Short answer for SaaS founders
If you sell SaaS to enterprises in the UK or Europe, ISO 27001 is the certificate their security review most often asks for, and a focused team can get it in 4 to 8 weeks. Qorelo, a German AI platform for SAP operations, was certified in about six weeks with zero non-conformities. Centinel Analytica took under two months, with 15-20 hours of its team's time.
The certificate doesn't end security reviews, but it changes them. Instead of proving every control from scratch in every questionnaire, you show an independent certificate, its scope and the evidence behind it.
Talk to a founder about your ISO route · Read the Centinel case study
Where ISO 27001 comes up in an enterprise deal
Security proof isn't one gate. It comes back at every stage of a SaaS deal:
- The first security review. Before a pilot or a contract, the buyer's security or vendor-risk team sends a questionnaire and asks which certifications you hold. A certificate answers their first question.
- Supplier onboarding. Procurement adds you as a supplier and records how you protect their data. Large organisations treat this as part of their supply chain security; in the UK, the National Cyber Security Centre publishes 12 principles to help them control and oversee their suppliers.
- The contract. Security schedules and data processing agreements spell out what you commit to, such as access control, encryption, incident notification and audits.
- Every year after. Many buyers reassess their suppliers every year. Surveillance audits keep your certificate current, so you can show the same certificate each time.
Centinel Analytica, a German startup that tells genuine users apart from bots and AI agents, saw this first-hand. Its enterprise customers started asking for ISO 27001 and SOC 2, so security proof became part of sales and procurement conversations. Centinel now uses its certificate to close enterprise customers. Qorelo's CTO says certification gave the company a stronger trust foundation for enterprise customer conversations, including with Mercedes-Benz.
What enterprise security reviewers check
When you send a certificate, a reviewer at a large company checks more than the logo on it:
| What they ask for | What they check | What to have ready |
|---|---|---|
| ISO 27001 certificate | Issued by an accredited certification body and still valid | The certificate; it can often be found on public registers such as UKAS CertCheck and IAF CertSearch |
| Scope | That it covers the product they're buying | A scope statement that names your platform |
| Statement of Applicability | Which Annex A controls you apply, and why you left any out | Your Statement of Applicability (SoA), shared under NDA if you prefer |
| Policies | That they exist and that people follow them | Policies, plus evidence such as acknowledgements and access reviews |
| Penetration test | Recent, independent, with serious findings fixed | A summary letter or executive summary |
| Hosting and subprocessors | Where their data lives and who else processes it | A subprocessor list with data locations |
| Data protection | GDPR terms for their personal data | Your data processing agreement and privacy documentation |
In our experience, scope is where SaaS startups most often get caught out. A scope that doesn't clearly cover the product a buyer is purchasing tells them little, and widening it after certification means more audit work. Decide it at the start.
What to put in scope for a SaaS product
Scope the product your customers buy and everything that keeps it running:
- the application and APIs your customers use;
- your production cloud accounts and the services you run there;
- source code, CI/CD and the deployment pipeline;
- the people who can reach production or customer data, including support;
- the suppliers that store or process customer data, such as hosting, email, monitoring and AI model providers;
- the laptops and workplace tools your team uses, such as Google Workspace or Microsoft 365, GitHub and Slack.
Your cloud provider's certificate doesn't cover you
AWS, Microsoft Azure and Google Cloud hold ISO 27001 certificates for their own services. AWS describes the split as security "of" the cloud, which is theirs, and security "in" the cloud, which is yours: your accounts, configuration, identities, code and data.
Their certificates still help. Your auditor will look at how you choose, manage and plan to exit your cloud services (Annex A control 5.23, information security for use of cloud services), and your provider's certificates are part of the evidence for it.
The controls auditors spend time on in a SaaS company
ISO 27001 has two parts. The clauses cover the management system: your scope, risk assessment, Statement of Applicability, internal audit and management review. Annex A lists 93 controls in the 2022 version, and you choose which apply to you. In our experience, these are the Annex A areas auditors spend most time on in a SaaS company:
| Area | Annex A controls | Evidence that usually comes from your tools |
|---|---|---|
| Access and authentication | 5.15, 5.18, 8.2, 8.5 | MFA and SSO settings in Google Workspace or Microsoft 365, GitHub and your cloud console; access reviews; offboarding records |
| Secure development and change | 8.25, 8.28, 8.29, 8.31, 8.32 | Branch protection and pull-request reviews, CI checks, separate production and test environments |
| Vulnerabilities and configuration | 8.8, 8.9 | Dependency and container scanning, patching records, infrastructure as code |
| Logging and monitoring | 8.15, 8.16 | Cloud audit logs, alerts and who reviews them |
| Backups | 8.13 | Backup settings and a tested restore |
| Cloud and suppliers | 5.19 to 5.23 | A supplier list with risk ratings, contracts or DPAs, your providers' certificates |
| Incidents | 5.24 to 5.28 | An incident process and an incident log, even an empty one |
Most SaaS teams already do much of this. What's missing is usually the paper trail: written rules, a record that you follow them, and evidence an auditor can sample. With Kantis, policies are drafted for you and a lot of the evidence comes straight from tools like GitHub and Google Workspace. Your team's part is to review and to run the processes.
A timeline that fits your deal
Work back from the date your buyer needs proof. A focused project typically looks like this:
| When | What happens | Your team's part |
|---|---|---|
| Week 1 | Gap assessment, scope and risk method | Agree the scope |
| Weeks 1 to 3 | Policies, risk assessment and Statement of Applicability | Review and approve |
| Weeks 2 to 5 | Evidence collected from your tools, gaps fixed | Fix what the gaps show, such as MFA or access reviews |
| Weeks 4 to 6 | Internal audit and management review | Take part in the management review |
| Weeks 4 to 8 | Stage 1 and Stage 2 audits by the certification body, then the certificate | Join the audit interviews |
Book the certification body early, because its calendar often sets the end date. If the deal can't wait for the certificate, ask the buyer whether a letter saying you're in progress, with your audit booked, is enough for now. In our experience, it often is.
What it takes from your team
UK estimates put team time at 150 to 300 hours on a project supported by a platform, and it's the cost founders forget. Centinel's team spent 15-20 hours in total, because Kantis ran the internal audit, mapped Centinel's existing engineering practices to audit evidence and coordinated the auditor.
"Misha did our internal audit, handled the auditor coordination, and helped us turn what we already had into proper evidence."
Simeon Räthel, Co-founder & CEO, Centinel Analytica
Your team still owns a few decisions: what's in scope, which risks you accept, and how your processes actually run. Those are hours worth spending. Formatting policies and chasing screenshots are not.
The ISO 27001 cost guide breaks down the cash side: for up to 10 people, UK market ranges add up to about £11,300 to £31,500 in year one, ex VAT.
After the certificate: using it in deals
- Put it where buyers look. A Trust Center with your certificate, policies and security documents answers many questions before buyers send a questionnaire. Qorelo's Trust Center shows its ISO 27001 certification, and buyers request the certificate and reports there.
- Answer questionnaires from the same evidence. With a certified ISMS behind you, many answers already exist in your policies and evidence. Kantis drafts answers from them, and a person approves every answer before it goes out.
- Keep it current. The certificate lasts three years, with surveillance audits in years two and three. Keep access reviews, supplier reviews and incident records going, so the next audit is routine.
- If US buyers ask for SOC 2. Most of the evidence carries over. Read ISO 27001 vs SOC 2 for startups for which one to do first and how to do both.
Where Kantis fits
Kantis combines software with hands-on support for SaaS teams: the gap assessment, policies written for how your team actually works, evidence collected from your tools, the internal audit, coordination with your certification body and a Trust Center for your buyers. An accredited certification body runs the audit and issues the certificate.
For the full ISO 27001 process from scope to certificate, read our ISO 27001 for startups guide. For two SaaS examples, read the Centinel Analytica case study and the Qorelo case study.
Talk to a founder about your ISO route and you'll leave knowing what your enterprise buyers will check, what to put in scope and the fastest credible route to a certificate. Calls are in English.