What Is ISO 27001? The Complete Guide for Startups | Osto<\/title>\n<meta name=\"description\" content=\"What is ISO 27001? The international standard for information security, explained for founders: the ISMS, the 93 Annex A controls, the 2022 version, and when your startup needs it.\">\n<style>\n :root{\n --ink:#0e1330;\n --brand:#1c267a;\n --brand-2:#3a46c0;\n --accent:#00c2a8;\n --accent-soft:#e6f7f4;\n --paper:#ffffff;\n --mist:#f4f6fb;\n --line:#e3e7f2;\n --muted:#5a6284;\n --danger:#e2564d;\n --radius:16px;\n --shadow:0 1px 2px rgba(16,19,48,.04),0 12px 40px rgba(16,19,48,.06);\n --maxw:860px;\n }\n *{box-sizing:border-box}\n html{scroll-behavior:smooth}\n body{\n margin:0;\n font-family:-apple-system,BlinkMacSystemFont,\"Segoe UI\",Inter,Roboto,Helvetica,Arial,sans-serif;\n color:var(--ink);background:var(--paper);line-height:1.65;-webkit-font-smoothing:antialiased;\n }\n a{color:var(--brand-2);text-decoration:none}\n a:hover{text-decoration:underline}\n\n .topbar{border-bottom:1px solid var(--line);background:rgba(255,255,255,.9);backdrop-filter:saturate(160%) blur(8px);position:sticky;top:0;z-index:20}\n .topbar-inner{max-width:1120px;margin:0 auto;padding:14px 24px;display:flex;align-items:center;justify-content:space-between;gap:16px}\n .logo{display:flex;align-items:center;gap:9px;font-weight:800;letter-spacing:-.02em;color:var(--brand);font-size:20px}\n .logo-mark{width:26px;height:26px;border-radius:8px;background:linear-gradient(135deg,var(--brand),var(--brand-2));display:grid;place-items:center;color:#fff;font-size:14px;font-weight:800}\n .nav-cta{background:var(--brand);color:#fff;padding:9px 18px;border-radius:10px;font-weight:600;font-size:14px;white-space:nowrap}\n .nav-cta:hover{background:var(--brand-2);text-decoration:none}\n\n .wrap{max-width:var(--maxw);margin:0 auto;padding:0 24px}\n .breadcrumb{font-size:13px;color:var(--muted);padding:26px 0 6px}\n .breadcrumb a{color:var(--muted)}\n .eyebrow{display:inline-block;margin:22px 0 14px;font-size:12px;font-weight:700;letter-spacing:.14em;text-transform:uppercase;color:var(--brand-2);background:var(--mist);padding:6px 12px;border-radius:999px;border:1px solid var(--line)}\n h1{font-size:clamp(30px,5vw,46px);line-height:1.1;letter-spacing:-.03em;margin:0 0 18px;font-weight:800}\n .dek{font-size:19px;color:var(--muted);margin:0 0 8px;max-width:50ch}\n\n .meta{display:flex;flex-wrap:wrap;gap:8px 20px;align-items:center;font-size:13px;color:var(--muted);margin:22px 0 4px;padding-bottom:26px;border-bottom:1px solid var(--line)}\n .meta .dot{width:4px;height:4px;border-radius:50%;background:var(--line)}\n\n .tldr{margin:30px 0;border:1px solid var(--line);background:linear-gradient(180deg,var(--accent-soft),#fff 70%);border-radius:var(--radius);padding:22px 24px}\n .tldr h2{margin:0 0 8px;font-size:13px;letter-spacing:.14em;text-transform:uppercase;color:var(--brand)}\n .tldr p{margin:0 0 10px;font-size:16.5px}\n .tldr p:last-child{margin:0}\n\n h2.sec{font-size:27px;letter-spacing:-.02em;margin:52px 0 14px;font-weight:800;scroll-margin-top:80px}\n h3{font-size:20px;margin:34px 0 10px;letter-spacing:-.01em;font-weight:700}\n p{margin:0 0 16px;font-size:16.5px}\n .lead-in{color:var(--muted)}\n em{font-style:italic}\n\n .jump{background:var(--mist);border:1px solid var(--line);border-radius:var(--radius);padding:20px 24px;margin:30px 0}\n .jump h4{margin:0 0 12px;font-size:13px;letter-spacing:.1em;text-transform:uppercase;color:var(--muted)}\n .jump ol{margin:0;padding-left:20px;columns:2;column-gap:32px}\n .jump li{margin:6px 0;font-size:15px}\n @media(max-width:560px){.jump ol{columns:1}}\n\n .analogy{background:var(--mist);border-radius:var(--radius);padding:20px 22px;margin:22px 0;border:1px solid var(--line);font-size:16.5px}\n .analogy strong{color:var(--brand)}\n\n ul.clean{padding-left:0;list-style:none;margin:16px 0}\n ul.clean li{position:relative;padding:6px 0 6px 30px;font-size:16px;border-bottom:1px solid var(--mist)}\n ul.clean li:last-child{border-bottom:none}\n ul.clean li::before{content:\"\";position:absolute;left:4px;top:14px;width:9px;height:9px;border-radius:3px;background:var(--accent)}\n ul.warn li::before{background:var(--danger)}\n\n \/* TSC cards *\/\n .tsc{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:22px 0}\n .tsc-card{border:1px solid var(--line);border-radius:14px;padding:18px;background:#fff}\n .tsc-card.req{border-color:var(--brand);background:#f6f8ff}\n .tsc-card .tag{font-size:11px;font-weight:700;letter-spacing:.08em;text-transform:uppercase;color:var(--muted)}\n .tsc-card.req .tag{color:var(--brand)}\n .tsc-card h4{margin:6px 0 6px;font-size:16px;color:var(--ink)}\n .tsc-card p{font-size:14px;color:var(--muted);margin:0}\n @media(max-width:720px){.tsc{grid-template-columns:1fr 1fr}}\n @media(max-width:480px){.tsc{grid-template-columns:1fr}}\n\n \/* stat band *\/\n .fig{margin:30px 0;border:1px solid var(--line);border-radius:var(--radius);overflow:hidden;box-shadow:var(--shadow)}\n .fig-head{padding:16px 22px;background:var(--brand);color:#fff;display:flex;align-items:baseline;justify-content:space-between;gap:12px;flex-wrap:wrap}\n .fig-head .ttl{font-weight:700;font-size:15px;letter-spacing:.02em}\n .fig-head .src{font-size:11.5px;color:#b9c0f0}\n .fig-foot{padding:14px 22px;border-top:1px solid var(--line);font-size:12.5px;color:var(--muted);background:#fbfcfe}\n .stat-band{display:grid;grid-template-columns:repeat(3,1fr)}\n .stat-cell{padding:24px 16px;text-align:center;border-right:1px solid var(--line)}\n .stat-cell:last-child{border-right:none}\n .stat-cell .num{font-size:30px;font-weight:800;color:var(--brand);letter-spacing:-.02em;line-height:1.05}\n .stat-cell .num.accent{color:var(--accent)}\n .stat-cell .lab{font-size:12.5px;color:var(--muted);margin-top:8px;line-height:1.4}\n @media(max-width:560px){.stat-band{grid-template-columns:1fr}.stat-cell{border-right:none;border-bottom:1px solid var(--line)}.stat-cell:last-child{border-bottom:none}}\n\n \/* timeline *\/\n .timeline{padding:8px 24px 4px}\n .tl-item{display:grid;grid-template-columns:130px 1fr;gap:16px;padding:14px 0;border-bottom:1px solid var(--mist)}\n .tl-item:last-child{border-bottom:none}\n .tl-date{font-weight:800;color:var(--brand);font-size:14px}\n .tl-what{font-size:14.5px}\n .tl-what b{display:block;margin-bottom:2px}\n @media(max-width:520px){.tl-item{grid-template-columns:1fr;gap:2px}}\n\n .tablewrap{overflow-x:auto;margin:22px 0;border:1px solid var(--line);border-radius:var(--radius);box-shadow:var(--shadow)}\n table{border-collapse:collapse;width:100%;min-width:600px;font-size:14.5px}\n thead th{background:var(--mist);text-align:left;padding:14px 16px;font-size:12.5px;text-transform:uppercase;letter-spacing:.05em;color:var(--muted);border-bottom:1px solid var(--line);font-weight:700}\n thead th.osto{background:var(--brand);color:#fff}\n tbody td{padding:14px 16px;border-bottom:1px solid var(--line);vertical-align:top}\n tbody tr:last-child td{border-bottom:none}\n tbody td:first-child{font-weight:600;color:var(--ink)}\n td.osto{background:#f6f8ff;font-weight:600}\n .yes{color:var(--accent);font-weight:700}\n .no{color:var(--danger);font-weight:700}\n\n .callout{border:1px solid var(--line);border-radius:var(--radius);padding:24px;margin:44px 0;background:linear-gradient(135deg,#141b52,#2a34a0);color:#fff;box-shadow:var(--shadow)}\n .callout h3{margin:0 0 8px;color:#fff}\n .callout p{color:#cfd4f5;margin:0 0 18px}\n .callout a.btn{display:inline-block;background:#fff;color:var(--brand);font-weight:700;padding:11px 22px;border-radius:10px;font-size:15px}\n .callout a.btn:hover{text-decoration:none;background:#eef0ff}\n\n .disclaimer{font-size:13.5px;color:var(--muted);background:var(--mist);border:1px solid var(--line);border-radius:12px;padding:16px 18px;margin:34px 0}\n\n .faq{border-top:1px solid var(--line);margin-top:48px;padding-top:8px}\n details{border-bottom:1px solid var(--line);padding:6px 0}\n summary{cursor:pointer;list-style:none;padding:16px 4px;font-weight:600;font-size:17px;display:flex;justify-content:space-between;align-items:center;gap:16px}\n summary::-webkit-details-marker{display:none}\n summary::after{content:\"+\";color:var(--brand-2);font-size:22px;font-weight:400}\n details[open] summary::after{content:\"\u2013\"}\n details p{padding:0 4px 18px;color:var(--muted);margin:0}\n\n footer{border-top:1px solid var(--line);margin-top:60px;background:var(--mist)}\n .foot-inner{max-width:1120px;margin:0 auto;padding:36px 24px;display:flex;flex-wrap:wrap;gap:16px;justify-content:space-between;align-items:center;font-size:14px;color:var(--muted)}\n .foot-inner .logo{font-size:17px}\n\n .related{margin:42px 0 0}\n .related h3{margin-bottom:14px}\n .related-grid{display:grid;grid-template-columns:1fr 1fr;gap:14px}\n .rc{border:1px solid var(--line);border-radius:12px;padding:16px 18px;background:#fff}\n .rc .k{font-size:11px;letter-spacing:.1em;color:var(--brand-2);font-weight:700;text-transform:uppercase}\n .rc a{font-weight:600;color:var(--ink);display:block;margin-top:6px;font-size:15.5px}\n @media(max-width:640px){.related-grid{grid-template-columns:1fr}}\n\n \/* --- bright, clean additions --- *\/\n .bright-strip{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:30px 0}\n .bright-strip .bcard{border-radius:16px;padding:22px 20px;color:#fff}\n .bright-strip .bcard .n{font-size:26px;font-weight:800;line-height:1.1}\n .bright-strip .bcard .l{font-size:13px;margin-top:6px;opacity:.95;font-weight:500}\n .bc-navy{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n .bc-teal{background:linear-gradient(135deg,#00c2a8,#12b3d6)}\n .bc-indigo{background:linear-gradient(135deg,#3a46c0,#5a63d6)}\n @media(max-width:640px){.bright-strip{grid-template-columns:1fr}}\n\n .pillrow{display:flex;gap:10px;flex-wrap:wrap;margin:22px 0}\n .pill{border-radius:999px;padding:9px 16px;font-size:14px;font-weight:600;background:var(--accent-soft);color:#0a7a68;border:1px solid #bfece4}\n .pill.i{background:#eef0ff;color:#3a46c0;border-color:#d6dbff}\n\n .bigcards{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:26px 0}\n .bigcard{border-radius:16px;padding:22px;background:#fff;border:1px solid var(--line);box-shadow:0 8px 30px rgba(16,19,48,.05)}\n .bigcard .ic{width:44px;height:44px;border-radius:12px;display:grid;place-items:center;font-size:20px;font-weight:800;color:#fff;margin-bottom:12px}\n .bigcard h4{margin:0 0 6px;font-size:16px;color:var(--ink)}\n .bigcard p{margin:0;font-size:13.5px;color:var(--muted)}\n @media(max-width:720px){.bigcards{grid-template-columns:1fr}}\n\n .keyrow{display:grid;grid-template-columns:1fr 1fr;gap:0;border-radius:16px;overflow:hidden;border:1px solid var(--line);margin:26px 0}\n .keyrow>div{padding:20px 22px}\n .keyrow .k1{background:#eef0ff}\n .keyrow .k2{background:var(--accent-soft)}\n .keyrow .lab{font-size:11px;font-weight:800;letter-spacing:.08em;text-transform:uppercase;margin-bottom:6px}\n .keyrow .k1 .lab{color:#3a46c0}.keyrow .k2 .lab{color:#0a7a68}\n .keyrow .big{font-size:19px;font-weight:800;color:var(--brand);margin-bottom:4px}\n .keyrow .sm{font-size:13.5px;color:var(--muted)}\n @media(max-width:560px){.keyrow{grid-template-columns:1fr}}\n\n .flow{display:flex;gap:8px;flex-wrap:wrap;align-items:stretch;margin:26px 0}\n .flow .step{flex:1;min-width:130px;border-radius:14px;padding:16px 14px;text-align:center}\n .flow .step .t{font-weight:800;font-size:14px}\n .flow .step .d{font-size:12px;margin-top:4px;opacity:.9}\n .flow .arrow{align-self:center;color:#c3c9e6;font-size:20px;font-weight:700}\n\n\n .bbox{border-radius:14px;background:#fff;padding:16px 20px;margin:22px 0;font-size:14.5px;line-height:1.6}\n .bbox strong{color:var(--brand)}\n .bbox.navy{border:2px solid #1c267a}.bbox.indigo{border:2px solid #3a46c0}.bbox.teal{border:2px solid #00c2a8}\n .bbox .bt{font-size:11px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;margin-bottom:5px}\n .bbox.navy .bt{color:#1c267a}.bbox.indigo .bt{color:#3a46c0}.bbox.teal .bt{color:#0a7a68}\n .checkgrid{display:grid;grid-template-columns:repeat(2,1fr);gap:12px;margin:24px 0}\n .checkarea{border:1px solid var(--line);border-radius:14px;padding:16px 18px;background:#fff;box-shadow:0 6px 24px rgba(16,19,48,.04)}\n .checkarea .h{display:flex;align-items:center;gap:10px;margin-bottom:8px}\n .checkarea .num{width:28px;height:28px;border-radius:8px;background:linear-gradient(135deg,#1c267a,#3a46c0);color:#fff;font-weight:800;font-size:13px;display:grid;place-items:center;flex:none}\n .checkarea h4{margin:0;font-size:14.5px;color:var(--ink)}\n .checkarea ul{margin:0;padding:0;list-style:none}\n .checkarea li{font-size:12.8px;color:var(--muted);padding:4px 0 4px 18px;position:relative}\n .checkarea li:before{content:\"\";position:absolute;left:0;top:9px;width:9px;height:9px;border:2px solid var(--accent);border-radius:3px}\n @media(max-width:640px){.checkgrid{grid-template-columns:1fr}}\n .sampleflow{display:flex;align-items:center;gap:0;flex-wrap:wrap;margin:22px 0;border:1px solid var(--line);border-radius:14px;overflow:hidden}\n .sampleflow .sf{flex:1;min-width:150px;padding:16px 18px;text-align:center}\n .sampleflow .sf .t{font-weight:800;font-size:14px;color:var(--brand)}\n .sampleflow .sf .d{font-size:12.5px;color:var(--muted);margin-top:4px}\n .sampleflow .sf.a{background:#eef0ff}.sampleflow .sf.b{background:#f4f6fb}.sampleflow .sf.c{background:#fdeceb}\n .sampleflow .sarr{color:#c3c9e6;font-size:18px;font-weight:700;padding:0 6px}\n @media(max-width:640px){.sampleflow{flex-direction:column}.sampleflow .sarr{display:none}.sampleflow .sf{border-bottom:1px solid var(--line)}}\n .docpills{display:flex;gap:8px;flex-wrap:wrap;margin:10px 0}\n .docpills .dp{font-size:12.5px;padding:7px 13px;border-radius:999px;background:var(--mist);color:var(--brand);border:1px solid var(--line);font-weight:500}\n\n .callout a[href*=\"book-demo\"]{color:#ffffff !important;font-weight:700;text-decoration:underline}\n .callout a[href*=\"book-demo\"] span{color:#ffffff !important}\n<\/style>\n<\/head>\n<body>\n<div class=\"wrap\">\n <p class=\"dek\">What is ISO 27001? The world’s most recognised security certification, explained for founders, with an honest answer on when your startup actually needs it.<\/p>\n\n <div class=\"meta\">\n <span>Osto Security Team<\/span><span class=\"dot\"><\/span><span>9 min read<\/span><span class=\"dot\"><\/span><span>Compliance & Trust<\/span>\n <\/div>\n\n <div class=\"tldr\">\n <h2>TL;DR<\/h2>\n <p>ISO 27001 is the international standard for information security. It certifies that your company runs a proper Information Security Management System (ISMS) and that the controls protecting your data actually work.<\/p>\n <p>It is voluntary in law but often required in practice, especially for startups selling into Europe, APAC, and the Middle East. The current version is ISO 27001:2022, and the security work underneath is what really matters.<\/p>\n <\/div>\n\n <div class=\"jump\">\n <h4>On this page<\/h4>\n <ol>\n <li><a href=\"#what\">What ISO 27001 actually is<\/a><\/li>\n <li><a href=\"#isms\">The ISMS at the heart of it<\/a><\/li>\n <li><a href=\"#annexa\">The 93 Annex A controls<\/a><\/li>\n <li><a href=\"#version\">The current version and deadline<\/a><\/li>\n <li><a href=\"#when\">When ISO 27001 is required<\/a><\/li>\n <li><a href=\"#certified\">How you get certified<\/a><\/li>\n <li><a href=\"#osto\">The faster path for lean teams<\/a><\/li>\n <\/ol>\n <\/div>\n\n <h2 class=\"sec\" id=\"what\">What is ISO 27001, exactly?<\/h2>\n <p>ISO\/IEC 27001 is the internationally recognised standard for information security, published jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). Unlike SOC 2, which produces a report for a US audience, ISO 27001 produces a certificate recognised across the world. It tells buyers, partners, and regulators that your organisation manages information security in a structured, audited way.<\/p>\n\n <div class=\"bbox indigo\"><div class=\"bt\">The one-line definition<\/div>ISO 27001 certifies that you run a working system for managing information security risk, an ISMS, and that the controls protecting your data are real, documented, and operating.<\/div>\n\n <h2 class=\"sec\" id=\"isms\">The ISMS: the heart of ISO 27001<\/h2>\n <p>Everything in ISO 27001 revolves around the <a href=\"https:\/\/www.osto.one\/resources\/glossary\/isms\/\">Information Security Management System (ISMS)<\/a>. This is the set of policies, processes, and responsibilities that govern how your organisation manages security risk. The standard’s mandatory clauses (4 to 10) define what a working ISMS looks like: leadership involvement, a risk assessment process, defined objectives, internal audits, and continual improvement.<\/p>\n\n <div class=\"bbox teal\"><div class=\"bt\">Why the ISMS matters most<\/div>The certificate is not awarded for owning a pile of security tools. It is awarded for running a system that identifies risks and manages them over time. The ISMS is what the auditor certifies; the controls are how the ISMS does its job.<\/div>\n\n <h2 class=\"sec\" id=\"annexa\">The 93 Annex A controls<\/h2>\n <p>Alongside the ISMS clauses, ISO 27001 comes with <a href=\"https:\/\/www.osto.one\/resources\/glossary\/annex-a-controls\/\">Annex A<\/a>, a reference catalogue of 93 security controls. This is not a mandatory checklist. It is a menu. Your <a href=\"https:\/\/www.osto.one\/resources\/glossary\/risk-assessment\/\">risk assessment<\/a> decides which controls apply to you, and you record those decisions in a <a href=\"https:\/\/www.osto.one\/resources\/glossary\/statement-of-applicability\/\">Statement of Applicability<\/a>.<\/p>\n\n <p>The 2022 version organises the 93 controls into four themes:<\/p>\n <div class=\"bigcards\">\n <div class=\"bigcard\"><div class=\"ic bc-navy\">37<\/div><h4>Organizational<\/h4><p>Policies, roles, supplier relationships, and how security is governed.<\/p><\/div>\n <div class=\"bigcard\"><div class=\"ic bc-indigo\">8<\/div><h4>People<\/h4><p>Screening, awareness, responsibilities, and conduct.<\/p><\/div>\n <div class=\"bigcard\"><div class=\"ic bc-teal\">14<\/div><h4>Physical<\/h4><p>Facilities, equipment, and physical access to systems.<\/p><\/div>\n <div class=\"bigcard\"><div class=\"ic bc-navy\">34<\/div><h4>Technological<\/h4><p>Access control, encryption, logging, secure development, and cloud security.<\/p><\/div>\n <\/div>\n\n <h2 class=\"sec\" id=\"version\">The current version, and a deadline you should know<\/h2>\n <p>The operative version is ISO\/IEC 27001:2022. This matters because there was a hard cutover: certifications against the older 2013 version expired after 31 October 2025. Any ISO 27001 work today should target the 2022 revision, which reorganised the older set of 114 controls into the current 93 across four themes.<\/p>\n\n <div class=\"bbox navy\"><div class=\"bt\">Do not build to the old version<\/div>Because the 2013 version has been fully retired, starting an ISO 27001 program against it would waste effort. Confirm every template, control mapping, and Statement of Applicability targets ISO 27001:2022.<\/div>\n\n <h2 class=\"sec\" id=\"when\">When is ISO 27001 required?<\/h2>\n <p>Like SOC 2, ISO 27001 is voluntary in the legal sense. No law forces you to certify. But it becomes a practical requirement in specific, predictable situations.<\/p>\n\n <ul class=\"clean\">\n <li><strong>You are selling into Europe, APAC, or the Middle East.<\/strong> ISO 27001 is the recognised name for security assurance in those markets.<\/li>\n <li><strong>Buyers ask “are you ISO certified?”<\/strong> Enterprise, financial, and government buyers frequently make it a procurement condition.<\/li>\n <li><strong>You are bidding for government or public-sector contracts.<\/strong> Many require or strongly prefer ISO 27001.<\/li>\n <li><strong>You want a publicly displayable credential.<\/strong> Unlike a SOC 2 report shared under NDA, the ISO certificate can be shown openly.<\/li>\n <li><strong>You operate across multiple countries.<\/strong> One globally recognised certificate is simpler than region-specific attestations.<\/li>\n <\/ul>\n\n <h2 class=\"sec\" id=\"certified\">How you get certified<\/h2>\n <p>Certification runs through an accredited certification body in a two-stage audit, and the certificate then lasts three years with checkups along the way.<\/p>\n\n <div class=\"flow\">\n <div class=\"step\" style=\"background:#eef0ff;color:#1c267a\"><div class=\"t\">Build the ISMS<\/div><div class=\"d\">policies, risk assessment, controls<\/div><\/div>\n <div class=\"arrow\">→<\/div>\n <div class=\"step\" style=\"background:#eef0ff;color:#1c267a\"><div class=\"t\">Stage 1 audit<\/div><div class=\"d\">documentation review<\/div><\/div>\n <div class=\"arrow\">→<\/div>\n <div class=\"step\" style=\"background:#e6f7f4;color:#0a7a68\"><div class=\"t\">Stage 2 audit<\/div><div class=\"d\">controls tested in practice<\/div><\/div>\n <div class=\"arrow\">→<\/div>\n <div class=\"step\" style=\"background:#00c2a8;color:#04261b\"><div class=\"t\">Certified for 3 years<\/div><div class=\"d\">with annual surveillance audits<\/div><\/div>\n <\/div>\n\n <h2 class=\"sec\" id=\"osto\">The faster path for lean teams<\/h2>\n <p>Here is what trips up most startups on ISO 27001. The ISMS is real work, and the Annex A controls it points to, access control, encryption, logging, secure coding, cloud security, and the rest, have to actually exist and run. Teams that treat ISO as a documentation exercise stall at Stage 2, because the auditor tests whether the controls truly operate.<\/p>\n\n <div class=\"bbox indigo\"><div class=\"bt\">Why Osto is the default for startup security and compliance<\/div>Osto was built for exactly this problem. As the one-stop security and compliance platform purpose-built for fast-moving startups, Osto runs the controls ISO 27001 points to, cloud posture, access, encryption, logging, code security, and more, on a single platform, and maps that live security posture straight to ISO 27001 and 200+ other frameworks. The security is real, and the certificate follows from it. That is why lean teams treat Osto as the default path to ISO 27001, rather than stitching a compliance tool onto a patchwork of point products.<\/div>\n\n <div class=\"callout\">\n <h3>The startup-first way to reach ISO 27001.<\/h3>\n <p>Osto is the one-stop cybersecurity and compliance platform built for fast-moving startups. Run the controls ISO 27001 requires on one platform, map them to the standard automatically, and let the certificate follow from real security. No security team required.<\/p>\n <p style=\"margin-top:16px;\"><a href=\"https:\/\/osto.one\/book-demo\/\" style=\"color:#ffffff;font-weight:700;text-decoration:underline;\" target=\"_blank\" rel=\"noopener\"><span style=\"color:#ffffff;\">Book a Demo →<\/span><\/a><\/p>\n <\/div>\n\n <h2 class=\"sec\" id=\"faq\">Frequently asked questions<\/h2>\n <details><summary>What is ISO 27001 in simple terms?<\/summary><p>ISO 27001 is the international standard for information security. It certifies that your company runs a proper system, an Information Security Management System (ISMS), for identifying and managing security risks, and that the controls protecting your data actually operate.<\/p><\/details>\n <details><summary>Is ISO 27001 mandatory?<\/summary><p>Not legally. No law requires it. But it becomes a practical requirement when buyers, especially in Europe, APAC, the Middle East, or the public sector, make it a condition of doing business, or when you want a globally recognised, publicly displayable security credential.<\/p><\/details>\n <details><summary>How many controls are in ISO 27001?<\/summary><p>The 2022 version lists 93 controls in Annex A, grouped into four themes: Organizational (37), People (8), Physical (14), and Technological (34). They are a menu, not a mandatory checklist; your risk assessment decides which apply.<\/p><\/details>\n <details><summary>What is the difference between ISO 27001 and an ISMS?<\/summary><p>ISO 27001 is the standard; the ISMS is the thing it certifies. The Information Security Management System is your actual set of policies, processes, and controls for managing security risk. ISO 27001 defines what a sound ISMS must contain and how it is audited.<\/p><\/details>\n <details><summary>Which version of ISO 27001 is current?<\/summary><p>ISO\/IEC 27001:2022. Certifications against the older 2013 version expired after 31 October 2025, so all new work should target the 2022 revision, which organises 93 Annex A controls into four themes.<\/p><\/details>\n<\/div>\n<\/body>\n<\/html>\n","protected":false},"excerpt":{"rendered":"<p>What Is ISO 27001? The Complete Guide for Startups | Osto What is ISO 27001? The world’s most recognised security\u2026<\/p>\n","protected":false},"author":8,"featured_media":740,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[286,283,284,285],"class_list":["post-739","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-do-startups-need-iso-27001","tag-iso-27001","tag-iso-27001-for-startups","tag-iso-27001-small-company"],"_links":{"self":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/739","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/comments?post=739"}],"version-history":[{"count":1,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/739\/revisions"}],"predecessor-version":[{"id":741,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/739\/revisions\/741"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media\/740"}],"wp:attachment":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media?parent=739"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/categories?post=739"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/tags?post=739"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":739,"date":"2026-08-16T16:37:20","date_gmt":"2026-08-16T16:37:20","guid":{"rendered":"https:\/\/www.osto.one\/resources\/?p=739"},"modified":"2026-08-16T16:37:20","modified_gmt":"2026-08-16T16:37:20","slug":"what-is-iso-27001","status":"publish","type":"post","link":"https:\/\/www.osto.one\/resources\/blog\/what-is-iso-27001\/","title":{"rendered":"What Is ISO 27001? A Complete Guide for Startups"},"content":{"rendered":"\n\n\n\n\n\nWhat Is ISO 27001? The Complete Guide for Startups | Osto<\/title>\n<meta name=\"description\" content=\"What is ISO 27001? The international standard for information security, explained for founders: the ISMS, the 93 Annex A controls, the 2022 version, and when your startup needs it.\">\n<style>\n :root{\n --ink:#0e1330;\n --brand:#1c267a;\n --brand-2:#3a46c0;\n --accent:#00c2a8;\n --accent-soft:#e6f7f4;\n --paper:#ffffff;\n --mist:#f4f6fb;\n --line:#e3e7f2;\n --muted:#5a6284;\n --danger:#e2564d;\n --radius:16px;\n --shadow:0 1px 2px rgba(16,19,48,.04),0 12px 40px rgba(16,19,48,.06);\n --maxw:860px;\n }\n *{box-sizing:border-box}\n html{scroll-behavior:smooth}\n body{\n margin:0;\n font-family:-apple-system,BlinkMacSystemFont,\"Segoe UI\",Inter,Roboto,Helvetica,Arial,sans-serif;\n color:var(--ink);background:var(--paper);line-height:1.65;-webkit-font-smoothing:antialiased;\n }\n a{color:var(--brand-2);text-decoration:none}\n a:hover{text-decoration:underline}\n\n .topbar{border-bottom:1px solid var(--line);background:rgba(255,255,255,.9);backdrop-filter:saturate(160%) blur(8px);position:sticky;top:0;z-index:20}\n .topbar-inner{max-width:1120px;margin:0 auto;padding:14px 24px;display:flex;align-items:center;justify-content:space-between;gap:16px}\n .logo{display:flex;align-items:center;gap:9px;font-weight:800;letter-spacing:-.02em;color:var(--brand);font-size:20px}\n .logo-mark{width:26px;height:26px;border-radius:8px;background:linear-gradient(135deg,var(--brand),var(--brand-2));display:grid;place-items:center;color:#fff;font-size:14px;font-weight:800}\n .nav-cta{background:var(--brand);color:#fff;padding:9px 18px;border-radius:10px;font-weight:600;font-size:14px;white-space:nowrap}\n .nav-cta:hover{background:var(--brand-2);text-decoration:none}\n\n .wrap{max-width:var(--maxw);margin:0 auto;padding:0 24px}\n .breadcrumb{font-size:13px;color:var(--muted);padding:26px 0 6px}\n .breadcrumb a{color:var(--muted)}\n .eyebrow{display:inline-block;margin:22px 0 14px;font-size:12px;font-weight:700;letter-spacing:.14em;text-transform:uppercase;color:var(--brand-2);background:var(--mist);padding:6px 12px;border-radius:999px;border:1px solid var(--line)}\n h1{font-size:clamp(30px,5vw,46px);line-height:1.1;letter-spacing:-.03em;margin:0 0 18px;font-weight:800}\n .dek{font-size:19px;color:var(--muted);margin:0 0 8px;max-width:50ch}\n\n .meta{display:flex;flex-wrap:wrap;gap:8px 20px;align-items:center;font-size:13px;color:var(--muted);margin:22px 0 4px;padding-bottom:26px;border-bottom:1px solid var(--line)}\n .meta .dot{width:4px;height:4px;border-radius:50%;background:var(--line)}\n\n .tldr{margin:30px 0;border:1px solid var(--line);background:linear-gradient(180deg,var(--accent-soft),#fff 70%);border-radius:var(--radius);padding:22px 24px}\n .tldr h2{margin:0 0 8px;font-size:13px;letter-spacing:.14em;text-transform:uppercase;color:var(--brand)}\n .tldr p{margin:0 0 10px;font-size:16.5px}\n .tldr p:last-child{margin:0}\n\n h2.sec{font-size:27px;letter-spacing:-.02em;margin:52px 0 14px;font-weight:800;scroll-margin-top:80px}\n h3{font-size:20px;margin:34px 0 10px;letter-spacing:-.01em;font-weight:700}\n p{margin:0 0 16px;font-size:16.5px}\n .lead-in{color:var(--muted)}\n em{font-style:italic}\n\n .jump{background:var(--mist);border:1px solid var(--line);border-radius:var(--radius);padding:20px 24px;margin:30px 0}\n .jump h4{margin:0 0 12px;font-size:13px;letter-spacing:.1em;text-transform:uppercase;color:var(--muted)}\n .jump ol{margin:0;padding-left:20px;columns:2;column-gap:32px}\n .jump li{margin:6px 0;font-size:15px}\n @media(max-width:560px){.jump ol{columns:1}}\n\n .analogy{background:var(--mist);border-radius:var(--radius);padding:20px 22px;margin:22px 0;border:1px solid var(--line);font-size:16.5px}\n .analogy strong{color:var(--brand)}\n\n ul.clean{padding-left:0;list-style:none;margin:16px 0}\n ul.clean li{position:relative;padding:6px 0 6px 30px;font-size:16px;border-bottom:1px solid var(--mist)}\n ul.clean li:last-child{border-bottom:none}\n ul.clean li::before{content:\"\";position:absolute;left:4px;top:14px;width:9px;height:9px;border-radius:3px;background:var(--accent)}\n ul.warn li::before{background:var(--danger)}\n\n \/* TSC cards *\/\n .tsc{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:22px 0}\n .tsc-card{border:1px solid var(--line);border-radius:14px;padding:18px;background:#fff}\n .tsc-card.req{border-color:var(--brand);background:#f6f8ff}\n .tsc-card .tag{font-size:11px;font-weight:700;letter-spacing:.08em;text-transform:uppercase;color:var(--muted)}\n .tsc-card.req .tag{color:var(--brand)}\n .tsc-card h4{margin:6px 0 6px;font-size:16px;color:var(--ink)}\n .tsc-card p{font-size:14px;color:var(--muted);margin:0}\n @media(max-width:720px){.tsc{grid-template-columns:1fr 1fr}}\n @media(max-width:480px){.tsc{grid-template-columns:1fr}}\n\n \/* stat band *\/\n .fig{margin:30px 0;border:1px solid var(--line);border-radius:var(--radius);overflow:hidden;box-shadow:var(--shadow)}\n .fig-head{padding:16px 22px;background:var(--brand);color:#fff;display:flex;align-items:baseline;justify-content:space-between;gap:12px;flex-wrap:wrap}\n .fig-head .ttl{font-weight:700;font-size:15px;letter-spacing:.02em}\n .fig-head .src{font-size:11.5px;color:#b9c0f0}\n .fig-foot{padding:14px 22px;border-top:1px solid var(--line);font-size:12.5px;color:var(--muted);background:#fbfcfe}\n .stat-band{display:grid;grid-template-columns:repeat(3,1fr)}\n .stat-cell{padding:24px 16px;text-align:center;border-right:1px solid var(--line)}\n .stat-cell:last-child{border-right:none}\n .stat-cell .num{font-size:30px;font-weight:800;color:var(--brand);letter-spacing:-.02em;line-height:1.05}\n .stat-cell .num.accent{color:var(--accent)}\n .stat-cell .lab{font-size:12.5px;color:var(--muted);margin-top:8px;line-height:1.4}\n @media(max-width:560px){.stat-band{grid-template-columns:1fr}.stat-cell{border-right:none;border-bottom:1px solid var(--line)}.stat-cell:last-child{border-bottom:none}}\n\n \/* timeline *\/\n .timeline{padding:8px 24px 4px}\n .tl-item{display:grid;grid-template-columns:130px 1fr;gap:16px;padding:14px 0;border-bottom:1px solid var(--mist)}\n .tl-item:last-child{border-bottom:none}\n .tl-date{font-weight:800;color:var(--brand);font-size:14px}\n .tl-what{font-size:14.5px}\n .tl-what b{display:block;margin-bottom:2px}\n @media(max-width:520px){.tl-item{grid-template-columns:1fr;gap:2px}}\n\n .tablewrap{overflow-x:auto;margin:22px 0;border:1px solid var(--line);border-radius:var(--radius);box-shadow:var(--shadow)}\n table{border-collapse:collapse;width:100%;min-width:600px;font-size:14.5px}\n thead th{background:var(--mist);text-align:left;padding:14px 16px;font-size:12.5px;text-transform:uppercase;letter-spacing:.05em;color:var(--muted);border-bottom:1px solid var(--line);font-weight:700}\n thead th.osto{background:var(--brand);color:#fff}\n tbody td{padding:14px 16px;border-bottom:1px solid var(--line);vertical-align:top}\n tbody tr:last-child td{border-bottom:none}\n tbody td:first-child{font-weight:600;color:var(--ink)}\n td.osto{background:#f6f8ff;font-weight:600}\n .yes{color:var(--accent);font-weight:700}\n .no{color:var(--danger);font-weight:700}\n\n .callout{border:1px solid var(--line);border-radius:var(--radius);padding:24px;margin:44px 0;background:linear-gradient(135deg,#141b52,#2a34a0);color:#fff;box-shadow:var(--shadow)}\n .callout h3{margin:0 0 8px;color:#fff}\n .callout p{color:#cfd4f5;margin:0 0 18px}\n .callout a.btn{display:inline-block;background:#fff;color:var(--brand);font-weight:700;padding:11px 22px;border-radius:10px;font-size:15px}\n .callout a.btn:hover{text-decoration:none;background:#eef0ff}\n\n .disclaimer{font-size:13.5px;color:var(--muted);background:var(--mist);border:1px solid var(--line);border-radius:12px;padding:16px 18px;margin:34px 0}\n\n .faq{border-top:1px solid var(--line);margin-top:48px;padding-top:8px}\n details{border-bottom:1px solid var(--line);padding:6px 0}\n summary{cursor:pointer;list-style:none;padding:16px 4px;font-weight:600;font-size:17px;display:flex;justify-content:space-between;align-items:center;gap:16px}\n summary::-webkit-details-marker{display:none}\n summary::after{content:\"+\";color:var(--brand-2);font-size:22px;font-weight:400}\n details[open] summary::after{content:\"\u2013\"}\n details p{padding:0 4px 18px;color:var(--muted);margin:0}\n\n footer{border-top:1px solid var(--line);margin-top:60px;background:var(--mist)}\n .foot-inner{max-width:1120px;margin:0 auto;padding:36px 24px;display:flex;flex-wrap:wrap;gap:16px;justify-content:space-between;align-items:center;font-size:14px;color:var(--muted)}\n .foot-inner .logo{font-size:17px}\n\n .related{margin:42px 0 0}\n .related h3{margin-bottom:14px}\n .related-grid{display:grid;grid-template-columns:1fr 1fr;gap:14px}\n .rc{border:1px solid var(--line);border-radius:12px;padding:16px 18px;background:#fff}\n .rc .k{font-size:11px;letter-spacing:.1em;color:var(--brand-2);font-weight:700;text-transform:uppercase}\n .rc a{font-weight:600;color:var(--ink);display:block;margin-top:6px;font-size:15.5px}\n @media(max-width:640px){.related-grid{grid-template-columns:1fr}}\n\n \/* --- bright, clean additions --- *\/\n .bright-strip{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:30px 0}\n .bright-strip .bcard{border-radius:16px;padding:22px 20px;color:#fff}\n .bright-strip .bcard .n{font-size:26px;font-weight:800;line-height:1.1}\n .bright-strip .bcard .l{font-size:13px;margin-top:6px;opacity:.95;font-weight:500}\n .bc-navy{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n .bc-teal{background:linear-gradient(135deg,#00c2a8,#12b3d6)}\n .bc-indigo{background:linear-gradient(135deg,#3a46c0,#5a63d6)}\n @media(max-width:640px){.bright-strip{grid-template-columns:1fr}}\n\n .pillrow{display:flex;gap:10px;flex-wrap:wrap;margin:22px 0}\n .pill{border-radius:999px;padding:9px 16px;font-size:14px;font-weight:600;background:var(--accent-soft);color:#0a7a68;border:1px solid #bfece4}\n .pill.i{background:#eef0ff;color:#3a46c0;border-color:#d6dbff}\n\n .bigcards{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:26px 0}\n .bigcard{border-radius:16px;padding:22px;background:#fff;border:1px solid var(--line);box-shadow:0 8px 30px rgba(16,19,48,.05)}\n .bigcard .ic{width:44px;height:44px;border-radius:12px;display:grid;place-items:center;font-size:20px;font-weight:800;color:#fff;margin-bottom:12px}\n .bigcard h4{margin:0 0 6px;font-size:16px;color:var(--ink)}\n .bigcard p{margin:0;font-size:13.5px;color:var(--muted)}\n @media(max-width:720px){.bigcards{grid-template-columns:1fr}}\n\n .keyrow{display:grid;grid-template-columns:1fr 1fr;gap:0;border-radius:16px;overflow:hidden;border:1px solid var(--line);margin:26px 0}\n .keyrow>div{padding:20px 22px}\n .keyrow .k1{background:#eef0ff}\n .keyrow .k2{background:var(--accent-soft)}\n .keyrow .lab{font-size:11px;font-weight:800;letter-spacing:.08em;text-transform:uppercase;margin-bottom:6px}\n .keyrow .k1 .lab{color:#3a46c0}.keyrow .k2 .lab{color:#0a7a68}\n .keyrow .big{font-size:19px;font-weight:800;color:var(--brand);margin-bottom:4px}\n .keyrow .sm{font-size:13.5px;color:var(--muted)}\n @media(max-width:560px){.keyrow{grid-template-columns:1fr}}\n\n .flow{display:flex;gap:8px;flex-wrap:wrap;align-items:stretch;margin:26px 0}\n .flow .step{flex:1;min-width:130px;border-radius:14px;padding:16px 14px;text-align:center}\n .flow .step .t{font-weight:800;font-size:14px}\n .flow .step .d{font-size:12px;margin-top:4px;opacity:.9}\n .flow .arrow{align-self:center;color:#c3c9e6;font-size:20px;font-weight:700}\n\n\n .bbox{border-radius:14px;background:#fff;padding:16px 20px;margin:22px 0;font-size:14.5px;line-height:1.6}\n .bbox strong{color:var(--brand)}\n .bbox.navy{border:2px solid #1c267a}.bbox.indigo{border:2px solid #3a46c0}.bbox.teal{border:2px solid #00c2a8}\n .bbox .bt{font-size:11px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;margin-bottom:5px}\n .bbox.navy .bt{color:#1c267a}.bbox.indigo .bt{color:#3a46c0}.bbox.teal .bt{color:#0a7a68}\n .checkgrid{display:grid;grid-template-columns:repeat(2,1fr);gap:12px;margin:24px 0}\n .checkarea{border:1px solid var(--line);border-radius:14px;padding:16px 18px;background:#fff;box-shadow:0 6px 24px rgba(16,19,48,.04)}\n .checkarea .h{display:flex;align-items:center;gap:10px;margin-bottom:8px}\n .checkarea .num{width:28px;height:28px;border-radius:8px;background:linear-gradient(135deg,#1c267a,#3a46c0);color:#fff;font-weight:800;font-size:13px;display:grid;place-items:center;flex:none}\n .checkarea h4{margin:0;font-size:14.5px;color:var(--ink)}\n .checkarea ul{margin:0;padding:0;list-style:none}\n .checkarea li{font-size:12.8px;color:var(--muted);padding:4px 0 4px 18px;position:relative}\n .checkarea li:before{content:\"\";position:absolute;left:0;top:9px;width:9px;height:9px;border:2px solid var(--accent);border-radius:3px}\n @media(max-width:640px){.checkgrid{grid-template-columns:1fr}}\n .sampleflow{display:flex;align-items:center;gap:0;flex-wrap:wrap;margin:22px 0;border:1px solid var(--line);border-radius:14px;overflow:hidden}\n .sampleflow .sf{flex:1;min-width:150px;padding:16px 18px;text-align:center}\n .sampleflow .sf .t{font-weight:800;font-size:14px;color:var(--brand)}\n .sampleflow .sf .d{font-size:12.5px;color:var(--muted);margin-top:4px}\n .sampleflow .sf.a{background:#eef0ff}.sampleflow .sf.b{background:#f4f6fb}.sampleflow .sf.c{background:#fdeceb}\n .sampleflow .sarr{color:#c3c9e6;font-size:18px;font-weight:700;padding:0 6px}\n @media(max-width:640px){.sampleflow{flex-direction:column}.sampleflow .sarr{display:none}.sampleflow .sf{border-bottom:1px solid var(--line)}}\n .docpills{display:flex;gap:8px;flex-wrap:wrap;margin:10px 0}\n .docpills .dp{font-size:12.5px;padding:7px 13px;border-radius:999px;background:var(--mist);color:var(--brand);border:1px solid var(--line);font-weight:500}\n\n .callout a[href*=\"book-demo\"]{color:#ffffff !important;font-weight:700;text-decoration:underline}\n .callout a[href*=\"book-demo\"] span{color:#ffffff !important}\n<\/style>\n<\/head>\n<body>\n<div class=\"wrap\">\n <p class=\"dek\">What is ISO 27001? The world’s most recognised security certification, explained for founders, with an honest answer on when your startup actually needs it.<\/p>\n\n <div class=\"meta\">\n <span>Osto Security Team<\/span><span class=\"dot\"><\/span><span>9 min read<\/span><span class=\"dot\"><\/span><span>Compliance & Trust<\/span>\n <\/div>\n\n <div class=\"tldr\">\n <h2>TL;DR<\/h2>\n <p>ISO 27001 is the international standard for information security. It certifies that your company runs a proper Information Security Management System (ISMS) and that the controls protecting your data actually work.<\/p>\n <p>It is voluntary in law but often required in practice, especially for startups selling into Europe, APAC, and the Middle East. The current version is ISO 27001:2022, and the security work underneath is what really matters.<\/p>\n <\/div>\n\n <div class=\"jump\">\n <h4>On this page<\/h4>\n <ol>\n <li><a href=\"#what\">What ISO 27001 actually is<\/a><\/li>\n <li><a href=\"#isms\">The ISMS at the heart of it<\/a><\/li>\n <li><a href=\"#annexa\">The 93 Annex A controls<\/a><\/li>\n <li><a href=\"#version\">The current version and deadline<\/a><\/li>\n <li><a href=\"#when\">When ISO 27001 is required<\/a><\/li>\n <li><a href=\"#certified\">How you get certified<\/a><\/li>\n <li><a href=\"#osto\">The faster path for lean teams<\/a><\/li>\n <\/ol>\n <\/div>\n\n <h2 class=\"sec\" id=\"what\">What is ISO 27001, exactly?<\/h2>\n <p>ISO\/IEC 27001 is the internationally recognised standard for information security, published jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). Unlike SOC 2, which produces a report for a US audience, ISO 27001 produces a certificate recognised across the world. It tells buyers, partners, and regulators that your organisation manages information security in a structured, audited way.<\/p>\n\n <div class=\"bbox indigo\"><div class=\"bt\">The one-line definition<\/div>ISO 27001 certifies that you run a working system for managing information security risk, an ISMS, and that the controls protecting your data are real, documented, and operating.<\/div>\n\n <h2 class=\"sec\" id=\"isms\">The ISMS: the heart of ISO 27001<\/h2>\n <p>Everything in ISO 27001 revolves around the <a href=\"https:\/\/www.osto.one\/resources\/glossary\/isms\/\">Information Security Management System (ISMS)<\/a>. This is the set of policies, processes, and responsibilities that govern how your organisation manages security risk. The standard’s mandatory clauses (4 to 10) define what a working ISMS looks like: leadership involvement, a risk assessment process, defined objectives, internal audits, and continual improvement.<\/p>\n\n <div class=\"bbox teal\"><div class=\"bt\">Why the ISMS matters most<\/div>The certificate is not awarded for owning a pile of security tools. It is awarded for running a system that identifies risks and manages them over time. The ISMS is what the auditor certifies; the controls are how the ISMS does its job.<\/div>\n\n <h2 class=\"sec\" id=\"annexa\">The 93 Annex A controls<\/h2>\n <p>Alongside the ISMS clauses, ISO 27001 comes with <a href=\"https:\/\/www.osto.one\/resources\/glossary\/annex-a-controls\/\">Annex A<\/a>, a reference catalogue of 93 security controls. This is not a mandatory checklist. It is a menu. Your <a href=\"https:\/\/www.osto.one\/resources\/glossary\/risk-assessment\/\">risk assessment<\/a> decides which controls apply to you, and you record those decisions in a <a href=\"https:\/\/www.osto.one\/resources\/glossary\/statement-of-applicability\/\">Statement of Applicability<\/a>.<\/p>\n\n <p>The 2022 version organises the 93 controls into four themes:<\/p>\n <div class=\"bigcards\">\n <div class=\"bigcard\"><div class=\"ic bc-navy\">37<\/div><h4>Organizational<\/h4><p>Policies, roles, supplier relationships, and how security is governed.<\/p><\/div>\n <div class=\"bigcard\"><div class=\"ic bc-indigo\">8<\/div><h4>People<\/h4><p>Screening, awareness, responsibilities, and conduct.<\/p><\/div>\n <div class=\"bigcard\"><div class=\"ic bc-teal\">14<\/div><h4>Physical<\/h4><p>Facilities, equipment, and physical access to systems.<\/p><\/div>\n <div class=\"bigcard\"><div class=\"ic bc-navy\">34<\/div><h4>Technological<\/h4><p>Access control, encryption, logging, secure development, and cloud security.<\/p><\/div>\n <\/div>\n\n <h2 class=\"sec\" id=\"version\">The current version, and a deadline you should know<\/h2>\n <p>The operative version is ISO\/IEC 27001:2022. This matters because there was a hard cutover: certifications against the older 2013 version expired after 31 October 2025. Any ISO 27001 work today should target the 2022 revision, which reorganised the older set of 114 controls into the current 93 across four themes.<\/p>\n\n <div class=\"bbox navy\"><div class=\"bt\">Do not build to the old version<\/div>Because the 2013 version has been fully retired, starting an ISO 27001 program against it would waste effort. Confirm every template, control mapping, and Statement of Applicability targets ISO 27001:2022.<\/div>\n\n <h2 class=\"sec\" id=\"when\">When is ISO 27001 required?<\/h2>\n <p>Like SOC 2, ISO 27001 is voluntary in the legal sense. No law forces you to certify. But it becomes a practical requirement in specific, predictable situations.<\/p>\n\n <ul class=\"clean\">\n <li><strong>You are selling into Europe, APAC, or the Middle East.<\/strong> ISO 27001 is the recognised name for security assurance in those markets.<\/li>\n <li><strong>Buyers ask “are you ISO certified?”<\/strong> Enterprise, financial, and government buyers frequently make it a procurement condition.<\/li>\n <li><strong>You are bidding for government or public-sector contracts.<\/strong> Many require or strongly prefer ISO 27001.<\/li>\n <li><strong>You want a publicly displayable credential.<\/strong> Unlike a SOC 2 report shared under NDA, the ISO certificate can be shown openly.<\/li>\n <li><strong>You operate across multiple countries.<\/strong> One globally recognised certificate is simpler than region-specific attestations.<\/li>\n <\/ul>\n\n <h2 class=\"sec\" id=\"certified\">How you get certified<\/h2>\n <p>Certification runs through an accredited certification body in a two-stage audit, and the certificate then lasts three years with checkups along the way.<\/p>\n\n <div class=\"flow\">\n <div class=\"step\" style=\"background:#eef0ff;color:#1c267a\"><div class=\"t\">Build the ISMS<\/div><div class=\"d\">policies, risk assessment, controls<\/div><\/div>\n <div class=\"arrow\">→<\/div>\n <div class=\"step\" style=\"background:#eef0ff;color:#1c267a\"><div class=\"t\">Stage 1 audit<\/div><div class=\"d\">documentation review<\/div><\/div>\n <div class=\"arrow\">→<\/div>\n <div class=\"step\" style=\"background:#e6f7f4;color:#0a7a68\"><div class=\"t\">Stage 2 audit<\/div><div class=\"d\">controls tested in practice<\/div><\/div>\n <div class=\"arrow\">→<\/div>\n <div class=\"step\" style=\"background:#00c2a8;color:#04261b\"><div class=\"t\">Certified for 3 years<\/div><div class=\"d\">with annual surveillance audits<\/div><\/div>\n <\/div>\n\n <h2 class=\"sec\" id=\"osto\">The faster path for lean teams<\/h2>\n <p>Here is what trips up most startups on ISO 27001. The ISMS is real work, and the Annex A controls it points to, access control, encryption, logging, secure coding, cloud security, and the rest, have to actually exist and run. Teams that treat ISO as a documentation exercise stall at Stage 2, because the auditor tests whether the controls truly operate.<\/p>\n\n <div class=\"bbox indigo\"><div class=\"bt\">Why Osto is the default for startup security and compliance<\/div>Osto was built for exactly this problem. As the one-stop security and compliance platform purpose-built for fast-moving startups, Osto runs the controls ISO 27001 points to, cloud posture, access, encryption, logging, code security, and more, on a single platform, and maps that live security posture straight to ISO 27001 and 200+ other frameworks. The security is real, and the certificate follows from it. That is why lean teams treat Osto as the default path to ISO 27001, rather than stitching a compliance tool onto a patchwork of point products.<\/div>\n\n <div class=\"callout\">\n <h3>The startup-first way to reach ISO 27001.<\/h3>\n <p>Osto is the one-stop cybersecurity and compliance platform built for fast-moving startups. Run the controls ISO 27001 requires on one platform, map them to the standard automatically, and let the certificate follow from real security. No security team required.<\/p>\n <p style=\"margin-top:16px;\"><a href=\"https:\/\/osto.one\/book-demo\/\" style=\"color:#ffffff;font-weight:700;text-decoration:underline;\" target=\"_blank\" rel=\"noopener\"><span style=\"color:#ffffff;\">Book a Demo →<\/span><\/a><\/p>\n <\/div>\n\n <h2 class=\"sec\" id=\"faq\">Frequently asked questions<\/h2>\n <details><summary>What is ISO 27001 in simple terms?<\/summary><p>ISO 27001 is the international standard for information security. It certifies that your company runs a proper system, an Information Security Management System (ISMS), for identifying and managing security risks, and that the controls protecting your data actually operate.<\/p><\/details>\n <details><summary>Is ISO 27001 mandatory?<\/summary><p>Not legally. No law requires it. But it becomes a practical requirement when buyers, especially in Europe, APAC, the Middle East, or the public sector, make it a condition of doing business, or when you want a globally recognised, publicly displayable security credential.<\/p><\/details>\n <details><summary>How many controls are in ISO 27001?<\/summary><p>The 2022 version lists 93 controls in Annex A, grouped into four themes: Organizational (37), People (8), Physical (14), and Technological (34). They are a menu, not a mandatory checklist; your risk assessment decides which apply.<\/p><\/details>\n <details><summary>What is the difference between ISO 27001 and an ISMS?<\/summary><p>ISO 27001 is the standard; the ISMS is the thing it certifies. The Information Security Management System is your actual set of policies, processes, and controls for managing security risk. ISO 27001 defines what a sound ISMS must contain and how it is audited.<\/p><\/details>\n <details><summary>Which version of ISO 27001 is current?<\/summary><p>ISO\/IEC 27001:2022. Certifications against the older 2013 version expired after 31 October 2025, so all new work should target the 2022 revision, which organises 93 Annex A controls into four themes.<\/p><\/details>\n<\/div>\n<\/body>\n<\/html>\n","protected":false},"excerpt":{"rendered":"<p>What Is ISO 27001? The Complete Guide for Startups | Osto What is ISO 27001? The world’s most recognised security\u2026<\/p>\n","protected":false},"author":8,"featured_media":740,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[286,283,284,285],"class_list":["post-739","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-do-startups-need-iso-27001","tag-iso-27001","tag-iso-27001-for-startups","tag-iso-27001-small-company"],"_links":{"self":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/739","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/comments?post=739"}],"version-history":[{"count":1,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/739\/revisions"}],"predecessor-version":[{"id":741,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/739\/revisions\/741"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media\/740"}],"wp:attachment":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media?parent=739"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/categories?post=739"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/tags?post=739"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}