ISO 27001 for an Early-Stage Product Team

A prospect in Germany just asked whether you are ISO 27001 certified. You have six people, one product, and a codebase that was substantially written by an AI agent nine months ago. The honest answer is no, and the useful question is what you do next.

ISO 27001 is not a code standard. It is a management standard — it asks you to run a documented information security management system and to prove that you run it. That distinction matters enormously for a small team, because it means most of the work is not engineering, and the engineering that does exist is work you should have done anyway.

Here is what the standard actually asks for, what it costs at your stage, and which parts you can start this month without spending anything.

ISO 27001 vs SOC 2, in one paragraph each

SOC 2 is a US attestation. An accredited CPA firm observes your controls and writes a report describing what they saw. There is no pass or fail — there is a report with or without exceptions, and buyers read it. Type 1 is a point in time, Type 2 covers a window, usually three to twelve months.

ISO 27001 is an international certification. A certification body audits your ISMS against a fixed clause structure and the Annex A control set, then issues a certificate valid for three years with surveillance audits in between. You either get it or you do not.

Practically: US buyers ask for SOC 2, European and APAC buyers ask for ISO 27001, and enterprise buyers in regulated sectors increasingly ask for both. The underlying evidence overlaps by roughly 70–80%, so doing one first makes the second dramatically cheaper. If your pipeline is mixed, most teams do SOC 2 first and layer ISO on top — but if your first three enterprise deals are all European, invert that.

What the standard actually requires

Strip away the consulting language and ISO 27001 asks you to do five things and keep records of all of them.

1. Define scope. Which systems, data, people, and locations are covered. A small team should scope tightly — the production SaaS platform and the people who operate it, not "the whole company."
2. Assess risk. A written risk assessment: what could go wrong, how likely, how bad, what you are doing about it. This is the clause auditors probe hardest and the one startups fake most obviously.
3. Select and justify controls. You work through Annex A (93 controls in the 2022 revision) and produce a Statement of Applicability saying which apply, how you implement them, and why the rest do not.
4. Operate the system. Access reviews happen. Incidents get logged. Suppliers get assessed. Training happens. Not once — on a schedule.
5. Check yourself. Internal audit and a management review, both documented, both before the certification body shows up.

The pattern is the same throughout: the auditor is not checking whether your security is good. They are checking whether you have a system, whether you follow it, and whether you can prove both with artifacts that predate the audit.

What your codebase has to be able to prove

The Annex A controls that bite engineering teams are a short list, and they map almost exactly onto the gaps AI-assisted development leaves behind.

That secrets row is not theoretical. GitGuardian counted 28.65 million new hardcoded secrets in public GitHub commits during 2025, up 34% year over year, and AI-assisted commits leaked at roughly 3.2% versus a 1.5% baseline. If your repo was built with an agent, assume there is something in the history and scan it properly before an auditor's tooling does it for you.

The access-review control is the other reliable failure. "We all have admin, we trust each other" is a true statement and an audit finding. You need a documented role model, and it needs to be enforced in the application, not just in your heads — which is a real engineering task if the app never had one. Our RBAC implementation guide covers the shape of that work.

What it costs and how long it takes

For a team under 25 people with a single product in scope, budget:

• Certification body fees: roughly $10k–$20k for the Stage 1 and Stage 2 audits combined, then smaller surveillance audits in years two and three.
• Compliance platform: $8k–$25k a year for Vanta, Drata, Sprinto, or similar. Worth it at this size — the evidence collection alone saves you a headcount.
• Consultant or vCISO: $10k–$30k if you use one. Optional, but a first-timer without one usually loses more in calendar time than they save in fees.
• Internal engineering: the number nobody budgets. Expect four to eight weeks of real work if your app has the gaps in the table above.

Total first-year spend commonly lands in the $30k–$70k range, and the timeline from kickoff to certificate is typically four to seven months — most of which is waiting for enough operating history to exist. That is the trap: the clock starts when your controls start running, not when you decide to get certified.

Start these five things now, before you buy anything

None of these require an auditor, a platform, or a budget approval, and every one of them shortens the eventual project:

1. Turn on branch protection and require review on main. This single change creates the change-management evidence trail for the entire certification.
2. Write the asset and subprocessor list. Every service holding your data, in a spreadsheet. It takes an afternoon and it feeds the risk assessment, the SoA, your DPAs, and every security questionnaire you will answer.
3. Rotate every credential and move secrets into a manager. Assume anything the AI touched is compromised.
4. Get structured logs with retention. You cannot retrofit six months of audit logs later; you can only start producing them today. See logging practices for a small team.
5. Fix the role model in the app. This is the longest lead-time item and the one that needs actual code.

If you are not sure which of these your app already satisfies, an independent code audit will tell you in about a week, and the output doubles as your first risk assessment input.

Frequently asked questions

Are we too early for ISO 27001? If no customer has asked, yes — the money buys you nothing yet. Start the moment a certificate appears in a deal you actually want, and in the meantime run the five items above so the eventual project takes months instead of a year.

Can we get certified with an AI-generated codebase? Yes. The standard has no opinion about who or what wrote your code; it cares whether changes are controlled, access is restricted, and evidence exists. The practical issue is that agent-built apps usually lack the role model and the logging, so budget engineering time rather than assuming it is a paperwork exercise.

Does ISO 27001 cover GDPR? No, though it helps. ISO 27001 covers security management; GDPR adds lawful basis, data subject rights, residency, and processor obligations. ISO 27701 extends the standard toward privacy, and our GDPR guide for AI-built apps covers the parts certification will not.

---

If a certificate is now standing between you and a signed contract, the bottleneck is usually the application, not the paperwork — roles, secrets, and logs that were never built. SprintX closes those gaps in fixed-scope engagements and hands you the evidence your auditor will ask for. Show us your codebase and we will tell you what stands between you and Stage 2.