ISO 27001 is the international standard for information security management, and in Europe, it's the certificate enterprise buyers ask for by name. This guide explains what the standard actually requires, how certification works, and how a startup gets there without hiring consultants.
What ISO 27001 actually is
ISO 27001 doesn't certify that your product is secure. It certifies that you run an Information Security Management System (ISMS), a living system of policies, risk assessments, controls, and reviews that manages security continuously. The auditor checks that the system exists, that it fits your organisation, and that you actually operate it.
That distinction matters: a company with modest security tooling and a well-run ISMS will pass; a company with expensive tooling and no system will not.
The building blocks
- Scope: which parts of your business the ISMS covers. For most SaaS startups: the whole company.
- Risk assessment: a register of what could go wrong, how likely, how bad, and what you're doing about each item.
- Policies: the documented rules of your security programme, access control, incident response, supplier security, and the rest.
- Annex A controls: a catalogue of 93 controls you select from based on your risks. Your choices are justified in the Statement of Applicability.
- Evidence: proof the controls operate, access reviews performed, training completed, backups tested.
- Management review & internal audit: the loop that keeps the system honest between certification audits.
The certification process
Stage 1, documentation review
An accredited certification body reviews your ISMS documentation: scope, policies, risk assessment, Statement of Applicability. They flag gaps to close before Stage 2. Think of it as a dress rehearsal.
Stage 2, the certification audit
The auditor examines whether the system operates in practice: they interview staff, sample evidence, and trace controls end to end. Pass, and you're certified for three years, with lighter surveillance audits each year in between.
The audit fee goes directly to the certification body, bodies must be independent of the software or consultants that prepared you. Certixa introduces you to three accredited bodies and preps you for both stages.
How long and how much
With automation doing the drafting and evidence collection, most startups reach Stage 1 readiness in four to eight weeks, see the detailed breakdown in how long ISO 27001 takes. On cost: the consultant-led route runs €15K–€40K before audit fees; the platform route runs from €149/month plus the audit. The full arithmetic is in our cost guide.
Where startups stumble
- Treating it as a document project. Auditors detect copy-pasted template policies immediately. The ISMS must describe your actual company.
- Scoping too cleverly. Excluding half the company from scope backfires, buyers read the certificate's scope statement.
- Evidence archaeology. Collecting a year of evidence in the week before the audit is the single most painful (and avoidable) failure mode. Automate collection from day one.
- Forgetting the operating rhythm. Certification requires an internal audit and a management review before Stage 2, schedule them early.
The no-consultant route
Everything above is systematisable, which is exactly what Certixa does: the AI drafts policies from what it learns about your company, proposes your risk register, builds your Statement of Applicability across all 93 Annex A controls, and collects evidence from your connected tools continuously. You review, decide, and approve, the parts that genuinely need you.