ISO 27001 Certification Support

Build a management system your organization can run

ISO/IEC 27001 specifies requirements for an information security management system. A useful program connects business context, information-security risk, controls, accountability, and continuing review. It should describe the organization and services in scope rather than simply assemble a folder of policies.

QuickTrust helps turn that scope into an implementation plan. The work links requirements to control owners, policy commitments, engineering tasks, and records that an independent reviewer can follow.

The complete ISO 27001 guide covers the standard in depth; this page focuses on what the assessment requires and how the work is divided.

What the assessment actually requires

ISO 27001 certifies a management system, not a set of technical settings. The certification body assesses whether your organization has established, implemented, maintained, and continually improved an information security management system that meets the requirements of the standard, and whether the controls you selected are implemented as described.

Clauses 4 to 10 contain the mandatory management system requirements. Clause 4 covers the context of the organization: internal and external issues, interested parties and their requirements, and the scope of the system. Clause 5 covers leadership: top management commitment, an information security policy, and assigned roles and responsibilities. Clause 6 covers planning: the risk assessment and risk treatment processes, information security objectives, and planning of changes. Clause 7 covers support: resources, competence, awareness, communication, and documented information. Clause 8 covers operation: carrying out the risk assessment and treatment at planned intervals and controlling the processes needed to meet requirements. Clause 9 covers performance evaluation: monitoring and measurement, internal audit, and management review. Clause 10 covers improvement: nonconformities, corrective action, and continual improvement. Every one of these clauses is examined, and an organization cannot exclude any of them from scope.

Annex A and the Statement of Applicability. Annex A lists a reference set of information security controls grouped into organizational, people, physical, and technological themes. The standard does not require every control to be implemented. Instead, the risk treatment process determines which controls are necessary, and the organization compares that list against Annex A to confirm nothing important was overlooked. The result is recorded in the Statement of Applicability, which lists every Annex A control, states whether it applies, justifies any exclusion, and describes the implementation status. The Annex A controls audit guide explains how assessors typically sample controls and what records they expect.

Stage 1 and stage 2 certification audits. Initial certification is conducted in two stages by the certification body. Stage 1 is primarily a review of documentation and readiness: the assessor checks that the scope, policies, risk assessment, Statement of Applicability, internal audit, and management review exist and are coherent, and identifies areas of concern before the main audit. Stage 2 examines whether the management system is implemented and effective: the assessor interviews staff, samples records, inspects controls in operation, and evaluates whether nonconformities exist. Major nonconformities must be addressed before a certificate can be issued; minor ones usually require a corrective action plan. The certification body, not the readiness vendor, decides the outcome.

Surveillance and recertification. A certificate is issued for a cycle during which the certification body conducts surveillance audits to confirm the system continues to operate and improve. At the end of the cycle, a recertification audit covers the full system again. This is why the management system has to be something your organization can actually run, rather than a project that ends on the certificate date.

Choose an accredited certification body and confirm scope interpretation, stage scheduling, and evidence expectations with them before planning the rest of the work.

Establish scope and risk decisions first

Identify the products, teams, systems, locations, and dependencies covered by the management system. Record important boundaries and exclusions with a rationale. A scope statement should help staff and assessors understand what is actually being managed.

Use a consistent risk process to identify and evaluate issues. Define who can accept a risk and when the decision must be revisited. Control selection should follow the risks and requirements relevant to your organization; copying another company's control list is not a substitute for those decisions.

Connect the documentation to implementation

Workstream	Practical output
Governance	Scope, accountable owners and management decisions
Risk treatment	Prioritized actions and documented acceptance
Control selection	Applicability decisions and implementation status
Operations	Working access, change, supplier and recovery processes
Evidence	Sources, periods, review decisions and exceptions
Improvement	Findings, corrective actions and effectiveness checks

Keep the statement of applicability consistent with the selected controls and their implementation. If a control is described as operating, identify the records that support that status. Explain exceptions rather than concealing them behind a completion percentage.

Platform versus implementation team

A platform can hold the documentation, structure the risk register, track the Statement of Applicability, and organize evidence, but someone still has to implement the technological controls, and your management still has to make the decisions the standard assigns to leadership. The table below shows how QuickTrust divides the work between the platform, the scoped implementation engineers, and the decisions that stay with your organization and the certification body.

Work	Platform organizes	Scoped engineers perform	Customer and certification body decide
Context and scope	Records issues, interested parties, requirements and the scope statement	Advise on technical boundaries and dependencies	Top management approves scope
Leadership and policy	Holds the information security policy, roles and approvals	Not applicable	Top management commits resources and adopts policy
Risk assessment and treatment	Structures the risk register, criteria, treatment plan and acceptance records	Contribute technical findings on actual systems	Risk owners accept or treat each risk
Statement of Applicability	Maintains the control list, applicability, justification and status	Report implementation status of technological controls	Customer approves; certification body evaluates credibility
Organizational and people controls	Tracks policies, training, onboarding, supplier reviews and their records	Support supplier security reviews where technical	Customer managers operate the processes
Technological controls	Links each control to tasks, owners and evidence	Implement access control, logging, vulnerability management, backup, network and secure development changes in your environment	Customer approves production access and each change
Physical controls	Records facility and equipment procedures and evidence	Not applicable unless infrastructure is self-hosted	Customer operates the controls
Internal audit	Schedules the audit, holds findings and tracks corrective actions	Not applicable	Customer arranges an independent internal auditor
Management review	Stores inputs, minutes and decisions	Not applicable	Top management conducts the review
Certification audit	Organizes the evidence request list and responses	Explain technical controls to the assessor when asked	Certification body conducts stages 1 and 2 and decides

The standard places internal audit, management review, and risk acceptance with your organization on purpose. QuickTrust can make them easier to run and better documented, but it cannot perform them on your behalf without undermining what the certificate is meant to show.

Give engineering work an acceptance criterion

An access-control change should identify the affected system, approval, test, rollback approach, and evidence. A recovery process should define the service that must be restored and how a test demonstrates the intended result. Policies and operational instructions should reflect the implemented behavior.

QuickTrust can scope security and DevOps work around these gaps. Your organization retains control over production access, policy approval, and risk acceptance. The engagement should make those boundaries explicit.

Typical timeline and what changes it

ISO 27001 timelines vary more than most frameworks because the management system requirements include activities that must happen in sequence. A plan should describe those phases and their dependencies rather than promise a certification date.

Scoping. Define the organization, services, systems, and locations in scope, identify interested parties and requirements, and select a certification body. Gap assessment. Compare the current state against clauses 4 to 10 and the Annex A controls your risks suggest. Review existing policies, interview owners, and sample records. The gap assessment checklist is a reasonable structure. The output is a list of management system elements to build, controls to implement, and documentation to revise.

Risk assessment and treatment planning. This is a formal requirement, not just a planning aid. Establish criteria, identify and evaluate risks, decide treatments, select controls, and produce the Statement of Applicability. Organizations with no prior risk process spend longer here.

Implementation. Build the management system processes and implement the selected controls. Technical work includes access management, logging and monitoring, vulnerability handling, change management, backup and recovery, and supplier controls. Scoped implementation engineers can carry much of this, with each change approved and tested by your team.

Operating evidence. The standard does not define a fixed operating period, but a stage 2 assessor needs records showing the system operates: completed internal audit, a management review with real inputs and decisions, access reviews, incident handling, corrective actions. These activities take time to occur, and an internal audit and management review must be complete before stage 2.

Certification audit. Stage 1, remediation of any concerns, then stage 2. Certification body scheduling is an external dependency, and lead times vary. Book early and confirm what the assessor expects to see at each stage.

Factors that extend the plan include an unclear scope, no existing risk process, technical controls that need significant infrastructure change, missing control owners, and late certification body booking. Factors that shorten it include an existing SOC 2 program with operating controls, centralized identity and infrastructure as code, and leadership that can make decisions quickly. Set a target with your certification body after the gap assessment, when the real work is visible.

Review before independent assessment

Plan internal audit and management review as opportunities to test whether the system works. Track findings to corrective action and verify the result. A document review should include a sample of actual operating records and interviews with the people responsible for them.

Confirm assessment stages, scope, evidence expectations, and scheduling with the certification body. Readiness assistance is separate from the certification decision. Neither a software score nor a promised project duration determines the certification outcome.

What it costs and how to budget

ISO 27001 costs fall into distinct components, and proposals that quote one of them tell you little about the total. Build the budget from all of them and ask each vendor which they cover.

Platform subscription. Software that holds the management system documentation, risk register, Statement of Applicability, tasks, and evidence. Pricing usually depends on the frameworks in scope and the integrations used. Current QuickTrust tiers are on the pricing page.

Implementation services. Security and engineering work to build the management system and implement controls. This component depends on the gap assessment and is the most variable. A written scope with named deliverables is easier to budget and compare than an open retainer.

Certification body fees. The accredited certification body charges for stage 1, stage 2, surveillance audits, and recertification. Fees depend on the size of the organization, the scope, the number of locations, and the certification body. Internal audit. The standard requires an internal audit that is independent of the work being audited. Small organizations often engage an external auditor for this role, which is a separate line from certification body fees.

Internal time. Risk assessment workshops, policy approval, management review, training, access reviews, control operation, and responding to the assessor. For a small organization this is frequently the largest cost, and it continues after certification.

Recurring maintenance. Surveillance audits, annual internal audits, management reviews, risk reassessment, control operation, and updates when the business changes. Budget this as an operating cost from the start.

The ISO 27001 certification cost breakdown discusses how each component varies and what to ask when comparing proposals. If you are also deciding between frameworks, the ISO 27001 versus SOC 2 comparison explains how the costs and evidence differ, and the QuickTrust versus Vanta comparison covers the difference in platform model.

Who this is for

QuickTrust's ISO 27001 service fits a particular set of situations.

A startup with a first enterprise deal outside North America. A prospect's procurement team has asked for an ISO 27001 certificate, or has made it a condition of a contract, and the company has never operated a formal management system. The priority is a realistic scope, a candid gap assessment, early certification body engagement, and implementation support for a small engineering team.

A healthcare or data-heavy SaaS company with overlapping obligations. The organization handles regulated data under HIPAA or similar regimes and needs ISO 27001 for a customer or market. The work is scoping the management system so that controls and evidence serve both obligations without pretending that a certificate satisfies a legal duty.

A scaling SaaS company adding ISO 27001 to an existing SOC 2. The organization already holds a SOC 2 report and needs ISO 27001 for international customers. Many controls carry over, but the management system elements, including context, leadership, risk treatment, the Statement of Applicability, internal audit, and management review, are new work. The value is in mapping what exists and building only what is missing.

A team without a security hire. Engineering leadership owns security by default and nobody is available to run the management system day to day. Scoped engineers carry the technical implementation while the platform keeps ownership, status, and evidence visible to the people who are accountable, including the top management the standard expects to be involved.

Maintain the system after the project

Assign recurring review responsibilities and change triggers. New products, suppliers, and operating models may require updated risk treatment and control ownership. Use continuous monitoring and evidence operations to keep those decisions visible.

Download the gap assessment checklist, explore AI governance where relevant, and discuss your implementation scope.