Access control and secure authentication
ZTNA, secure server access, device control and disk encryption cover a large block of the technological theme directly, and generate their own records.
ISO 27001
ISO 27001, without the management-system theatre.
ISO 27001 certifies a management system, which is why it reads as paperwork. It only works if real controls sit underneath it. Osto runs those controls and keeps the records the certification body asks to see.
What it asks for
What a certification body comes to check.
ISO 27001:2022 splits into clauses 4 to 10, which define the information security management system, and Annex A, which lists 93 controls you select from. Both are audited, in two stages.
Clauses 4 to 10, the management system
Context, leadership, planning, support, operation, performance evaluation and improvement. This is the half people underestimate: it is about whether security is governed, not whether a firewall exists.
Annex A, 93 controls in four themes
Organisational, people, physical and technological. You justify every inclusion and every exclusion in a Statement of Applicability, and the auditor reads it.
A risk assessment you can defend
Risks identified, owners assigned, treatment decided and residual risk accepted by someone with the authority to accept it. Controls that trace back to no risk are the most common finding.
Stage 1, then Stage 2, then surveillance
Stage 1 reviews documentation. Stage 2 tests whether you do what the documents say. Certification runs three years with surveillance audits in between, so this does not end at the certificate.
How Osto covers it
The technological controls, actually running.
Annex A's technological theme is where most of the evidence lives and where a documentation-only approach runs out. These are modules, not policies.
Logging, monitoring and threat intelligence
Continuous detection across cloud, network and endpoint, with cloud posture management on AWS, Azure and GCP. Annex A asks for monitoring activities; this is what performs them.
Secure development and technical vulnerability management
SAST, SCA, SBOM and license compliance in the pipeline, plus web, mobile and API scanners and expert-led VAPT against the running system.
Evidence gathered as you go
The platform's compliance module maps what each control produces to the Annex A reference it satisfies, so the Statement of Applicability has something behind each line.
Every module named above is on the platform page, with a short demo of each.
The honest difference
The certificate, and what has to be true under it.
ISO 27001 is the framework most often reduced to a document exercise, because the clauses genuinely are documentation. The controls underneath are not.
Documentation alone
- Policies, procedures and a Statement of Applicability
- A risk register with owners and treatment plans
- Records that controls were reviewed
- An auditor asking to see the control operating
- A surveillance audit twelve months later
With Osto underneath
- The same documents, mapped to controls that exist
- The same register, with technical risks already treated
- Records generated by the control, not written about it
- The control demonstrated live, in your own environment
- Still running, because it was never a one-off
ISO 27001 library
Everything we have written about ISO 27001.
Written by the team that runs the controls, not a content desk.
Start here
Requirements and controls
Risk and internal audit
Getting certified, and staying certified
Questions
The things founders ask first.
How long does ISO 27001 certification take?
Three to nine months for most startups, driven almost entirely by how much of the management system already exists. The Stage 1 and Stage 2 audits themselves are days. Scheduling with a certification body is often the longest single wait.
Is ISO 27001 worth it for an early-stage startup?
It depends on who is asking. ISO 27001 carries more weight in Europe, the UK, India and the Middle East, while North American buyers usually ask for SOC 2 first. If your pipeline is split, doing both is less than twice the work because the controls overlap heavily.
What changed in ISO 27001:2022?
Annex A was restructured from 114 controls in 14 domains to 93 in 4 themes, with 11 new controls including threat intelligence, cloud services and secure coding. The clauses barely moved. If you certified against 2013, the transition is a remapping exercise rather than a rebuild.
Do we need an internal audit before certification?
Yes. Clause 9.2 requires it, and the certification body will ask for the results at Stage 1. It has to be done by someone independent of the area being audited, which for a small team usually means an outside pair of hands.
Does ISO 27001 cover India's DPDP Act?
Partly, and usefully. The security obligations overlap enough that one programme can serve both, but DPDP adds consent, notice and data-principal rights that ISO 27001 does not address. Treat it as a strong head start, not as coverage.
Get ISO 27001 ready the way it actually works.
Thirty minutes, your stack on screen, an honest read on what is already in place and what is not.