ISO 27001 certification for startups, run for you
Compliance
ISO 27001 often shows up on vendor checklists from enterprise and international buyers. For a startup, the hard part is not reading the standard. It is running a management system every week while also shipping product. This page covers what ISO 27001 requires, what the audit looks like, and where software helps.
The short answer |
|---|
ISO/IEC 27001 is the international standard for an information security management system (ISMS). An independent certification body audits your ISMS and, if you pass, issues a certificate on a three-year cycle with annual surveillance audits. The current edition is ISO/IEC 27001:2022, with 93 Annex A controls in four themes. Companies that sell to international or enterprise buyers often need it. |
What is ISO 27001?
ISO 27001 defines how to set up, run and improve an ISMS: the policies, risk process, roles and controls that keep information secure. Unlike SOC 2, it is a certification. The certificate says your management system conforms to the standard. All 2013 certificates expired or were withdrawn by 31 October 2025, so every current certificate is to the 2022 edition.
How is ISO 27001:2022 structured?
Clauses 4 to 10 are the mandatory requirements: context and scope, leadership, planning and risk assessment, support, operation, performance evaluation, and improvement. Annex A is a reference list of 93 controls.
Annex A theme | Controls | Examples |
|---|---|---|
Organizational (A.5) | 37 | Policies, supplier security, incident management, threat intelligence, cloud services |
People (A.6) | 8 | Screening, security awareness training, remote working, responsibilities after termination |
Physical (A.7) | 14 | Physical entry, equipment security, storage media, secure disposal |
Technological (A.8) | 34 | Access rights, cryptography, logging, secure development, data masking |
Annex A is not a checklist you must implement in full. You choose controls based on your risk assessment and record each decision in a Statement of Applicability.
How is ISO 27001 different from SOC 2?
ISO 27001 is a certification against an international standard, issued by a certification body, and focuses on the management system. SOC 2 is an attestation report from a CPA firm against AICPA criteria. The underlying controls overlap heavily, so one well-run program can support both.
Who needs ISO 27001?
B2B SaaS companies selling to enterprises in Europe, the UK, India, the Middle East or Asia-Pacific.
Startups whose customers list ISO 27001 as a vendor requirement in RFPs or security questionnaires.
Companies that handle sensitive customer data, including fintech, health tech and HR tech.
Suppliers to larger companies that already hold ISO 27001 and expect their vendors to manage security the same way.
Teams that want one internationally recognized certification before adding SOC 2 or other frameworks.
What does ISO 27001 take?
Controls: the Annex A controls your risk assessment selects, such as access management, encryption, logging, secure development, supplier management, backups and incident response.
Documents: ISMS scope, information security policy, risk assessment and risk treatment methodology, risk treatment plan, Statement of Applicability, security objectives, and supporting policies.
Evidence: records that the ISMS operates, including risk assessments, access reviews, training records, supplier reviews, incident logs, internal audit reports, management review minutes and corrective actions.
What does the ISO 27001 certification audit involve?
Stage 1: the certification body reviews your documentation and checks whether the ISMS is ready for a full audit.
Stage 2: the auditor tests whether your ISMS conforms to the standard and operates in practice.
Surveillance audits: in years two and three, the certification body checks that the ISMS is still running.
Recertification: in year four, a full audit starts the next three-year cycle.
What NexusVoid automates vs what you still do
Task | NexusVoid | You, management and the certification body |
|---|---|---|
Mapping Annex A to your controls | Done for you, with shared controls reused across SOC 2 and other frameworks | Confirm ISMS scope |
Policies | Drafted and tailored to your company | Approve and publish them as management |
Risk register | Maintained, with risks suggested from real findings | Decide risk treatment and accept residual risk |
Statement of Applicability | Drafted from your controls and risks | Review and approve the justifications |
Evidence collection | Automatic from cloud, GitHub, identity and devices | Provide manual records like signed NDAs |
Technical vulnerabilities | Argus finds them and opens fix pull requests; Striker tests | Review and merge fixes |
Internal audit and management review | Evidence and reports prepared | Assign an impartial internal auditor; leadership runs the review |
Certification | Auditor-ready exports | Choose the certification body; only it issues the certificate |
How NexusVoid gets you ready and keeps you ready
NexusVoid runs your security program like an autonomous CISO, and ISO 27001 is the by-product. If you have no CISO, it acts as one. If you have a CISO or vCISO, it automates most of their work, following a loop of Detect, Prove, Resolve, Test, Verify.
Argus finds and fixes: outside-in first like an attacker, with no credentials or installs to begin, then inward through code, dependencies, cloud and secrets. Findings map to MITRE ATT&CK, risk is priced in dollars with FAIR, fixes arrive as pull requests, and merged fixes are retested and filed as evidence.
Aegis proves: tailored policies, automatic evidence, risk register, vendor management, employee security training, a device agent, a trust center and auditor-ready exports.
Striker tests: vulnerability assessment and pentest for web, API, cloud and mobile, pay per scan, with a report in under 60 minutes.
Surveillance audits are where many ISMS programs slip. Because evidence is collected continuously and every finding has an owner, the program keeps running between audits instead of restarting each year.
Common ISO 27001 mistakes
Scoping too broadly for a first certification, which multiplies the controls and evidence you need.
Copying a template Statement of Applicability that does not match your actual risks.
Skipping the internal audit or management review. Both are mandatory clause requirements, not optional extras.
Writing a risk assessment once and never updating it.
Treating certification as the finish line, then scrambling before each surveillance audit.
Frequently asked questions
How many controls are in ISO 27001:2022?
Annex A of ISO/IEC 27001:2022 lists 93 controls in four themes: 37 organizational, 8 people, 14 physical and 34 technological. The 2013 edition had 114 controls in 14 domains. The 2022 edition merged many of them and added new ones such as threat intelligence, information security for cloud services, and data masking.
Do we have to implement all 93 Annex A controls?
No. Clauses 4 to 10 are mandatory. Annex A controls are selected based on your risk assessment and risk treatment plan. You record every control in a Statement of Applicability, with a justification for each one you include or exclude. A remote-only startup, for example, may justify a narrower set of physical controls, but the reasoning has to be documented.
How long is an ISO 27001 certificate valid?
Certification runs on a three-year cycle. You pass a Stage 1 and Stage 2 audit in the first year, then the certification body runs surveillance audits in years two and three. In year four you go through recertification. Your ISMS has to keep operating the whole time, which is why continuous evidence matters more than a one-off project.
Should a startup get ISO 27001 or SOC 2 first?
Follow your buyers. SOC 2 is the report most US buyers ask for. ISO 27001 is an international certification that many buyers in other regions recognize. The controls overlap heavily, so with a shared-control setup most of the work you do for one counts toward the other. Ask your top prospects which one their procurement team requires.
Can NexusVoid certify us for ISO 27001?
No. Only an independent certification body can audit you and issue an ISO 27001 certificate. NexusVoid builds and runs the security program behind your ISMS, drafts tailored policies, collects evidence, maintains your risk register and prepares auditor-ready exports. You choose the certification body, and your management owns the decisions the standard assigns to leadership.
If ISO 27001 is on a customer’s vendor checklist and you want to know how far you are from it, book a call at /contact and we will review your current setup with you.
Something wrong in this post? Tell us at lakshay@nexusvoidai.com and we will fix it and say so.
More compliance guides
DPDP Act compliance
India's DPDP Rules apply in full from 13 May 2027. NexusVoid builds the security safeguards, breach readiness and evidence the law expects, before the deadline.
GDPR compliance
Selling to EU customers means GDPR. NexusVoid runs the security of processing, breach readiness and vendor oversight, and keeps the evidence ready for customer reviews.
HIPAA compliance
Protect ePHI the way the HIPAA Security Rule expects. NexusVoid runs the safeguards, risk analysis evidence and testing so you can sign BAAs with confidence.
Start with a real security program.
Tell us what you need to fix first and we will show that part live, on a stack like yours.