Before you chase ISO 27001 certification, read the contract.
Most organizations arrive at ISO 27001 because a customer, a prospect or a renewal mentioned it. The exact wording matters more than almost anything else you'll decide — and Greypike runs the ISO 27001 work either way.
Some contracts say
ISO 27001 alignment
Demonstrating that your security program follows ISO 27001 principles and controls.
Others say
ISO 27001 certification
An accredited certification body has formally audited and certified your ISMS.
Those are not the same thing — and the difference can save you a great deal of time, cost and effort.
ISO 27001 alignment or certification: which sentence is in your contract?
Go and look — it takes two minutes and it decides the size of everything that follows. Pick the one closer to what you've been sent.
Alignment
No certificate neededYou need to demonstrate that your security program follows ISO 27001 principles and controls. You do not need an external audit, a certification body, or the cost and calendar that come with them.
- Build the management system and the controls
- Evidence them the way you would for any customer review
- Answer the clause with your program, not a certificate
- Certification stays available later if a customer escalates
Certification
Accredited audit requiredYou need an accredited certification body to audit and certify your ISMS. That is a real program with a real timeline, and the work has to be done before the auditor arrives, not during.
- A defined ISMS with scope, objectives and a Statement of Applicability
- Annex A controls implemented and evidenced
- Internal audit and management review actually performed
- An accredited certification body engaged — not Greypike
If it's ambiguous, ask before you spend anything
Plenty of contracts are written by someone who used the words interchangeably. One email to your customer's procurement contact — "are you asking for alignment or for a certificate from an accredited body?" — is the highest-return question on this page.
ISO 27001 is not a list of controls. It's a management system.
The standard requires you to establish, operate, maintain, review and continually improve an Information Security Management System (ISMS). The controls sit inside that — they aren't the point of it.
Defined scope
What systems, people, locations and processes the ISMS covers.
Security objectives
The business goals the security program exists to support.
Risk assessment
A structured process for identifying and evaluating information security risks.
Risk treatment
How each identified risk will be addressed, and which controls apply.
Statement of Applicability
A record of which Annex A controls apply to you, and why.
Annex A controls
The controls selected to support your risk treatment decisions.
Internal audits
Periodic reviews of the management system, performed and recorded.
Management review
Leadership reviewing effectiveness and performance. Actually leadership.
Continual improvement
Using findings, incidents and audit results to improve over time.
Greypike does not issue ISO 27001 certifications
We're not a certification body. We help you prepare — organizing requirements, assigning work, managing evidence and reviewing readiness before an external certification audit.
Certification is performed by a certification body accredited by a national accreditation body, such as ANAB in the US or UKAS in the UK. Just as a CPA firm issues a SOC 2 report, a certification body issues the certificate.
ISO 27001:2022 changed the control structure
Organizations researching ISO 27001 run into a lot of outdated content. The current standard is ISO/IEC 27001:2022, and Annex A was restructured.
If the implementation guidance you're reading uses the old A.5–A.18 numbering, it predates the current revision. Check before you build anything from it.
ISO/IEC 27001:2022 — 93 controls in four themes
CurrentThe 2022 revision reorganized Annex A into four themes and 93 controls, including 11 new ones such as threat intelligence, information security for cloud services, data leakage prevention and secure coding. If you are implementing today, this is the structure your Statement of Applicability and your auditor will use.
Organizational controls
37 controls
Governance, policies, responsibilities, supplier management and related controls.
People controls
8 controls
Security awareness, employment-related controls and personnel responsibilities.
Physical controls
14 controls
Facilities, equipment, devices and physical protection measures.
Technological controls
34 controls
Identity and access management, logging, monitoring, encryption and related safeguards.
ISO/IEC 27001:2013 — 114 controls in fourteen domains
SupersededGuidance written before the revision organizes Annex A this way. It is not wrong about security, but the numbering no longer matches the standard you will be audited against — and a Statement of Applicability built on it will need rework. The transition period for 2013 certificates ended on October 31, 2025.
- A.5 Information security policies
- A.6 Organization of information security
- A.7 Human resource security
- A.8 Asset management
- A.9 Access control
- A.10 Cryptography
- A.11 Physical and environmental security
- A.12 Operations security
- A.13 Communications security
- A.14 System acquisition, development and maintenance
- A.15 Supplier relationships
- A.16 Incident management
- A.17 Business continuity
- A.18 Compliance
Most ISO 27001 work is operational, not documentary
Organizations often assume ISO 27001 is mainly about writing documents. In practice, most requirements turn into activities that have to keep happening.
Risk reviews
Assessing new and changing risks as the business moves.
Access reviews
Verifying that users still hold appropriate access.
Vendor management
Evaluating supplier security risks, on a cycle.
Security training
Maintaining awareness and the record that it happened.
Incident management
Documenting and responding to events when they occur.
Internal audits
Reviewing whether the management system is working.
Management reviews
Leadership oversight and the decisions that follow.
Policy maintenance
Reviewing and updating governance documentation.
The framework is important. The work is what actually produces compliance.An ISMS that exists on paper and hasn't been operated is one of the most common problems at a certification audit — and one of the hardest to fix quickly.
How Greypike runs ISO 27001 compliance
Every ISO 27001 requirement becomes one or more tasks. Instead of maintaining an ISMS through spreadsheets and calendar reminders, the management system runs as a structured workflow — and a compliance analyst checks the evidence before a certification body ever sees it.
Who this usually lands on
- Operations leaders
- Technology leaders
- Security leaders
- IT managers
- Founders
- Quality managers
A compliance analyst, included
Most organizations pursuing ISO 27001 have no dedicated compliance personnel. Greypike includes a named compliance analyst who reviews completed work and makes sure the evidence is ready before an auditor or certification body sees it.
Conduct the internal audit of the ISMS
Audit the management system against the standard and your own documented procedures. Record findings, assign corrective actions, and confirm they close.
- Owner
- Dana Whitfield, Operations
- Due
- September 30
- Evidence
- Audit report with findings and actions
- Accepted when
- Findings raised, owned and tracked to closure
- Also satisfies
- SOC 2, customer questionnaires
Not yet — the audit found nothing, and an auditor who finds nothing is the finding. A clean internal audit with no observations reads as an audit that wasn't really performed. Look again at supplier reviews and access, then resubmit.
The strongest reason to pursue ISO 27001 may be the work you've already done
Most organizations arriving here have already completed meaningful security work. The mistake is assuming all of it has to be repeated.
Tick what you've already got
What carries across into ISO 27001
7Areas of reuse
Almost everything you've already done maps onto ISO 27001 somewhere. Here is where each piece of existing work lands.
- Answers already given to customersReusable as control evidence
- Supplier security evaluationsOrganizational controls
- Existing policy setMapped, then gap-filled
- Risk assessment processFeeds risk treatment and the SoA
- SOC 2 control workSubstantial overlap with Annex A
- Evidence already collectedReused rather than recollected
- Controls already runningBecome evidence once documented
Risk assessments remain risk assessments. Access reviews remain access reviews. Greypike maps completed tasks and supporting evidence across frameworks, so you leverage what you've already invested rather than restarting.
Why organizations choose Greypike for ISO 27001
The challenge is not understanding the standard. It's making sure the work gets completed, evidence stays current, reviews happen on time, and an auditor receives a well-run program rather than a folder.
| The traditional ISO 27001 approach | Greypike |
|---|---|
| Separate compliance projects | Unified compliance program |
| Policy-heavy process | Task-based execution |
| Evidence scattered across systems | Centralized evidence management |
| Last-minute audit preparation | Continuous readiness |
| Consultant-dependent | Software with compliance analyst review |
| Duplicate effort across frameworks | Framework reuse |
ISO 27001 compliance pricing
No sales process required to see the number. ISO 27001 is one framework, and one framework is what the subscription covers. Certification audit fees are paid separately to your certification body.
$399per month
or $4,000 a year, saving $788
First 25 customers only. Standard pricing is higher. Founding customers keep this rate for 24 months. 12-month term, no setup fee.
Book a demoWhat's included
- A compliance analyst reviewing your work
- ISO 27001 converted into assigned tasks
- Evidence management
- Continuous monitoring
- Framework mapping and reuse
Adding SOC 2 later? See framework pricing →
ISO 27001 FAQ
Something not covered here? Ask us directly. The standard itself is published by ISO.
What is the difference between ISO 27001 alignment and ISO 27001 certification?
Alignment means your security program follows ISO 27001 principles and controls, which you demonstrate with your own evidence. Certification means an accredited certification body has audited your Information Security Management System and issued a certificate. Many contracts only require alignment, so check the exact wording before you commit to an audit.
How long does ISO 27001 certification take?
For a small or mid-sized organization, preparation commonly takes six to twelve months, depending on scope and what is already in place. The certification audit itself runs in two stages: a Stage 1 review of your ISMS documentation and readiness, then a Stage 2 audit of whether the system is actually operating.
What changed in ISO 27001:2022?
Annex A was restructured from 114 controls in 14 domains into 93 controls in four themes: organizational, people, physical and technological. Eleven new controls were added, including threat intelligence, information security for cloud services, data leakage prevention and secure coding. The transition period for certificates issued against ISO 27001:2013 ended on October 31, 2025.
Who issues ISO 27001 certificates?
Certification bodies that are accredited by a national accreditation body, such as ANAB in the United States or UKAS in the United Kingdom. Greypike is not a certification body; we help you prepare the ISMS and evidence before the certification audit.
How long is an ISO 27001 certificate valid?
Three years. The certification body performs surveillance audits in the years between, typically annually, and a recertification audit before the certificate expires. That is why the ISMS has to keep operating after the first audit.
Does SOC 2 work count toward ISO 27001?
Much of it. SOC 2 and ISO 27001 controls overlap substantially, so completed SOC 2 work and evidence can be reused. ISO 27001 also requires management system elements that SOC 2 does not, such as a defined ISMS scope, a Statement of Applicability, internal audits and management review.
How much does Greypike cost for ISO 27001?
Founding customer pricing is $399 a month on a 12-month term, or $4,000 a year paid up front, for one framework, with compliance analyst review included. Certification audit fees are paid separately to your certification body. See pricing.
Build the management system. Not another spreadsheet.
ISO 27001 requirements become assigned tasks and recurring workflows, with evidence reviewed by a compliance analyst. And if you have already done the work elsewhere, you bring it with you.
