ISO 27001 compliance, from first gap to certification
ISO 27001 is the international standard for an Information Security Management System (ISMS). AuditLens helps you assess your readiness, implement the requirements, bring in expertise when you need it, and prepare for independent certification.
What is ISO 27001?
ISO/IEC 27001 sets out the requirements for establishing, implementing, maintaining and continually improving an Information Security Management System (ISMS) — the policies, processes and controls an organization uses to manage information security risk.
The 2022 edition groups its Annex A reference controls into four themes: organizational, people, physical and technological. Organizations decide which controls apply to them, and record that decision in a Statement of Applicability.
Certification is granted by an independent certification body after a two-stage audit, and is maintained through surveillance audits and periodic recertification.
- Current edition
- 2022
- Annex A controls
- 93
- Control themes (A.5–A.8)
- 4
- Certificate cycle
- 3 years
Who needs ISO 27001?
ISO 27001 is voluntary — but for many organizations it quickly becomes expected.
- SaaS and technology companies
Selling to enterprise customers whose procurement teams ask for an ISO 27001 certificate.
- Organizations handling sensitive data
Processing customer, financial or health data that needs demonstrable protection.
- Suppliers in regulated supply chains
Serving customers in finance, healthcare, government and other sectors with strict supplier requirements.
- Growing startups and scale-ups
Preparing for larger deals, investor due diligence or expansion into new markets.
Why organizations pursue ISO 27001
- Win and keep enterprise dealsA certificate answers the question procurement teams ask first.
- Shorter security reviewsPoint to an independently verified ISMS instead of answering every questionnaire from scratch.
- A managed security programClear ownership, risk management and continual improvement instead of ad-hoc fixes.
- Independent proof of trustAn accredited certification body verifies your ISMS — not just your own claims.
The ISO 27001 journey with AuditLens
Assess, fix, get help, get audit-ready, get independently verified and stay compliant.
- 01 · AssessFind your gapsIn AuditLens
- 02 · FixTurn gaps into actionIn AuditLens
- 03 · Get HelpBring in expertise when you need itWith a vetted expert
- 04 · Get Audit-ReadyPrepare for independent assessmentIn AuditLens
- 05 · VerifyGet independently assessedBy an independent provider
- 06 · MaintainStay compliantIn AuditLens
How ready are you for ISO 27001?
Find your gaps before paying for consultants or booking an audit. The free assessment calibrates to your organization and shows your readiness by theme in about five minutes.
Run your ISO 27001 program in one workspace
AuditLens is ISO 27001 compliance software: controls, evidence, policies, risks and audit readiness, together in one place.
- Gap AssessmentScore each control against your scope and get a prioritized remediation plan.
- ControlsThe full ISO 27001:2022 Annex A catalog with owners, status and applicability.
- EvidenceUpload artifacts or pull them from AWS, GitHub and Google Workspace, linked to controls.
- PoliciesGenerate ISO-aligned policies from templates, tailor them, and link them to controls.
- Risk ManagementAn ISO 27005-aligned risk register with treatment plans linked to controls.
- Audit ReadinessA live Audit Readiness Score, versioned Statement of Applicability and internal audits.
- AI AssistanceA Copilot that answers ISMS questions from your context and helps draft policies and evidence.
- Audit TrailEvery change recorded in a tamper-evident activity log your auditor can review.
ISO 27001 consultants and implementers, when you need them
Many teams implement ISO 27001 themselves in AuditLens. When you want extra hands or specialist knowledge, bring in a vetted implementation expert — they support your program in AuditLens rather than replacing it.
- You have no in-house ISO 27001 experience
- You need to hit an audit date quickly
- You want an expert review before the certification audit
- You need specialist help on risk assessment or policies
The independent certification pathway
ISO 27001 certification is issued by an independent certification body — never by AuditLens, and never by the consultant who helped you implement.
- 01Choose a certification body
Select an accredited certification body that fits your scope, region and industry.
- 02Stage 1 audit
The auditor reviews your ISMS documentation and readiness for Stage 2.
- 03Stage 2 audit
The auditor assesses whether your ISMS is implemented and operating effectively.
- 04Certification decision
The certification body decides whether to grant the certificate.
- 05Surveillance audits
Periodic audits during the certificate cycle keep the certificate valid.
- 06Recertification
A recertification audit renews the certificate at the end of the cycle.
Implementation and independent certification or audit are separate activities, delivered by separate providers.
Find a Certification BodyAuditLens provides compliance software and access to independent professional service providers. Certification and independent audit outcomes are determined by the relevant independent provider; AuditLens does not guarantee audit or certification outcomes.
ISO 27001 questions
How long does ISO 27001 certification take?
It depends on your scope, your starting point and how much help you have. The free assessment shows how far you are from audit-ready, which is the best basis for a realistic plan.
Do we need an ISO 27001 consultant?
Not necessarily. Many organizations implement ISO 27001 themselves using AuditLens, and bring in an implementation expert only for specific gaps or to move faster.
Who issues the ISO 27001 certificate?
An independent certification body issues the certificate after a successful Stage 1 and Stage 2 audit. AuditLens does not certify organizations and does not guarantee audit outcomes.
How many controls are in ISO 27001:2022?
Annex A of the 2022 edition lists 93 reference controls in four themes. You decide which apply to your organization and justify the decision in your Statement of Applicability.
What is the difference between ISO 27001 and SOC 2?
ISO 27001 is an international standard for an Information Security Management System (ISMS), with certification by an accredited body. SOC 2 is an attestation report on controls against the AICPA Trust Services Criteria, most common in North America.
Start with
your gaps.
Take the free readiness assessment and see what to fix first — then fix it yourself in AuditLens, bring in an expert, or both.