ISO/IEC 27001 is the international standard for building and running an information security management system (ISMS), and the most widely recognized security certification worldwide. For a US startup selling to enterprises, the practical question is usually ISO 27001 or SOC 2 first: SOC 2 dominates US procurement, ISO 27001 travels better internationally, and both rest on the same work, so a realistic program with a tight scope takes 6 to 12 months.
What ISO 27001:2022 is and what changed
The standard has two parts. Clauses 4 to 10 are mandatory and describe the management system: context, leadership, risk-based planning, support, operation, performance evaluation and improvement. Annex A is a catalog of 93 controls in four themes:
| Theme | Controls | Examples |
|---|---|---|
| Organizational (A.5) | 37 | Policies, asset inventory, suppliers, cloud services, incident management |
| People (A.6) | 8 | Screening, awareness training, remote work |
| Physical (A.7) | 14 | Perimeters, clear desk, equipment |
| Technological (A.8) | 34 | Access control, encryption, backups, logging, secure development |
The 2022 edition cut the 114 controls of the 2013 version to 93 and introduced 11 new ones, including threat intelligence, cloud services security, configuration management, information deletion, data masking, data leakage prevention, monitoring and secure coding. A 2024 amendment added climate change considerations to the organizational context.
The transition period ended on October 31, 2025. Certificates issued against the 2013 version are no longer valid, so if a vendor shows you an ISO 27001:2013 certificate today, it has expired.
ISO 27001 vs SOC 2 for US startups
US enterprise buyers usually ask for a SOC 2 report; European and global buyers usually ask for ISO 27001. The underlying controls overlap heavily.
| ISO 27001 | SOC 2 | |
|---|---|---|
| What it is | Certification of a management system against an international standard | Attestation report under AICPA standards on controls at a service organization |
| Who issues it | Accredited certification body | Independent CPA firm |
| Criteria | Clauses 4 to 10 plus risk-selected Annex A controls | Trust Services Criteria: Security, plus optional Availability, Processing Integrity, Confidentiality and Privacy |
| Output | Public certificate, valid three years with annual surveillance audits | Restricted-use report shared under NDA, typically renewed annually |
| Variants | One certification, in two audit stages | Type 1 (design at a point in time) or Type 2 (operating effectiveness over a period) |
| Strongest in | Global and international procurement | US enterprise procurement |
Rule of thumb: if your pipeline is mostly US enterprises, start with SOC 2 and design controls so they map to ISO 27001 later; if you sell into Europe, Latin America or global accounts, start with ISO 27001. Many companies end up with both and run one control set, audited twice.
If you already use the NIST Cybersecurity Framework or the CIS Controls internally, you are not starting from zero: both map well to Annex A and to the SOC 2 Trust Services Criteria. Keep a single control matrix that references every framework you need, and collect each piece of evidence once. ISO/IEC 27002 is the companion guide that explains how to implement each Annex A control, which is useful when designing them.
Steps to implement ISO 27001
- Scope: for a startup, the product, its infrastructure and the teams that build and run it, not the whole company.
- Asset inventory: systems, data, vendors, devices and people in scope.
- Risk assessment and treatment: documented method, likelihood and impact scales, and a decision per risk.
- Statement of Applicability (SoA): all 93 controls, which apply, which are excluded and why. Auditors read it closely.
- Policies and procedures: few and useful: information security, access control, acceptable use, backup, incident management, suppliers and secure development.
- Implement controls and keep evidence that they operate: tickets, logs, meeting notes, configuration screenshots.
- Internal audit by someone independent of the implementers.
- Management review of risks, incidents and metrics, with decisions recorded.
- Certification audit: Stage 1 reviews documentation and readiness; Stage 2 tests whether controls work in practice.
Realistic timelines and cost drivers
For a small organization with a tight scope, a typical plan is 2 to 3 months for gap analysis, risk assessment and documentation, 3 to 6 months of implementation while evidence accumulates, then internal audit, management review and the two certification stages: 6 to 12 months overall. "Certified in 30 days" offers usually mean template documents with no working controls behind them.
There is no list price. Cost depends on:
- Headcount in scope: certification body audit time scales with it.
- Sites and technical complexity: offices, clouds, products and critical vendors.
- Starting maturity: existing MFA, tested backups and change management cut the work significantly.
- External support: consultants, compliance automation platforms and technical testing such as a penetration test.
- Internal time: the most underestimated cost; someone has to own the ISMS.
A nearshore security team in UTC-5 can carry much of the technical implementation (cloud hardening, logging, secure SDLC, testing) during your business hours, as our cybersecurity services do, while ownership and management decisions stay in-house.
Quick wins for the first weeks
Before writing policies, close the gaps that cause most incidents at small companies. Each maps to Annex A and to SOC 2 common criteria:
- MFA on email, cloud, source control and admin tools.
- Account inventory and same-day offboarding.
- Backups with an isolated copy and a tested restore.
- A company password manager and full-disk encryption on laptops.
- Centralized cloud and application logs; on AWS, start with our AWS hardening checklist.
- A list of vendors with access to data, and their contracts.
- A one-page incident response plan; build it with our incident response plan guide.
ISO 27001 and customer security questionnaires
Selling to enterprises means security questionnaires, often hundreds of questions in formats such as SIG or CAIQ. A working ISMS changes the dynamic: you answer from policies, evidence and your SoA quickly and consistently, and many buyers accept a current certificate or SOC 2 report in place of large parts of the questionnaire. For a software vendor, that shortens sales cycles. If you also handle data from users in Latin America, our Ecuador LOPDP guide shows how ISMS controls map to privacy obligations.
Common mistakes to avoid
- Scoping too broadly: putting the whole company in the first cycle multiplies the work and the audit days. Start with the product your customers evaluate and expand later.
- Buying a template pack and calling it done: auditors certify operating controls, not documents. An access control policy with no recorded access reviews is a guaranteed finding.
- A generic risk assessment: copying someone else's risk register produces controls that do not match your real threats. Risks should come from your assets, vendors and way of working.
- Leaving evidence for the end: Stage 2, like a SOC 2 Type 2 period, needs proof that controls ran over time. Evidence collected the week before the audit is not enough.
- Outsourcing ownership: consultants and compliance platforms speed things up, but leadership must own the system, review risks and make decisions. Without an internal owner, the ISMS decays after certification and the surveillance audit notices.
- Ignoring vendors: cloud providers, outsourced developers and SaaS tools are part of your risk; know what data they hold and under which contract.
Frequently asked questions
Should a US startup get ISO 27001 or SOC 2 first?
If most of your pipeline is US enterprise customers, SOC 2 is usually requested first, so start there and design controls to map to ISO 27001 later. If you sell to Europe, Latin America or global accounts, ISO 27001 is generally the stronger signal. The controls overlap heavily, so the second framework costs far less than the first.
How long does ISO 27001 certification take?
For a startup or SMB with a tight scope, 6 to 12 months is realistic: gap analysis and risk assessment, control implementation with operating evidence, internal audit, management review and a two-stage certification audit. The timeline depends mainly on starting maturity and how much time the internal team can commit.
How many controls are in ISO 27001:2022?
Annex A of ISO/IEC 27001:2022 lists 93 controls in four themes: 37 organizational, 8 people, 14 physical and 34 technological. Not all are mandatory; each organization selects controls based on its risk assessment and justifies exclusions in the Statement of Applicability.
Is an ISO 27001:2013 certificate still valid?
No. The transition period ended on October 31, 2025, and certificates issued against the 2013 version are no longer valid. Every current certificate must reference ISO/IEC 27001:2022. If a vendor presents a 2013 certificate during due diligence, ask for the updated one.
What is the difference between SOC 2 Type 1 and Type 2?
A SOC 2 Type 1 report assesses whether controls are suitably designed at a single point in time. A Type 2 report also tests whether they operated effectively over a review period, commonly several months to a year. Enterprise buyers usually want Type 2; a Type 1 can bridge the gap while the observation period runs.
Conclusion
ISO 27001 is not a binder of policies; it is a system for choosing controls based on risk and proving they work. Start with a tight scope, close the quick wins and build evidence from day one, whichever framework you pursue first. For a gap assessment against ISO 27001 or SOC 2, or hands-on help implementing the technical controls, explore our cybersecurity services or book a free consultation.