The standard your customers keep asking about.

What certification actually costs

Certification bodies do not publish prices, but the audit days are fixed by ISO/IEC 27006, so you can work out your own number.

Write the scope statement

Clause 4.3 from twelve answers: the sentence the certificate will carry, the boundaries, the interfaces and dependencies, the exclusions with their justification, and the issues considered.

Write the information security policy

Clause 5.2 from ten answers: the purpose, why security matters to this company, the commitments, the objectives, who is responsible, the topic policies under it, and how it is communicated and reviewed.

Write the risk register and treatment plan

Five answers pick the starter risks, each scored and treated with the Annex A controls; the register and the plan written as the auditor reads them, and the Statement of Applicability follows.

Write the internal audit programme

Clause 9.2 from five answers: the criteria, how many audits a year and what each covers, who audits and how they stay independent, the methods, the year's schedule over the clause sections and the Annex A themes, and how results are reported.

Write the management review minutes

Clause 9.3 as an agenda: the seven inputs in the clause's order with what was said about each, the four performance trends with their counts, the decisions, the actions with owner and date, and the minutes an auditor reads.

Write a corrective action record

Clause 10.2 for one finding: the nonconformity, the correction and its consequences, the cause, whether it exists elsewhere, the action with owner and date, the effectiveness check, and the change to the system, as the record an auditor reads.

Write the incident response plan

The Annex A incident controls from a few answers: who leads, how an event is reported, the three severity levels, the response steps, the GDPR, NIS2 and CRA clocks that apply, the evidence to keep, the review afterwards, the exercises.

Write the acceptable use policy

The rules every person signs, from a few answers: accounts and passwords, devices and personal devices, remote work, data handling, approved services and AI tools, communication, personal use, monitoring, reporting, leaving, breaches, acknowledgement.

Write the access control policy

Who gets access to what and how it is granted, protected, reviewed and removed, from a few answers: one identity per person, multi-factor authentication, roles, privileged accounts, third parties, the access review, leavers, logging, exceptions.

Write the supplier security policy

How the company chooses, contracts, watches and leaves its suppliers and cloud services, from a few answers: the critical suppliers, what is checked before signing, the six contract clauses, where data may live, the review, the exit.

Write the business continuity plan

What the company does when the product, the data, the office or a supplier is gone, from a few answers: the services covered, the hours to restore, the data loss tolerated, who declares a disruption, how security holds during it, the recovery, the exercise.

Write the Statement of Applicability

The 93 Annex A controls with a status each, a justification for every exclusion, and the Statement written as the auditor reads it, to copy or download.

All 93 Annex A controls

One plain-English line per control, grouped by the four themes of the 2022 edition.

What we cover, clause by clause

Every clause from 4 to 10, where its records live in the product, and where the limits of any software sit.

How many auditor days, by headcount

The ISO/IEC 27006 Annex B arithmetic that fixes the audit fee before anyone quotes you.

ISO 27001 or SOC 2 in Europe

3,405 EU tender notices name ISO 27001 against 104 for SOC 2. The query is public; run it yourself.

Where public buyers name ISO 27001, by country

Public buyers in the EU and EEA named ISO 27001 in 3,404 tender notices over the last year, 0.38% of everything they published. Seven in ten came from Germany and Poland; France, Spain and Italy name their national schemes instead.

The scope statement, the line a buyer reads first

Why a certificate that names the head office does not cover a SaaS product, what clause 4.3 requires, the eight conditions a financial customer applies under DORA, and three scope statements for a software company that pass.

The Statement of Applicability, read for a software company

The four columns of Clause 6.1.3(d), the exclusions an auditor accepts and the ones they never do, and how the Statement follows the risk treatment plan.

The risk assessment, read for a software company

What Clause 6.1.2 asks for, a five-point method with an acceptance threshold, the starter risks a software company carries, and why the treatment plan comes before the Statement.

The information security policy, read for a software company

What Clause 5.2 asks for and does not, the nine sections a two-page policy carries, objectives an auditor can measure, and the mistakes the first audit flags.

The management review, read as an agenda

The seven inputs of Clause 9.3 in order, the four trends with figures, the two outputs, what the minutes have to show, and the mistakes that turn a meeting into a finding.

The corrective action record, read as a sequence

What Clause 10.2 asks for after a nonconformity, the seven sections of a record an auditor accepts, why correction is not corrective action, and the mistakes that reopen a closed finding.

ISO/IEC 27701:2025, the privacy standard on top of 27001

The standalone edition read row by row: the 70 requirements a running ISO 27001 system half covers, the 33 privacy-only ones, and the GDPR articles each control evidences.

DORA for a software vendor: the contract clauses your bank customer will send

Nine clauses in every ICT service contract and six more for a critical or important function, read from Article 30; the register of information you appear in; and which clauses an ISO 27001 system already produces the evidence for.