the exact timing with them in writing before you sign the contract.

The recurring work is what keeps the ISMS current between audits. Each year, someone on the team must be able to show that the risk assessment still reflects the product, the hosting setup and the people who now have access to them. The Statement of Applicability needs to match the controls you actually run. Access reviews, incident records and internal audits must have dates and owners. As headcount grows, new hires change the risk picture, so review the roles and access model after each hiring round rather than once a year. Ask the certification body how it will sample these records at surveillance, since that determines how much evidence you need to keep ready.

If you hold a certificate to the 2013 edition, the transition is already settled. IAF MD 26:2023 required all ISO/IEC 27001:2013 certificates to expire or be withdrawn by 31 October 2025, the end of the 36-month transition period. A startup that certified before that date and has not moved to the 2022 edition should confirm its status with its certification body and IAF CertSearch immediately, because a lapsed certificate can stall a customer contract. Any new surveillance or recertification audit will be against the 2022 edition.

What must be in place before the stage 1 audit

Stage 1 is a documentation review, and the certification body will check whether the ISMS exists on paper and is ready for a stage 2 test. The six items below are the minimum a startup should have in place before booking, along with what to confirm with the certification body first.

A defined scope

The scope states which products, services, people, locations and cloud accounts sit inside the ISMS. Startups often draw it too wide (every contractor and tool) or too narrow (the production product but not the team that supports it). Check that the scope names the service customers buy and the persons who build, operate and support it. Confirm with the certification body how it treats remote staff and any cloud provider that hosts the product, because both change the scope and audit time.

Top management commitment under clause 5

Clause 5 expects the most senior person in the company to direct the ISMS, approve the policy and assign responsibilities. In a small company this is usually the founder or CEO, and that person must be able to show the decisions they took, such as approving the policy or accepting residual risk. Check that the leader can name the information security roles and the people who hold them. Ask the certification body how it expects leadership involvement to appear in the records.

A current risk assessment and Statement of Applicability

Clause 6.1.2 requires a risk assessment with a defined method, and clause 6.1.3 requires a Statement of Applicability that lists the Annex A controls, states which apply and why, and records their status. Check that the risk register is dated, links each risk to a treatment, and that each control in the Statement of Applicability matches what the company actually does. Confirm with the certification body which version of the Statement of Applicability it will review at stage 1.

Core policies and procedures

Stage 1 looks for a short set of documented policies that the company follows, such as information security, access control, acceptable use, incident response, supplier management and backup. For a small team, each policy can be a few pages, but it must name an owner and state what people actually do. Check that the policies match the tools in use, and that staff have read and accepted them. Ask the certification body whether it needs the policies in a specific format or template.

Evidence that controls operate

A policy only counts once there is proof it runs. Stage 2 will sample evidence such as access reviews, onboarding and offboarding tickets, vulnerability scan results, backup restore tests and training completion. Check that each control in the Statement of Applicability has at least one dated record, and that records were produced by the normal workflow rather than assembled for the audit. Confirm with the certification body which evidence period it expects to see before stage 2, since it may ask for a recent operating history.

Internal audit and management review records

Clauses 9.2 and 9.3 require an internal audit of the ISMS and a management review at planned intervals. A small company can meet this with a short internal check against the requirements and a leadership meeting that reviews risks, incidents, audit findings and objectives, with minutes kept. Check that both have happened at least once and that the actions raised have owners and dates. Ask the certification body how it wants these records presented and whether an internal auditor must be independent of the work reviewed.

Who owns what in a startup's ISO 27001 project

The company is the only party that can make the decisions ISO 27001 treats as its own. Leadership sets the scope of the information security management system, accepts the risks that remain after treatment, approves the policies and makes sure the ISMS is part of how the business is run. Those duties do not transfer to a consultant or a tool, even when a small team relies heavily on outside help. The company also keeps the day-to-day evidence alive, because an audit tests what happened over time, not what was set up once.

Risk decisions: Leadership decides how each identified risk is treated and signs off the Statement of Applicability, including the reasons for any Annex A control that is excluded.
Policies and roles: Named people approve policies, own controls and accept the responsibilities written into them.
Management review: Leadership reviews the ISMS at planned intervals and records the decisions taken.
Staff time: Employees complete onboarding, access reviews, training and incident drills, and that time recurs for the life of the certificate.
Audit cooperation: The company answers auditor questions, provides access to records and owns any nonconformity corrections.

Before you engage anyone, confirm that a named owner in your company has time allocated for each of these duties.

What usually delays a startup's first certification

Most delays in a startup's first ISO 27001 certification come from decisions made late or out of order. The cards below cover the scope, people, tools, risk process, evidence and audit timing mistakes that push certification back, and what to do instead.

Scope decided after the work starts

Teams often begin policies and tooling before agreeing which products, environments, offices and people fall inside the ISMS. Every later artifact then has to be revised. Fix the scope in writing first, naming the product, hosting accounts, locations and business functions covered, and confirm it with the certification body before drafting controls. An illustrative case: a team that adds a second product after stage 1 may need to redo its risk assessment and Statement of Applicability.

Unclear persons in scope

The number of people doing work under the organization's control drives audit time, so a loose headcount leads to wrong quotes and rework. Contractors, part-time staff, interns and founders all count under the organization's control. List everyone by role and status, and ask each certification body how it counts people for the planned scope before you sign a contract.

Tools chosen before the risk process

Buying a GRC platform or security suite before the risk assessment often leaves gaps and unused features. Tools should follow the risks you identified and the controls you selected in the Statement of Applicability. Write down the risk criteria, list assets and threats, then choose the tools that produce evidence for the treatments you actually chose.

Evidence created only for the audit

Screenshots and policies written the week before stage 1 do not show that a control operated over time. Auditors look for records created in the normal course of work, such as access reviews, change tickets, backup restore logs and training completions. Start collecting these records early, and confirm with the certification body which evidence period it expects before stage 2.

Treating the SoA as a template

Copying a Statement of Applicability from a template, without justifying each Annex A control against your own risks, invites findings. The Statement of Applicability must state which controls apply, why, and how they are implemented, including exclusions. Review each line against your system, and make sure the owner named for each control can explain how it works.

Booking audits before readiness

Booking stage 2 before an internal audit and management review have been run usually creates nonconformities that delay the certificate. Schedule the stage 1 review first, use its findings to close gaps, and confirm internal audit and management review are complete before the main audit. Ask the certification body how it handles corrective actions and what evidence it needs to close them.

Questions startups ask about ISO 27001 timing and effort

Is ISO 27001 required for a startup?

No. ISO/IEC 27001 certification is optional. ISO's own FAQ explains that some organizations implement the standard only for its best practices, while others certify to reassure customers and clients that its recommendations are followed. For most startups the real trigger is a customer contract, an RFP or a procurement questionnaire that names the certificate. Before committing, ask the customer what it will accept: a current certificate, a report from a readiness assessment, or evidence of a program in progress. The organization still needs to consider information security risks at any size, and ISO/IEC 27001 lets it apply a risk process suited to its size and needs.

How many people does ISO 27001 audit time depend on?

Audit time is driven mainly by the number of people doing work under the organization's control. The European Accreditation FAQ 35.3, which cites ISO/IEC 27006, makes the total number of persons working for the organization across all shifts the starting point for ISMS audit time. Contractors and part-time staff can count too. Under FAQ 48.6, the certification body may reduce the head count for groups performing identical activities according to the risk of their tasks, but never below the square root of that group's head count, and it must document its criteria. Ask the certification body for its audit time calculation in writing and check how it treats contractors, outsourced development and remote staff.

Can a small team run ISO 27001 on its own?

A small team can run an ISMS itself, but it must cover every clause and every control in scope, and a few roles cannot be skipped. Top management must take visible responsibility under clause 5, and someone must own the risk assessment, the Statement of Applicability and internal audits. Where one person holds several roles, the team needs compensating oversight rather than an unchecked split of duties. Internal effort is recurring: policy reviews, access reviews, vendor reviews, training records and management review continue after certification. Budget named hours each month for the owner and for each control operator, and ask whether the team has the time to answer audit questions and close nonconformities within the deadlines the certification body sets.

What does ISO's SME guide cover?

ISO's practical guide for SMEs, ISO/IEC 27001:2022, A practical guide for SMEs (PUB100484, published 2024), is a companion handbook written for the 2022 edition. It summarizes each clause, from context of the organization in clause 4 to improvement in clause 10, with examples, case studies and annexes on FAQs, certification and support resources. It is written for organizations with limited staff and budgets. It is not the standard itself and it does not replace the requirements. ISO sells the standard at CHF 155 and the SME guide at CHF 44, so the guide is a low-cost way to plan the work and to brief a consultant or an internal owner before buying the standard.

Does an ISO 27001 certificate last forever?

No. A certificate is issued for a limited period. Under ISO/IEC 17021-1, the certification cycle for a management system lasts three years, and the certification body must carry out at least one audit in every calendar year, either a surveillance audit or a recertification audit. Surveillance audits sample the ISMS between the first and final years, and the recertification audit restarts the cycle. A certificate valid for only one year does not conform to the standard. Plan recurring effort for each surveillance visit, including evidence refreshes, internal audits and corrective actions, and confirm the audit calendar with the certification body before the first stage 1 visit.

Should a startup hire a consultant for ISO 27001?

Hire outside help when the internal team lacks time or security experience, and keep ownership in-house. An implementation partner can prepare systems, configuration, logging and evidence, and help draft policies and the risk assessment. The organization must still own its controls, decide the scope and sign the Statement of Applectability. Only an independent auditor or certification body can issue the certificate, so the consultant cannot also be the certifier. Ask for a fixed-scope written proposal that lists deliverables, the systems covered and who performs each task. At DeployOpen, most engagements are fixed-scope and agreed in writing before work starts, and a quote follows from that scope.

How DeployOpen prepares a startup's systems and evidence

DeployOpen helps young companies decide what an ISO 27001 effort should cover and then prepares the systems and evidence that the scope needs. We plan, implement and document self-hosted open-source platforms inside your own cloud accounts or data centers, and we hand over the records your team must keep running. Certification itself is issued only by an independent certification body.

How we scope

Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts.
We help you define which products, services and environments the ISMS covers, so the scope matches what customers actually ask for.
The written scope states which Annex A controls we prepare evidence for and which ones your team or an outside advisor keeps.

How we build

We implement self-hosted open-source platforms for areas such as asset inventory, access control, logging and vulnerability tracking, inside your infrastructure.
We configure these platforms so they produce evidence on a routine basis instead of only when an audit approaches.
We run security testing against the systems in scope so that findings can be tracked and closed under your corrective action process.

How we hand over

You receive documentation covering the systems we built, their configuration, owners and the recurring tasks needed to keep them running.
Evidence collection steps are written so a small team can repeat them for each surveillance or recertification audit.
Your team retains ownership of the policies, risk decisions and Statement of Applicability, and we confirm which of these you must approve yourselves.

How we support

Ongoing support, upgrades and continuous testing are available as retainers after the initial engagement ends.
A retainer can cover platform upgrades, backup checks and evidence reviews ahead of your certification body's visits.
Before any certification body is engaged, we recommend you confirm its accreditation and audit plan directly with it.