What the hell is ISO 27001?
ISO/IEC 27001:2022, usually called ISO 27001, is an international standard for information security management.
In practical terms, it is a way to show customers that your company has a controlled, documented, and regularly reviewed approach to security. It covers things like access control, supplier management, employee security training, incident response, risk management, asset management, business continuity, and how you monitor your systems over time.
The certificate does not say your product is impossible to breach. It says your company has built an information security management system, follows it in practice, and has had it independently audited.
For startups, ISO 27001 usually becomes urgent because of a commercial trigger:
- a larger enterprise customer asks for it before signing
- a regulated buyer in fintech, pharma, legal, biotech, healthcare, or security asks for it
- procurement sends a long security questionnaire
- your customers are getting bigger and security proof is no longer optional
- a partner or marketplace requires a recognised certification
The important point: ISO 27001 is rarely a vanity project for an early-stage company. It becomes relevant when trust is blocking revenue.
Why startups should not treat ISO 27001 like an enterprise project
The traditional way to get certified often assumes a mature company: dedicated compliance owners, security managers, large internal teams, long policy packs, and months of coordination.
That is not the reality for a 2-person, 5-person, or 20-person startup.
In an early-stage company, the CTO often ends up doing the work personally: writing policies, chasing evidence, answering auditor questions, demonstrating cloud controls, documenting access reviews, training the team, and trying to keep the product roadmap moving at the same time.
That is where the real cost appears. Not just audit fees. Not just software. CTO days.
For an early-stage startup, saving CTO time is gold. The CTO should be building the product, closing customer requirements, and removing technical blockers, not spending days turning scattered security habits into audit-ready documentation.
The startup ISO 27001 roadmap
Most founders do not need a textbook explanation first. They need to know the path from "a customer asked for ISO 27001" to "we are audit-ready".
At a glance, the route is:
- scope the requirement
- check the gaps
- build the ISMS
- prepare policies, risk records, and the SoA
- collect evidence and train the team
- complete internal checks
- pass Stage 1 and Stage 2 audit
- keep the system alive after certification
Every certification project has its own details, but a practical startup path usually looks like this.
1. Confirm what the buyer actually needs
Start with the reason you need ISO 27001.
Is a customer asking for it as a hard requirement? Is it needed before procurement can approve you? Is the buyer asking for ISO 27001 specifically, or would SOC 2, Cyber Essentials, GDPR documentation, or a security pack also help?
This matters because the right answer depends on the buyer, geography, industry, and deal stage.
2. Define the scope and run a free gap assessment
ISO 27001 certification applies to a defined scope. For most startups, that usually means the product, the team, and the systems involved in delivering the service to customers.
The goal is not to certify an imaginary enterprise organisation. The goal is to define a clean, defensible scope that matches how your startup actually works.
For example:
- your SaaS product and production infrastructure
- your core team and operating processes
- the systems where customer data is stored or processed
- the suppliers that matter for security
- the evidence needed to show the controls are real
Before writing policies or booking an audit, check what is already in place and what is missing.
A startup often has more security practice than it realises: cloud access controls, backups, password management, issue tracking, device management, deployment workflows, customer agreements, onboarding habits, and security checks. The problem is that these practices are rarely organised into an audit-ready system.
Kantis can help with the first commercial triage, scope discussion, and gap assessment for free, with no commitment. The point is to work out whether ISO 27001 is the right move, what effort is likely required, and what timeline is realistic before you spend money or founder time on the wrong path.
3. Build a practical ISMS
ISO 27001 requires an information security management system, usually shortened to ISMS. In plain English, the ISMS is the operating system for how your company manages information security: the risks you track, the decisions you make, the policies you follow, the evidence you keep, and the way you improve over time.
That sounds abstract, but for a startup it should become a practical operating layer:
- what information security risks matter
- what risks you track
- who owns security decisions
- which policies apply to the team
- how access is granted and removed
- how incidents are handled
- how suppliers are reviewed
- how systems are monitored
- how evidence is kept for the audit
The ISMS should reflect how the company actually operates. If it is written like a 500-person enterprise, the team will not follow it and the auditor will see the gap.
4. Prepare policies, risk records and the SoA
Policies are part of ISO 27001, but the goal is not to create generic documents that nobody reads.
The policies need to describe how your startup handles security in real life: access control, acceptable use, incident response, supplier management, secure development, data handling, business continuity, remote work, risk management, and related controls.
You also need the core documented information auditors expect to see: ISMS scope, information security policy, risk assessment approach, information security objectives, document control, operational controls, and records of reviews and improvements.
Kantis prepares this documentation around early-stage European startups, not vague enterprise templates and not assumptions copied from a California-based Series B company with a different operating model.
This is the part many founders never hear about until the audit is close.
ISO 27001 is risk-based. You need a risk assessment process, a risk register, risk treatment decisions, and a Statement of Applicability, usually called an SoA.
The SoA explains which ISO 27001 Annex A controls apply to your company, why they apply, whether they are implemented, and why any controls are excluded. For a startup, this should be clear and proportionate, but it cannot be skipped.
You also need evidence that risk owners have accepted treatment decisions and that the company has information security objectives it can monitor over time.
5. Train the team and collect evidence
ISO 27001 is not only about founders and cloud settings. Employees need to understand the policies that apply to them.
In practice, this usually means simple security training, policy acceptance, and evidence that the team understands basic expectations around access, devices, passwords, incidents, customer data, and secure ways of working.
This should be lightweight for a small team, but it cannot be skipped.
The audit is not passed by saying what you do. It is passed by demonstrating that you do what you say.
Typical evidence can include:
- cloud access lists
- MFA settings
- device management records
- employee onboarding and offboarding records
- supplier reviews
- risk register updates
- risk treatment records
- Statement of Applicability status
- backup configuration
- monitoring and alerting records
- vulnerability or security review evidence
- incident response process
- policy acceptance records
- security training completion
- internal audit records
- management review records
- corrective actions and improvements
Some evidence can be collected automatically from systems. Some still has to be collected manually. The practical work is turning scattered operational reality into a structured evidence pack an auditor can review.
6. Complete internal checks before the external audit
Before the certification audit, the company needs to show that the ISMS is operating.
That normally includes an internal audit, a management review, risk treatment decisions, control checks, and evidence that the company has acted on gaps rather than only documenting them. If a gap is found, it should be tracked through corrective action rather than hidden.
This is the stage where many startups lose time if nobody owns the process clearly.
7. Go through Stage 1 and Stage 2 audit
Kantis does not audit you and does not issue the ISO 27001 certificate.
The external audit is done by an independent certification body.
Stage 1 is usually a readiness and documentation review. The auditor checks whether the ISMS is defined well enough to proceed: scope, policies, risk process, Statement of Applicability, objectives, internal audit, management review, and other core records.
Stage 2 is the implementation audit. The auditor checks whether the ISMS is actually operating. This can include document review, evidence review, control checks, and short employee interviews. Auditors may ask founders, technical leads, or team members to explain how security processes work in practice.
If the auditor finds nonconformities, the company has to correct them before certification can be finalised.
For ISO 27001 needs in the UK and Germany, Kantis works with credible certification body partners, including UKAS-accredited certification bodies in the UK and DAkkS-accredited certification bodies in Germany where that route is appropriate. For US-facing SOC 2 needs, Kantis works with audit partners performing SOC engagements under AICPA standards. These are different assurance routes, but the practical point is the same: the partners are used to working with startups at different stages and sizes, from 2-person teams upward.
8. Receive the certificate and keep the system alive
Certification is not the end of the work.
ISO 27001 requires the company to keep the ISMS alive: monitoring controls, reviewing risks, keeping evidence up to date, maintaining policies, handling employee changes, tracking suppliers, and preparing for surveillance or renewal audits.
If customers rely on your security commitments, this ongoing layer matters. A certificate that is not maintained can become a risk during renewals, customer reviews, SLA discussions, and future procurement checks.
How long ISO 27001 takes for a startup
The timeline depends mostly on prioritisation, scope, current security maturity, auditor availability, and how fast the team can provide information.
These are planning ranges, not guarantees.
Fast path: 4 weeks, usually when the team is small, scope is clean, leadership prioritises the project, evidence is easy to collect, and auditor availability lines up.
Typical path: 6 to 8 weeks, which is realistic for many startups that need to coordinate policies, evidence, training, internal checks, and the external audit.
Longer path: 2 to 3 months, usually when the startup is busy, the scope is messy, key evidence is missing, systems are not monitored properly, or certification is important but not treated as a top priority.
The biggest factor is rarely company size alone. It is how seriously the founder and CTO prioritise the process once a customer has made certification a commercial requirement.
How much ISO 27001 costs
ISO 27001 cost depends on company size, scope, certification body, existing security maturity, tooling, and how much support you need.
The larger hidden cost is often internal time: founder time, CTO time, engineering time, and operational distraction.
For a breakdown of audit fees, tooling, support, and internal effort, read the ISO 27001 certification cost guide.
If you are comparing Kantis with Vanta, Drata, Sprinto, or Delve, read the compliance platform comparison for European startups. The important comparison is not only licence price. It is how much of the process your founder and CTO still need to carry.
What founders and CTOs usually underestimate
Founders usually understand the obvious parts: policies, audit, certificate.
They underestimate the operational parts:
- how much evidence needs to be collected
- how many security practices need to be written down
- how often the CTO becomes the default compliance owner
- how easy it is to miss the risk assessment, SoA, internal audit, or management review
- how much time is lost chasing screenshots, access lists, training records, and supplier notes
- how important continuous monitoring becomes after the certificate is issued
- how quickly security proof becomes part of enterprise sales, renewals, SLAs, and customer trust
The core mistake is treating ISO 27001 as a document project.
It is not. It is an operating system for security trust. The documents matter, but only because they describe the way the company actually works.
Where Kantis fits in
Kantis helps startups get audit-ready while saving as much founder and CTO time as possible.
Kantis does:
- help you understand whether ISO 27001 is the right answer for the customer requirement
- help define the certification scope
- run a free gap assessment with no commitment
- prepare startup-appropriate policy documents
- organise the ISMS around how your team actually works
- prepare risk assessment, risk treatment, SoA, objectives, internal audit, and management review evidence
- collect evidence automatically where possible
- structure manual evidence where automation is not enough
- help employees complete basic security training and policy acceptance
- prepare the audit evidence pack
- coordinate with credible audit partners
- track corrective actions where gaps are found
- support ongoing monitoring, renewals, and customer security requirements after certification
Kantis does not:
- act as the independent auditor
- issue the ISO 27001 certificate
- pretend your startup is a large enterprise
- bury the CTO in generic compliance templates
- make public claims your company cannot defend in an audit
The aim is simple: help you close the customer requirement without turning ISO 27001 into weeks of CTO distraction.
Proof point
In the published Qorelo case study, Qorelo used Kantis to get ISO 27001 certified in about six weeks with zero non-conformities.
That is not a universal promise. It is proof that a small, focused startup can move quickly when scope, evidence, policies, and audit coordination are handled properly.
Read the Qorelo ISO 27001 case study.
Start with the practical question
If ISO 27001 has just appeared in a customer requirement, start with the practical question:
What does this buyer actually need, how quickly do you need it, and what is the lowest-distraction path to get there?
Book a free ISO 27001 gap assessment. No commitment. We will help you understand the requirement, the likely scope, the timeline, and whether Kantis is the right fit.