Compliance & Certification Readiness · ISO 27001 READINESS
Facing an ISO 27001 requirement? We help organizations become audit-ready in 12–20 weeks, with a clear roadmap, practical implementation support and focused preparation to pass the audit on the first attempt.
We work directly with your certification body.
30-Day Readiness Confidence Guarantee
Move forward with a clear, complete ISO 27001 readiness report, backed by 30 days of follow-up access and complimentary refinements to the agreed deliverables.
93 / Annex A Controls Reviewed
Shared controls: evidence reuse assessed in scope.
100+ / Assessments Completed
20+ / Years of Experience
12–20 Weeks / ISO 27001 Audit Readiness
30 Days / Follow-Up Access
01
Temi brings over two decades of experience across technology, financial services, healthcare and media, including consulting engagements with Fortune 100 companies such as Amazon, Walgreens and Humana. Temi has led over 100 assessments.
From defining your ISMS scope to preparing for certification, Temi leads the engagement and participates in your certification-body calls.
02
Specific, time-bound situations where ISO 27001 certification is the next step.
An enterprise customer in Europe, the Middle East or Asia-Pacific requires ISO 27001 certification before signing. Procurement has made it a condition of approval, leaving your contract on hold. Every delay increases the risk of losing the deal. We help you prepare for certification so you can meet that requirement and move the opportunity forward.
You’re pursuing opportunities in financial services, healthcare, government or critical infrastructure where customers require ISO 27001 certification as part of supplier approval. Meeting that requirement can determine whether you qualify for the contract. We help you build the security management system and audit evidence needed to move forward.
Your international customers want recognized proof that you manage information security and protect their data responsibly. A SOC 2 report may support that confidence, but customers who require ISO 27001 still need certification. We help you prepare for this globally recognized standard so you can strengthen buyer trust and pursue opportunities across international markets.
03
ISO/IEC 27001, developed jointly by ISO and IEC, sets international requirements for an information security management system (ISMS). It helps organizations protect business and customer information by assessing risks, implementing safeguards and continually improving.
SOC 2 provides an attestation report with an auditor’s opinion. ISO 27001 provides certification: your ISMS must meet the requirements before certification is awarded. An independent, accredited certification body evaluates implementation and ongoing operation. Certification runs on a 3-year cycle, supported by annual surveillance audits.
The 2022 edition reorganized Annex A from 114 controls in 14 domains to 93 controls in 4 categories. Its 11 additions cover threat intelligence, cloud-service security, ICT continuity readiness, physical monitoring, configuration management, information deletion, data masking, leakage prevention, activity monitoring, web filtering and secure coding.
Completing a checklist or assembling policy templates is not enough. Documentation that differs from actual practice can create audit findings and delay certification. We develop an ISMS that fits your operations, with working controls and evidence your team can explain and maintain.
04
ISO 27001:2022 groups 93 controls into 4 categories. Your Statement of Applicability records which controls apply, why they are needed and their implementation status, giving auditors a clear view of your security controls. We assess applicability during the gap assessment and document the justification for any exclusions.
| Theme | Controls | What it covers |
|---|---|---|
| Organizational Controls (A.5) | 37 | Establish how your organization directs and manages information security. This largest category covers policies, roles and responsibilities, threat intelligence, asset management, access controls, third-party and vendor relationships, security within projects, and incident management. |
| People Controls (A.6) | 8 | Equip your people to protect information throughout their employment. This category covers pre-employment screening, security responsibilities in employment terms, awareness and training, disciplinary procedures, confidentiality agreements, responsibilities after employment ends, secure remote working and reporting security events. Together, these measures make security part of everyday work and strengthen your team’s ability to protect customer and business information. |
| Physical Controls (A.7) | 14 | Protect the places and equipment where your information is stored and used. This category covers perimeter security, controlled entry, secure offices and facilities, physical monitoring, protection from environmental threats, and safe working practices in restricted areas. It also addresses clear desks and locked screens, equipment placement and protection, and secure disposal of storage media. |
| Technological Controls (A.8) | 34 | Secure the systems, devices and networks that support your business. This category covers endpoint protection, privileged access, restrictions on information access, secure authentication and capacity management. It also addresses malware protection, vulnerability and configuration management, data masking, data leakage prevention, security monitoring, web filtering, secure coding and network security. |
Your organization’s risks determine which controls apply. During the gap assessment, we identify the relevant controls and record the rationale for any exclusions in your Statement of Applicability.
05
Your customers and target markets may call for both. If you already have SOC 2, we build on your existing controls and evidence to reduce duplicated implementation work. The benefit depends on the work those controls already cover, rather than the number of controls alone. During your free strategy call, we help you decide which framework to prioritize and whether a combined approach fits your business.
| Comparison | ISO 27001 | SOC 2 |
|---|---|---|
| Outcome | Certification confirming your ISMS meets the standard | Attestation report containing an independent auditor’s opinion |
| Independent assessor | Accredited certification body | Licensed CPA firm |
| Coverage and renewal | 3-year certification cycle with annual surveillance audits | Report covers a specified date or review period; customers typically request annual updates |
| Market recognition | Internationally recognized, particularly across Europe, Asia-Pacific and the Middle East | Widely requested by U.S. enterprise customers |
| Framework | ISMS requirements and 93 Annex A controls across 4 categories, selected by applicability | 5 Trust Services categories; Security is required, with others selected by scope |
| Shared controls | Shared controls: evidence reuse assessed in scope. | Shared controls: evidence reuse assessed in scope. |
| Business fit | International contracts, regulated-market opportunities and global customer assurance | Enterprise procurement, customer due diligence and investor assurance |
| Cyvelle readiness timeline | 12–20 weeks to audit readiness | 9–13 weeks to initial audit readiness |
06
Move from your initial assessment to certification readiness with a clear implementation roadmap. We build on existing SOC 2 or NIST-aligned controls and evidence to reduce duplicated work and accelerate preparation for your certification audit.
| Phase | Timing | What happens |
|---|---|---|
| Gap Assessment | Weeks 1–2 | We assess your current security program against ISO 27001:2022 requirements and all 93 Annex A controls. You receive a detailed gap assessment and prioritized remediation roadmap, showing what is already in place and what needs attention before your certification audit. |
| ISMS Development | Weeks 3–6 | We build your Information Security Management System around your business operations. This includes defining the scope, establishing your risk assessment methodology, developing policies and procedures, preparing your Statement of Applicability, and completing the mandatory documentation needed for ISO 27001 certification. |
| Control Implementation | Weeks 5–16 | We work with your team to implement the applicable Annex A controls across organizational, people, physical and technological security. We establish evidence collection and ongoing monitoring so you can demonstrate how those controls operate in practice. Implementation begins alongside ISMS development to keep preparation moving. |
| Audit Preparation | Weeks 12–20 | We conduct your internal audit, facilitate management review and prepare your team and evidence for the certification audit. We support the Stage 1 documentation review and Stage 2 assessment conducted by your independent certification body, with Temi participating in every certification-body call. |
07
A structured path to certification readiness, with practical support at every stage and minimal disruption to your team.
We evaluate your existing security practices against ISO 27001:2022 requirements and all 93 Annex A controls. Your detailed gap report and prioritized remediation roadmap show where you stand and which actions to address first.
We develop an Information Security Management System that reflects how your organization operates. This includes defining its scope, establishing your risk assessment approach, creating policies and procedures, preparing the Statement of Applicability, and completing all mandatory documentation for ISO 27001.
We work with your team to put the controls selected in your Statement of Applicability into practice. Implementation covers all 4 Annex A categories: Organizational (A.5), People (A.6), Physical (A.7) and Technological (A.8), aligning each applicable control with your risks and business operations.
We conduct your internal audit, facilitate management review and prepare your team for auditor interviews. We organize the evidence needed for your Stage 1 and Stage 2 certification audits and guide you through both stages, with Temi participating in every certification-body call.
08
Receive a fixed-price, scope-defined proposal within 24 hours of your free strategy call. Know your investment upfront, with clear deliverables and no hourly billing.
| ISO 27001 Readiness Review | Most Popular ISO 27001 Implementation & Audit Readiness |
ISO 27001 & SOC 2 Integrated Readiness |
|---|---|---|
| From $8,000 | From $20,000 | From $30,000 |
| Review against all ISO 27001:2022 requirements and 93 Annex A controls Detailed findings with prioritized remediation actions Draft Statement of Applicability ISMS documentation and evidence plan Readiness timeline based on your assessment Certification-body recommendations Management readout and 30 days of follow-up access |
All deliverables in the ISO 27001 Readiness Review, plus: Complete ISMS policies, procedures and required documentation Risk assessment methodology and assessment execution Implementation guidance and remediation ownership Internal audit planning and execution Management review facilitation Stage 1 and Stage 2 audit preparation Certification-body coordination and participation in auditor calls 30 days of follow-up access |
Everything in ISO 27001 Implementation & Audit Readiness SOC 2 readiness aligned to your required report One control framework mapped to both standards A shared evidence collection process Progress tracking across both frameworks Coordinated certification-body and CPA audit scheduling Participation in certification-body and CPA calls 30 days of follow-up access |
| Know where you stand and what it will take to become audit-ready, with your assessment and prioritized roadmap delivered within 2 weeks. | Build your ISMS, put security controls into practice and become audit-ready in 12–20 weeks, with support through both certification audit stages. | Prepare for ISO 27001 and SOC 2 together, using shared controls and evidence to reduce duplicated work and support enterprise customer requirements. |
| Within 2 weeks | 12–20 weeks | 16–24 weeks |
| Book a Free ISO 27001 Strategy Call | Book a Free ISO 27001 Strategy Call | Book a Free ISO 27001 Strategy Call |
Your ISO 27001 certification audit is conducted by an independent, accredited certification body and billed separately. Allow an indicative $10,000–$30,000 for the audit, depending on your organization’s size, scope and complexity. We help you select a certification body, compare proposals and negotiate fees.
For small projects and ad-hoc advisory work outside an agreed package or retainer, our hourly rate is $300.
09
If these customer requirements, contract opportunities or growth plans describe your business, ISO 27001 readiness is your next step.
SaaS and technology companies pursuing European or global enterprise contracts
Financial services firms seeking internationally recognized security assurance
Healthcare organizations protecting patient information across borders
Government contractors whose customers require ISO 27001 certification
Organizations with SOC 2 looking to strengthen their international credibility
Any organization whose customers, vendors or business partners request ISO 27001 certification
10
100+ assessments led by Temi, backed by 20+ years of experience
Founder-led delivery, drawing on consulting engagements with Amazon, Walgreens and Humana
Fixed-price proposals with clearly defined scope and deliverables
Integrated readiness that builds on your existing SOC 2 or NIST-aligned controls and evidence
A 30-Day Readiness Confidence Guarantee, with follow-up access and complimentary refinements to agreed deliverables
Speak with Temi about your business, target markets and timeline. Get clarity on what you need to prepare for and pass your ISO 27001 certification audit, with a fixed-price proposal within 24 hours of your free strategy call.
Choose a time for your free 30-minute call with Temi to discuss your certification goals and next steps.
11
How long does ISO 27001 readiness take? Our ISO 27001 implementation and audit-readiness program takes 12–20 weeks. Existing SOC 2 or NIST-aligned controls and evidence can accelerate preparation by reducing duplicated work. Your starting maturity, scope and available resources determine the pace. We support you through the independent certification body’s Stage 1 and Stage 2 audits.
How much does ISO 27001 readiness and certification cost? ISO 27001 readiness starts at $8,000. Your investment depends on your organization’s size, scope and complexity. Independent certification-audit fees and any selected platform or tooling are billed separately. You receive a fixed-price proposal within 24 hours of your free strategy call.
What is the difference between ISO 27001 and SOC 2? ISO 27001 is a globally recognized certification for your Information Security Management System (ISMS), with defined management requirements and 93 Annex A controls assessed for applicability. SOC 2 is an independent CPA attestation report evaluating your controls against the relevant Trust Services Criteria.
ISO 27001 supports international customer and procurement requirements, while SOC 2 is widely requested by US enterprise buyers, particularly in the SaaS market. Many organizations pursue both to meet customer requirements across markets.
Do we need ISO 27001 if we already have SOC 2? Your customers and target markets determine whether you need both. Enterprise buyers in Europe, the Middle East and Asia-Pacific may require ISO 27001 certification even when you already have a SOC 2 report.
Shared controls: evidence reuse assessed in scope. Your existing SOC 2 controls and evidence provide a strong foundation. We build on that work to reduce duplication and focus on the additional ISMS requirements needed for ISO 27001 certification.
What documents are required for ISO 27001? Your ISMS needs documented scope, an information security policy, security objectives, a risk assessment methodology and results, a risk treatment plan, and a Statement of Applicability.
You also need evidence of competence, operational planning and control, monitoring and measurement results, internal audits, management reviews, and corrective actions. We develop the documentation around how your business operates and organize the supporting evidence for your certification audit.
What is the Statement of Applicability? The Statement of Applicability (SoA) is a required ISO 27001 document that accounts for all 93 Annex A controls. It identifies which controls apply to your organization, explains their inclusion or exclusion, and records whether the applicable controls have been implemented.
It is a key document your certification auditor reviews to understand how your security controls address your organization’s risks. We develop your SoA so those decisions and their implementation status are clear and supported by evidence.
Can small companies get ISO 27001 certified? Yes. ISO 27001 applies to organizations of all sizes, including small businesses. Your ISMS can be tailored to your organization’s size, needs and risks while meeting the standard’s requirements.
Certification covers a defined scope, which may include selected services, business units or locations, accounting for relevant interfaces and dependencies. We help you define that scope and build a practical ISMS to prepare for certification and address customer requirements.
What happens after ISO 27001 certification? Your certificate follows a 3-year cycle, with annual surveillance audits to confirm that your ISMS remains effective. A recertification audit is required before the certificate expires to renew it for the next cycle.
We provide 30 days of follow-up access after your engagement. For ongoing security leadership, ISMS maintenance and surveillance-audit preparation, you can continue with our vCISO services.