Free ISO 27001 Gap Assessment:
See How Close You Are to Certification-Ready

ISO/IEC 27001 is the international standard for an information security management system (ISMS): a structured, documented program for identifying and managing information security risk. Certification is voluntary, but it’s increasingly a prerequisite in enterprise RFPs and vendor security reviews, especially for manufacturing, finance/accounting, and professional-services firms selling to larger customers. If you’re repeatedly losing deals to an “ISO 27001 required” line item, that’s usually the real trigger, more than a general sense you “should” be compliant.

As of October 31, 2025, ISO 27001:2013 certificates are no longer valid. The International Accreditation Forum set a firm transition deadline requiring all certified organizations to move to the 2022 revision, and certification bodies now audit exclusively against ISO/IEC 27001:2022. If your company (or a vendor you rely on) is still citing a 2013 certificate, treat that as expired, not current.

There’s no fixed subset that applies to every small business, that’s exactly what your Statement of Applicability is for: it documents which of the 93 controls fit your actual risk profile and operations, and justifies excluding the rest. In practice, smaller companies with simpler environments often exclude controls tied to things they don’t do (e.g., specific supplier-chain or development-environment controls) while still fully implementing the core access-control, encryption, and incident-management controls. A gap assessment like the one above is the fastest way to see where you likely stand before a consultant scopes your SoA formally.

Companies with a simple environment and few existing gaps are sometimes certification-ready in as little as 3-4 months. Most small and mid-size companies with real gaps to close realistically need 6-9 months, and companies starting from close to zero often need 9-12 months or more. The variable isn’t company size so much as how much of the ISMS (risk assessment, SoA, policies, technical controls, internal audit) already exists versus needs to be built from scratch.

For a small or mid-size company, first-year costs (gap analysis, any consultant support, and the certification body’s Stage 1/Stage 2 audit fees) typically fall in the $15,000-$50,000 range, based on published 2026 industry cost guides. A lean, mostly self-managed build using existing IT infrastructure tends toward the low end; a consultant-led project or a more complex environment (multiple locations, more systems, more vendors) tends toward the high end.

No, you need ISO 27001 first, either alongside these or as the base you build on. ISO 27017 adds cloud-specific security controls on top of ISO 27001/27002, including clarity on who, you or your cloud provider, is responsible for which control. ISO 27018 adds controls specific to protecting personally identifiable information (PII) that you process in a public cloud as a data processor. CSA STAR (the Cloud Security Alliance’s Security, Trust, Assurance and Risk program) goes a step further: STAR Level 2 certification requires you already hold, or obtain alongside it, an accredited ISO 27001 certificate, and then layers the CSA Cloud Controls Matrix on top of it. In every case, the gap assessment above is the right starting point, since all three build on the same ISMS foundation and the same Annex A controls you’re being scored against here. If a customer or prospect is specifically asking for one of these three, run the assessment above first, then talk to us about scoping the cloud-specific add-on.

That’s still a real business reason to pursue it, and it’s the single most common driver for manufacturing, finance/accounting, and professional-services firms in our experience. The certification itself, and the ISMS behind it, holds up regardless of why you started. Many companies begin the process purely to stop losing enterprise deals and end up with a genuinely more secure environment as a side effect, not the other way around.