The article
A large client's security review ends with one line: attach your ISO 27001 certificate. Until you can, the deal waits. No consultant can write that certificate for you. It comes from audits by a certification body, and the work before them mixes decisions only your company can make with engineering we can do.
I have been building software for 18 years, and for me ISO 27001 certification consulting starts with two facts: what the certificate covers and who issues it. Then come the steps, what the auditor will ask to see and how to keep the certificate once you have it.
ISO 27001 certification consulting: the short version
| Question | Answer |
|---|---|
| What gets certified | Your information security management system (ISMS), within a scope you define |
| The edition | ISO/IEC 27001:2022; accredited certificates against the 2013 edition expired or were withdrawn on 31 October 2025 |
| Who issues the certificate | A certification body, after its stage 1 and stage 2 audits; not ISO and not a consultant |
| What we do | The readiness assessment, scope and risks, the ISMS and its controls, the internal audit, support through the audits |
| How long it lasts | A three-year cycle, with a surveillance audit every year |
| Price | Estimated before work starts; the first call and the rough estimate are free |
What the certificate covers, and who issues it
The certificate covers a management system, not a product and not a level of security. It says that within the stated scope your company runs a system that manages the risks to its information and meets the standard. A scope can be one product or the whole company, so the first line to read on any certificate, yours or a vendor's, is what it covers.
ISO and the IEC publish the standard and certify nobody. Certificates come from certification bodies, and ISO's own advice is to check whether a body is accredited, because accreditation is independent confirmation of its competence. An accredited certificate can be looked up in IAF CertSearch, a database fed by accreditation and certification bodies. An ISO 27001 certification consultant, us included, prepares you and stays with you; the certificate is the certification body's.
Our ISO 27001 consulting services, step by step
- An ISO 27001 readiness assessment. Where you stand against the standard, gap by gap, with a plan you can put dates on. You give us time with your people and access to your systems.
- Scope and risks. What the ISMS covers, and a risk assessment that decides which controls you need. Accepting the risks that remain is your management's call.
- The ISMS and its controls. Policies, the Statement of Applicability and the Annex A controls in place. Annex A of the 2022 edition lists 93 controls in four groups, and the Statement says which of them apply to you and why.
- The internal audit. The audit the standard requires in clause 9.2, run before the real one, so the findings reach you first.
- Certification. Stage 1 and stage 2 audits by an accredited certification body you choose; we stay with you through both.
How long it takes depends on your size and on where you start; the readiness assessment turns that into a realistic plan.
What the auditor will ask to see
Auditors work from evidence, and a policy without records proves only that someone wrote it. This is the list I would hand to the person who will own the ISMS on your side; forward it to them.
| Evidence | What it shows |
|---|---|
| The scope | What the ISMS covers and where its boundaries are |
| The risk assessment and the treatment plan | Which risks you found and what you decided about each |
| The Statement of Applicability | Which Annex A controls apply, which do not, and why |
| Policies people follow | Rules for access, suppliers, incidents, backups and development that match how you work |
| Records that the controls run | Access reviews, logs, backup restore tests and change approvals |
| The internal audit report | That you checked the system before the auditor did |
| The management review | That your leadership looked at the results and decided what to change |
| Corrective actions | What you fixed after audits and incidents, and when |
Of the four ISO 27001 consulting pages Google showed me for this search in October 2026, only one names the Statement of Applicability, and one still walks readers along the path to a 2013-edition certificate, almost a year after every accredited 2013 certificate expired or was withdrawn. Four pages are a small sample; ask any consultant which edition they work to.
Controls built into your systems
Much of ISO 27001 lives in systems: who can reach what, what gets logged, whether a backup really restores, how code is reviewed. Our engineers carry out access reviews, logging, backups and secure development in your cloud and code, so the controls work and leave evidence as part of the work rather than in a rush before the audit.
It is the same engineering we do on regulated products. On RxPhoto, a platform for clinics that stores 80m+ before-and-after photos (per rxphoto.com), we worked on the backend, the web front end and the API behind the mobile app, and an audit log lets administrators follow every user action. PBM Source, compliance software we delivered for pharmacy benefit managers, turns every new regulation into a task with a date, an assignee and its documents in one place.
There are ISO 27001 compliance solutions sold as software, and a platform helps with the paperwork; the certificate still depends on controls that run in your systems. We set up such platforms and write what they miss under compliance automation.
ISO 27001 audit services: ours and the certification body's
Audits come in two kinds, and only one kind can come from us. We run the internal audit against the standard and your own rules, so the findings reach you while there is time to fix them. The certification body runs the rest: stage 1 and stage 2 before the certificate, a surveillance audit every year and a recertification audit before the three years end. The people who prepared you are not the people who certify you, and that separation gives the certificate its value.
After the certificate: ISO 27001 compliance support
A certificate lasts three years, and the system has to keep running between the audits. Our support covers the regular reviews, risk updates, internal audits and evidence. The 2022 edition added a clause on planning changes to the ISMS, 6.3: a new product, a new cloud or a new supplier is a change to plan, not something the auditor discovers.
What the price depends on
Our ISO 27001 compliance services are estimated before work starts, and the estimate turns on four things:
- the scope: the people, locations, systems and products inside it;
- where you start: the policies, controls and records you already have, which the readiness assessment shows;
- how many controls need engineering work in your cloud and code;
- whether we keep the system running after the certificate.
Budget for the certification body separately: it prices its own audits. The first call and the rough estimate are free.
Next to ISO 27001
ISO 27001 sits next to the other rules in our regulatory compliance services: cloud compliance for the cloud side of the controls, a cybersecurity risk assessment if you want a picture of your risks before deciding on certification, and CMMC for defense suppliers.
Tell us why you need the certificate: the client asking, the date and the part of the company it should cover. We answer new requests within 30 minutes on weekdays, 9 am to 6 pm Miami time, then reply with a readiness plan and a rough estimate, free.
