Get ISO 27001 certified without building a security team first.

Audit readiness depends on your scope and starting point, and typically takes 2–5 weeks with SecureSlate. The certificate then depends on the certification body's calendar and on your ISMS having run long enough to produce an internal audit and a management review. Your scoping call gives you a dated plan for both.

One fixed price agreed before work starts, covering the platform, the expert work, and the security scanning. The certification body's audit fee is paid to them directly, because the auditor has to stay independent of whoever helped you prepare. We give you a realistic range for that fee on the scoping call.

No. Your certificate has to come from an independent, accredited certification body, and whoever helps build your ISMS cannot also certify it. We coordinate with the auditor you choose or one from our partner network, then support you through Stage 1, Stage 2, and every surveillance audit after.

No. You implement the controls your risk assessment says you need, and your Statement of Applicability records why each control is included or excluded. A fully remote company, for example, can often justify excluding some physical controls. What auditors challenge is an exclusion with no reasoning behind it.

The transition period ended on 31 October 2025, so every audit now runs against ISO 27001:2022. The management clauses changed little. Annex A was restructured from 114 controls into 93, including 11 new controls such as threat intelligence, secure coding, and configuration management. If your certificate lapsed during the transition, we start with a gap analysis against the 2022 version.

Your ISMS still covers how you use the cloud: identity and access, configuration, logging, encryption, and supplier management under control 5.23. Physical data center controls are largely your provider's responsibility, and you evidence that by reviewing their certifications rather than auditing their buildings. We draw that boundary with you during scoping.

A lot. Access control, change management, vendor risk, incident response, and monitoring map closely between the two. ISO 27001 adds the management system itself: a formal risk assessment, a Statement of Applicability, internal audit, and management review. We reuse the evidence you already collect and build only what is missing.

The certificate lasts three years, with a surveillance audit in each of the second and third years and a recertification audit before it expires. Continuous monitoring keeps controls from drifting between audits, and your compliance lead runs the internal audit and management review each year, so surveillance is a check-in rather than a rebuild.

Much of the evidence work can. Cloud configuration, identity and access data, device checks, training records, vendor tracking, and code and surface scanning are collected and tested continuously by the platform. The decisions cannot, such as defining scope, judging risk, choosing what belongs in the Statement of Applicability, and running management review. SecureSlate automates the first part and gives you a compliance lead for the second.

Compliance software gives you templates, integrations, and a dashboard, but your team still runs the program. A consultant brings the expertise, but evidence often stays manual and the know-how can leave when the engagement ends. SecureSlate combines both: a compliance automation platform plus a dedicated compliance lead who runs risk workshops, documentation, internal audit, and auditor coordination, with security scanning inside the same fixed price.