What Is ISO 27001?
ISO 27001 is an international standard for information security management systems (ISMS). Published by the International Organization for Standardization (ISO), it provides a systematic approach to managing sensitive company information so that it remains secure. The standard covers people, processes, and technology.
Unlike frameworks such as the NIST Cybersecurity Framework, ISO 27001 is a certifiable standard. That means an accredited auditor can formally verify that your organization meets the requirements, and you receive a certificate that proves it to customers, partners, and regulators.
ISO 27001 vs. SOC 2: What Is the Difference?
Small business owners often ask how ISO 27001 compares to SOC 2. Here is the key distinction:
- ISO 27001 is an international standard recognized globally. It focuses on building and maintaining an information security management system. The certification is valid for three years with annual surveillance audits.
- SOC 2 is a U.S.-centric framework developed by the AICPA. It focuses on demonstrating that controls are in place and operating effectively. Reports are typically annual.
If your customers are primarily in North America, SOC 2 is more commonly requested. If you do business internationally -- especially in Europe, Asia, or the Middle East -- ISO 27001 carries more weight. Some businesses pursue both, as there is significant overlap in the underlying controls.
What ISO 27001 Certification Involves
The Information Security Management System (ISMS)
At the heart of ISO 27001 is the ISMS -- a documented framework that describes how your organization manages information security. It includes:
- Scope definition: What parts of your organization are covered by the ISMS
- Risk assessment: A formal process for identifying, analyzing, and evaluating information security risks
- Risk treatment plan: How you address each identified risk (mitigate, accept, transfer, or avoid)
- Statement of applicability: Which of the 93 controls in Annex A you have implemented and why
- Security policies and procedures: Documented rules and processes covering everything from access control to incident response
- Management commitment: Evidence that leadership actively supports and participates in the ISMS
The 93 Controls of Annex A
ISO 27001:2022 (the current version) includes 93 controls organized into four themes:
- Organizational controls (37): Policies, roles, responsibilities, threat intelligence, asset management, access control, supplier relationships
- People controls (8): Screening, employment terms, security awareness, disciplinary processes, responsibilities after termination
- Physical controls (14): Physical security perimeters, entry controls, protecting against environmental threats, secure disposal
- Technological controls (34): Encryption, authentication, malware protection, vulnerability management, logging, network security
You do not need to implement every control -- only those that are relevant to your identified risks. The Statement of Applicability documents your rationale for including or excluding each control.
What Does ISO 27001 Certification Cost?
For a small business (under 50 employees), budget for:
- Implementation costs: $15,000-$40,000 for consulting help, tools, and internal effort to build the ISMS and implement controls. If you have strong internal expertise, you can reduce consulting costs.
- Certification audit (Stage 1 + Stage 2): $10,000-$25,000. Stage 1 is a documentation review; Stage 2 is the on-site (or remote) evidence audit.
- Annual surveillance audits: $5,000-$15,000 per year to maintain certification.
- Re-certification (every 3 years): $8,000-$20,000 for the full recertification audit.
- Internal time: Significant. Budget 3-6 months for initial implementation, plus ongoing maintenance effort.
Total first-year investment typically ranges from $30,000 to $70,000 for small businesses, with annual maintenance of $10,000-$25,000.
Is ISO 27001 Worth It for Your Business?
When It Makes Sense
- International customers: If you sell to businesses in Europe, Asia, or the Middle East, ISO 27001 is often expected or required.
- Government contracts: Many government procurement processes require or favor ISO 27001 certified vendors.
- Competitive differentiation: In crowded markets, certification signals maturity and trustworthiness.
- Regulatory requirements: Some industries and jurisdictions reference ISO 27001 as a recognized security standard.
- You are losing deals: If prospects ask for ISO 27001 and you do not have it, the cost of certification may be less than the cost of lost business.
When It Might Not Make Sense
- Your customers never ask for it: If you serve individual consumers or local small businesses, the investment may not generate a return.
- You are very early stage: Startups with fewer than 10 people and limited revenue may find the overhead disproportionate. Start with NIST CSF and grow into certification.
- Budget constraints: If $30,000+ is a stretch, focus on building strong security fundamentals first. You can pursue certification when the business can support it.
How to Prepare for ISO 27001
If certification is in your future, start preparing now:
- Adopt NIST CSF first: Many NIST CSF controls map directly to ISO 27001 Annex A controls. The work you do now carries forward.
- Start documenting: ISO 27001 auditors need evidence. Start writing down your security policies, procedures, and risk assessment processes.
- Build the risk assessment habit: Conduct a formal risk assessment and document your findings. This is the foundation of the ISMS.
- Get leadership buy-in: ISO 27001 explicitly requires management commitment. Make sure your leadership team understands and supports the initiative.
- Consider a readiness assessment: Before committing to the certification process, understand where your gaps are so you can budget and plan accordingly.
Next Steps
Curious about how your business measures up against ISO 27001 requirements? Our free ISO 27001 Readiness Assessment evaluates your current security controls and gives you a clear picture of what you would need to implement before pursuing certification. It takes about 10 minutes and provides a practical roadmap.
Whether you pursue certification now or later, understanding the standard helps you build a stronger, more systematic approach to information security.