ISO 27001 Certification
ISO 27001 certification, with a clear path and defined costs.
ISO 27001 is increasingly a requirement for working with large companies. We guide you through every step, from gap analysis to documentation and audit support, on a path designed to take 6–9 months.
ISO 27001 Certification
ISO 27001 certification, with a clear path and defined costs.
ISO 27001 is the international standard for information security management. For software houses and startups, it's increasingly a requirement for working with large companies and passing their supplier security reviews. The problem: the traditional path can take 12–18 months and cost €30–80k in consultancy fees. Our method is designed to cut both time and cost, without cutting corners.
12–18 months
Average certification timeline without guidance
€30–80k
Typical consultancy cost for the certification journey
93 controls
ISO 27001 Annex A controls to assess, implement, and document
Industry averages for SMBs pursuing ISO 27001 certification independently or through traditional consultancies.
Who needs ISO 27001
It's not just for enterprise anymore
Software Houses & Agencies
You build software for multiple clients across different industries. Each client has different security expectations — and enterprise clients are increasingly running security questionnaires before signing.
→ Clients require it before signing development contracts
SaaS & Startups
You're moving upmarket from SMB to enterprise. Enterprise procurement teams now run security due diligence as standard. Without ISO 27001, you'll fail the vendor assessment and lose the deal.
→ Enterprise buyers block sales without a recognized security standard
IT Service Providers & MSPs
You manage infrastructure, security, or cloud operations for clients. Your clients are increasingly contractually required to ensure their service providers hold ISO 27001 — which means you need it too.
→ Required by client contracts and public sector tenders
Companies Entering Regulated Markets
Finance, healthcare, public sector, and critical infrastructure all require demonstrable information security management. ISO 27001 is the baseline expectation before any procurement conversation starts.
→ Mandatory for regulated sector procurement
How we compare
How we get you certified
Gap Analysis
We audit your current security posture against all 93 ISO 27001 Annex A controls. We identify what's already in place, what's partially covered, and what's missing — giving you a clear, prioritized remediation list rather than an overwhelming checklist.
What you get: gap report with risk-ranked findings
Controls Implementation
We work alongside your team to implement the required controls — policies, access management, incident response procedures, asset management, supplier security. We write the documentation, not just tell you what to write.
What you get: complete ISMS documentation
Internal Audit & Audit Prep
Before you face the external auditor, we run a full internal audit simulating the certification audit. We identify any remaining gaps, fix them, and prepare your team for the questions they'll be asked so there are no surprises on audit day.
What you get: internal audit report and a team ready for the audit
Certification Audit Support
We stay with you through the Stage 1 and Stage 2 external audits. We handle auditor queries, provide supporting evidence on demand, and manage any non-conformities raised — so your team focuses on their work, not on chasing documents.
What you get: support until the certificate is issued
What you'll have at the end
A complete ISMS — not just a certificate
ISO 27001 certification is the outcome, not the deliverable. What you'll actually have is a fully documented, implemented, and audited Information Security Management System. Every document listed below is written and tailored for your specific environment.
All documents are tailored to your specific environment and scope. We don't drop generic templates in your inbox — we write documentation that reflects how your company actually operates, which is what auditors actually check.
The 93 controls
ISO 27001:2022 Annex A — what we cover
The 2022 revision of ISO 27001 restructured Annex A into four themes covering 93 controls. We assess and implement across all four. Nothing gets skipped — but not everything applies, which is what the Statement of Applicability is for.
Organizational
Policies, roles, supplier relationships, threat intelligence, information classification, asset management, and information security in project management.
People
Pre-employment screening, security terms in contracts, awareness training, disciplinary processes, remote working, and clear desk/screen policy.
Physical
Physical entry controls, secure areas, equipment security, clean desk, unattended equipment, media disposal, and off-site working security.
Technological
Endpoint protection, identity and access management, logging and monitoring, vulnerability management, secure development, cryptography, and network security.
What changes
6–9 months
A faster path
A structured method and ready-made documentation templates: for most SMBs the path is designed to take 6–9 months instead of the typical 12–18. Less time in the process means working with large companies sooner.
Cost per phase
Clear costs from the start
Large consultancies often charge €30–80k for the same scope. We give you a written quote split by phase, designed for companies that don't have an unlimited compliance budget.
One partner
Security + compliance in one
If you've already run a Complete Assessment or a Tailor Made test with us, we already know your environment. The gap analysis starts from real data, not questionnaires — which is where most of the time savings come from.
Common questions
What you're probably wondering
Ready to start your ISO 27001 journey?
The path is designed to take 6–9 months. We handle the documentation, the preparation and the audit support — so your team stays focused on building product.
ISO 27001 certification is valid for 3 years, with annual surveillance audits. We offer ongoing support packages to help you maintain compliance and pass surveillance audits without needing to restart the process from scratch each cycle.
Tell us about your project
Write to us below or, if you prefer, at contact@pinelab.dev or +39 379 3743410.