The Global Standard for Information Security
If SOC 2 is the entry ticket for selling to US enterprise customers, ISO 27001 is the entry ticket for selling globally. ISO 27001 is the world’s most widely recognized information security standard, with certifications held by over 70,000 organizations across every industry and geography.
For SaaS companies expanding beyond the US market, ISO 27001 certification is often non-negotiable. European, Australian, and Asian enterprise buyers expect it. Government contracts frequently require it. And increasingly, even US-based customers view it as a signal of security maturity that goes beyond what SOC 2 alone demonstrates.
What ISO 27001 Actually Is
ISO 27001 is a management system standard. That distinction matters. It doesn’t prescribe a specific set of technical controls the way PCI DSS does. Instead, it requires you to build and operate an Information Security Management System (ISMS): a systematic approach to managing sensitive information so that it remains secure.
The standard has two main components:
Management System Clauses (4-10). These define the requirements for establishing, implementing, maintaining, and continually improving your ISMS. They cover organizational context, leadership commitment, planning, support, operation, performance evaluation, and improvement.
Annex A Controls. A reference set of 93 controls (in the 2022 version) organized into four themes: organizational, people, physical, and technological. You don’t implement all of them blindly. You conduct a risk assessment, determine which controls are relevant to your risk profile, and document your decisions in a Statement of Applicability.
The Certification Process
Stage 1 Audit (Documentation Review)
Your certification body reviews your ISMS documentation: policies, risk assessment methodology, Statement of Applicability, risk treatment plan, and evidence that the management system is operational. They identify any major gaps that need to be resolved before Stage 2.
Stage 2 Audit (Implementation Assessment)
The auditor spends time on-site (or remotely) evaluating whether your ISMS is effectively implemented and operating as documented. They interview staff, review evidence, test controls, and assess whether your management system is actually driving security outcomes, not just producing documents.
Surveillance Audits
After initial certification, you undergo annual surveillance audits that review a subset of your ISMS. These ensure you’re maintaining and improving the system between full recertification cycles.
Recertification Audit
Every three years, you undergo a full recertification audit similar in scope to the initial Stage 2.
Timeline for SaaS Companies
A realistic timeline from kickoff to certification:
Months 1-2: Gap Assessment & Planning. Evaluate your current security posture against ISO 27001 requirements. Identify what you have, what you’re missing, and what needs to change. Define your ISMS scope.
Months 2-5: ISMS Design & Implementation. Write policies, establish your risk assessment methodology, conduct your initial risk assessment, build your Statement of Applicability, implement controls, and set up monitoring and measurement processes.
Months 5-6: Internal Audit & Management Review. Conduct your required internal audit (or have someone conduct it for you). Hold a management review meeting. Address any findings.
Months 6-7: Stage 1 Audit. Your certification body reviews your documentation and confirms you’re ready for Stage 2.
Months 7-8: Stage 2 Audit. The implementation audit. If you’ve done the work, this should go smoothly.
Eight months is achievable for a SaaS company that’s organized and committed. Companies with existing SOC 2 programs or strong security foundations can sometimes compress this to six months.
ISO 27001:2022 Changes
The 2022 revision updated Annex A significantly. The previous 114 controls across 14 domains were reorganized into 93 controls across four themes. Eleven new controls were added, reflecting modern security concerns:
- Threat intelligence
- Cloud security
- ICT readiness for business continuity
- Physical security monitoring
- Configuration management
- Information deletion
- Data masking
- Data leakage prevention
- Monitoring activities
- Web filtering
- Secure coding
If you’re pursuing certification now, you’ll certify against ISO 27001:2022. If you’re already certified against the 2013 version, you need to transition by October 2025.
Common Challenges for SaaS Companies
Over-scoping. The most common mistake is making your ISMS scope too broad. Start with the systems, people, and processes that handle your customers’ data. You can expand scope later. A tightly scoped ISMS that’s genuinely effective is better than a broadly scoped one that exists only on paper.
Documentation overload. ISO 27001 requires documented information, but it doesn’t require bureaucracy. Your policies should reflect what you actually do, not what you think an auditor wants to hear. Concise, accurate documentation beats verbose fiction every time.
Risk assessment theater. The risk assessment is the engine of your ISMS. Everything flows from it: your Statement of Applicability, your control selection, your treatment plans. A formulaic risk assessment that doesn’t reflect your actual threat landscape produces an ISMS that doesn’t actually protect anything.
Neglecting the management system. Companies focus on implementing Annex A controls and neglect the management system clauses. But the management system is what makes ISO 27001 work long-term: leadership commitment, internal audit, management review, continual improvement. Without it, your controls decay over time.
Treating it as a project. Certification isn’t the finish line. It’s the starting point. The value of ISO 27001 is the ongoing management system that continuously improves your security posture. Companies that treat certification as a one-time project struggle through every surveillance audit.
ISO 27001 and SOC 2: Complementary, Not Redundant
Many SaaS companies wonder whether they need both. The short answer: it depends on your market.
ISO 27001 gives you a certifiable management system recognized globally. SOC 2 gives you a detailed attestation report that US customers expect. There’s significant control overlap, typically 60-70%, so pursuing both is more efficient than it might seem.
If you’re selling primarily to US enterprise customers, start with SOC 2. If you’re selling globally or to government, start with ISO 27001. If you’re doing both, build a unified control framework from the start so you’re not maintaining two separate programs.
Getting Started
The best first step is a gap assessment: a structured evaluation of where you stand today against ISO 27001 requirements. It tells you exactly what you need to build, what you can leverage from existing practices, and how to sequence your implementation.
At Concerto, we’ve guided dozens of SaaS companies through ISO 27001 certification. We understand cloud-native architectures, modern development practices, and how to build an ISMS that works for fast-moving teams rather than against them. Schedule a consultation to discuss what certification looks like for your organization.
