What the standard actually asks of you, where to start, and what "done enough for the audit" looks like — without a five-figure platform first.
A customer or investor just asked for ISO 27001, and the quotes you got back made your eyes water: consultants, platforms, "readiness assessments" that cost more than a year of salaries for one engineer. For a five-person SaaS company, the default path — Vanta or Drata plus a consultant plus a certification body — can easily run into five figures before anyone audits you.
Here's the honest alternative: ISO 27001 is one of the few frameworks a small team can genuinely prepare for itself. Not easily, and not quickly — but the work is mostly writing down what you already do, then fixing the gaps. This article walks through that path: what the standard actually asks of you, where to start, and what "done enough for the audit" looks like.
ISO 27001:2022 has two halves:
Certification means an accredited body (UKAS-accredited in the UK, or your national equivalent) audits that your system is real and operating — not aspirational. Two-stage audit, then annual surveillance. Nothing you download certifies you; the audit does. Prep is what you control.
Of the 93 controls, a small cloud-hosted SaaS team typically has meaningful work in maybe 25–35. A practical starting set:
The physical controls (A.7.x) are mostly covered by your cloud provider's certifications — but you still have to address them in your SoA honestly, by relying on the provider's certificate, not silently skip them.
Self-assess before you spend anything. The one-week method:
You now know your real workload. Most small teams find they've already done 40–60% of it — it just was never written down.
Write the policies that map to your biggest gaps first. Keep them short and true. A policy describing something you don't do is worse than none: auditors interview your engineers, and your engineers will describe what actually happens, not what the PDF says. Ten short policies — access control, change management, incident response, backup, cryptography, secure development, logging, HR security, supplier security, remote working — cover the core for most teams. Review them at least annually, and date the review.
The documents are the easy half. Certification bodies sample operating evidence: dated access reviews, real incident tickets (even minor ones, logged and closed), management review minutes, restore tests. That's generated by a monthly routine — roughly an hour a month of review plus a quarterly access review — run for the months before your audit. Start the cadence before you start collecting anything else, because that evidence takes time to accumulate and can't be backdated.
This is all doable yourself — we know, because we built a toolkit around exactly this method for 2–25 person SaaS teams. The ISO 27001 DIY Edition from Hardened Stack bundles the 93-control matrix with small-team guidance, the gap-analysis walkthrough, scope statement, SoA, risk register, and ten policy templates, with no platform subscription attached. It's prep tooling, not certification — the audit still decides — but if you'd rather not build the scaffolding from a blank folder, it's there.
Get the ISO 27001 DIY Edition →
Affiliation note: this article is from Hardened Stack, the team that put the toolkit together.
Start smaller
If you are starting with SOC 2 instead, take the free starter pack. It includes the first-week checklist, access review checklist, and risk register CSV.