The global standard for information security, earned.

ISO/IEC 27001 is the internationally recognized standard for Information Security Management Systems (ISMS). It's published by the International Organization for Standardization and specifies requirements for establishing, implementing, maintaining, and continuously improving a systematic approach to managing information security risks. You likely need it if enterprise clients are requiring it during vendor onboarding, if you're selling into European or APAC markets, if government or defense contracts require it, or if you want to demonstrate security maturity to investors and partners with a globally recognized credential.

Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur.

The time required to achieve ISO 27001 certification depends largely on an organization's readiness for certification. Once an organization is ready, the certification process typically includes a Stage 1 Audit followed by a Stage 2 Audit. Audit duration is determined by factors such as organizational size, number of locations, and the complexity of the certification scope.
‍

We can provide an estimated certification timeline after reviewing your organization's scope and certification requirements.

The Statement of Applicability (SoA) is one of the most important documents in an ISO 27001 engagement. It lists all 93 Annex A controls from ISO 27001:2022, documents which controls are applicable to your organization, whether each is implemented, and the justification for including or excluding each one.

Auditors use the SoA as a primary reference during Stage 1 and Stage 2. A poorly constructed SoA is one of the most common reasons Stage 1 audits identify issues. We build and review your SoA as part of every pre-certification engagement.

The ISO 27001:2022 update restructured Annex A from 114 controls across 14 control objectives to 93 controls across 4 themes: Organizational, People, Physical, and Technological. It added 11 new controls including threat intelligence, information security for cloud services, data masking, data leakage prevention, web filtering, and secure coding. 57 controls were merged, 23 renamed, 35 remained the same, and 1 was split.

The 2022 version also introduced 5 control attributes for better categorization and aligns more closely with ISO/IEC 27002:2022 and other modern management system standards.

The cost of ISO 27001 certification depends on factors such as organizational size, number of personnel, locations within scope, and the complexity of the activities covered by the ISMS. Audit duration is determined in accordance with established certification requirements and directly influences certification costs.

‍
We provide customized quotations based on your organization's specific certification scope and requirements. Contact us to discuss your needs and receive a proposal.

ISO 27001 certification is valid for three years, but it requires annual surveillance audits in years 1 and 2 to confirm continued compliance and ongoing ISMS improvement. Surveillance audits are lighter than the initial certification audit — they focus on specific areas of the ISMS rather than a full review. In year 3, a full recertification audit renews the certificate for another three-year cycle. Johanson Group manages your full surveillance program so these annual touchpoints are predictable and low-burden for your team.

Yes. ISO 27001 can be applied to organizations with fully remote, hybrid, or office-based workforces. The organization must demonstrate that information security risks associated with remote work are appropriately identified and controlled. Many modern SaaS and technology companies achieve certification while operating entirely remotely.

Yes. Organizations may determine that certain Annex A controls are not applicable based on their scope, activities, technology, and risk assessment results. Any excluded controls must be justified and documented in the Statement of Applicability (SoA). Exclusions cannot be used to avoid addressing relevant risks.

Certified organizations are responsible for notifying Johanson Group of significant changes that may affect their certified management system or certification scope. Examples include:

* Changes to the organization's legal name
* Changes to the organization's registered or certified address
* Addition or closure of locations within the certification scope
* Significant changes to the scope of certification
* Mergers, acquisitions, or ownership changes
* Significant organizational restructuring
* Major changes to products, services, or activities covered by the certification
* Significant changes affecting the effectiveness of the management system

Organizations should communicate these changes as soon as possible so that Johanson Group can determine whether additional review activities, audits, or updates to certification records are required.

Organizations must notify Johanson Group whenever significant changes occur that could affect the certified management system or the scope of certification. Examples include changes to the organization's name, addresses, locations, scope, ownership, or key business activities.

‍
Early notification allows Johanson Group to assess the impact of the change and determine whether additional review activities, special audits, or certificate updates are necessary. Delaying notification may affect the organization's ability to maintain accurate certification records.