Information security
ISO 27001
ISO/IEC 27001
ISO/IEC 27001 is the global standard for an information security management system (ISMS). We take you from first gap to a certificate issued by an accredited body.
What ISO 27001 is
ISO/IEC 27001 is the international standard for establishing, operating and continually improving an information security management system. It requires you to assess your risks, apply a set of controls to treat them, and run the whole thing as a managed system with leadership, objectives, internal audit and management review.
The control set in Annex A gives you a reference list to select from based on your risk assessment, with the detail set out in ISO/IEC 27002. Certification is awarded by an independent, accredited certification body, not by a consultancy, following a two-stage audit.
The structure of the standard
Clause 4 · Context of the organisation
You define the ISMS scope and the internal and external issues and interested parties that shape it.
Clause 5 · Leadership
Top management owns the information security policy and commits the resources and accountability the system needs.
Clause 6 · Planning
You run the risk assessment, decide how to treat each risk, set objectives and produce the Statement of Applicability.
Clause 7 · Support
You provide the people, competence, awareness, communication and documented information that keep the system running.
Clause 8 · Operation
You carry out the risk assessment and risk treatment plan in practice and control the changes that affect them.
Clauses 9 and 10 · Evaluation and improvement
You monitor, measure, internally audit and review the system, then act on findings and nonconformities to improve it.
Annex A · Reference controls
The 2022 edition lists 93 controls grouped into four themes, organisational, people, physical and technological, that you select from based on your risk.
Who needs it
- Organisations whose customers or regulators expect a recognised, auditable security standard
- Companies selling internationally where ISO 27001 is the common language for security assurance
- Teams that want a durable management system rather than a one-off report
What you get
- A scoped ISMS with risk assessment and risk treatment plan
- Documentation set including the Statement of Applicability
- Internal audit, penetration test and management review evidence
- Readiness and support through Stage 1 and Stage 2 certification audits
Timelines depend on your scope and how mature your controls already are. We scope it honestly up front rather than promise a fixed number of weeks.
Current version
The current edition is ISO/IEC 27001:2022, which reorganised Annex A into the four themes and 93 controls described above. The transition from the 2013 edition has now closed, so certificates are issued and maintained against the 2022 text. The supporting guidance in ISO/IEC 27002:2022 was updated alongside it and gives the implementation detail behind each Annex A control. If your ISMS was built on the older edition, the move is a mapping and re-baselining exercise rather than a rebuild, and we can help you work through it.
What it costs
Two costs sit side by side here. tr3labs charges a scoped advisory and implementation fee, quoted up front once we understand your size, scope and starting point. The certificate itself is issued by an independent, accredited certification body, which charges separately on its own schedule for the Stage 1 and Stage 2 audits and the annual surveillance that follows; tr3labs is never that certifier or auditor. We would rather scope the work with you than quote blind.
How tr3labs gets you there
Scope and gap assessment
We define the ISMS scope, run the risk assessment, and measure your current state against the standard and Annex A so you know exactly what is missing.
Build the management system
We help you produce the required documentation, the Statement of Applicability and risk treatment plan, and implement the policies and technical controls the standard expects.
Test and prove
We run internal audits, penetration testing and a management review so the system is operating and evidenced before an external auditor arrives.
Certification support
We prepare you for the Stage 1 and Stage 2 audits by your chosen accredited certification body and support you through to the certificate and the surveillance cycle that follows.
ISO/IEC 27001 vs SOC 2
Both prove you take security seriously, so buyers often treat them as interchangeable when they answer to different audiences in different ways.
| ISO/IEC 27001 | SOC 2 | |
|---|---|---|
| Core idea | A certified information security management system | An attestation report on controls against the Trust Services Criteria |
| Covers | The whole ISMS and its selected Annex A controls | The criteria relevant to the service you deliver |
| Who asks for it | A global and international buyer base | Mainly US enterprise buyers |
| Audit model | Two-stage audit by an accredited certification body | Examination by a licensed CPA firm |
| What you hold | A certificate on a three-year cycle with surveillance | A point-in-time or period-of-time report you refresh |
| Often held with | SOC 2, NIST CSF, ISO 42001 | ISO/IEC 27001 for international reach |
ISO 27001 FAQ
- How much does ISO 27001 certification cost?
- Our scoped advisory and implementation fee is quoted up front; separately, the accredited certification body charges on its own schedule for the Stage 1 and Stage 2 audits and the annual surveillance that follows. tr3labs is never that certifier, so we scope our part against your real starting point.
- How long does ISO 27001 take?
- It depends on your scope and how mature your controls already are. We scope the timeline honestly up front rather than promise a fixed number of weeks.
- Who issues the ISO 27001 certificate?
- An independent certification body accredited to award ISO/IEC 27001 issues the certificate after a two-stage audit. tr3labs prepares you, builds the ISMS and evidence, and supports you through the audit; we are not a certification body.
- What is the difference between ISO 27001 and SOC 2?
- ISO 27001 certifies a management system against an international standard and suits a global audience. SOC 2 is a CPA attestation report against the Trust Services Criteria and is the default expectation for US enterprise buyers. Many organisations pursue both and reuse much of the same evidence.
- Does the certificate last forever?
- No. An ISO 27001 certificate runs on a three-year cycle with annual surveillance audits and a recertification audit at the end. We help you stay ready across the cycle, not just for the first audit.
The services that get you there
Related standards
Related reading
SOC 2 vs ISO 27001: an honest comparison to help you choose
A plain-English guide to the real differences between SOC 2 and ISO 27001: what each one is, who asks for which, how the audits work, what you end up holding, and whether you should do both.
8 min read
What is ISO 27001? A plain-English guide to the information security standard
A clear, jargon-free introduction to ISO 27001 for founders and technical teams: what an ISMS is, the clauses 4 to 10, the 2022 Annex A controls, how two-stage certification works, and how to prepare.
8 min read
The OWASP LLM Top 10, Explained: A Plain-English Guide for Teams Shipping AI Features
A clear, practical walkthrough of the OWASP Top 10 risks for large language model applications, with a plain-English description and a concrete mitigation for each, aimed at teams adding AI features for the first time.
9 min read