How to get ISO 27001 certification: a practical SaaS guide
From scope and risk assessment to Stage 1 and Stage 2: what your SaaS needs to prepare, who issues the certificate and what changes the cost.
The short answer
To get ISO 27001 certified, define the scope, build and operate an information security management system, complete internal audit and management review, then undergo an independent certification audit. Amprovia prepares the system; the certification body decides whether to certify it.
Start with the product your buyer is assessing
Define the legal entity, activities, locations and information included in the ISMS. For a SaaS, map product development, hosting, support and relevant suppliers. A cloud provider’s certificate does not certify your own organisation.
Build the system around risks, not a template folder
Assess information-security risks, record treatment decisions and document which controls apply in the Statement of Applicability. Put controls into everyday work and retain evidence: access approvals, supplier reviews, incident handling and restoration tests, where applicable.
What happens at Stage 1 and Stage 2?
Stage 1 assesses the documented system and readiness for Stage 2. Stage 2 examines implementation and effectiveness through interviews and sampled evidence. Complete your internal audit and management review beforehand, and resolve findings through the certification body’s process.
How much does ISO 27001 certification cost?
There is no single price. Scope, headcount, complexity, existing controls and the certification body’s audit programme affect the quote. Separate preparation fees, independent audit fees and ongoing maintenance. Ask what is included before comparing offers; we do not publish a universal price or guaranteed completion time.
Italy, UK and USA: check the buyer’s requirement
ISO 27001 is an international standard, not a country-specific licence. Buyers may specify accreditation, certificate scope or additional evidence. Certification does not automatically establish GDPR compliance, replace a US customer’s SOC 2 request or satisfy every UK tender. Check the contract before choosing your certification path.
What Amprovia prepares — and what your team owns
We define gaps, draft documents, organise evidence and prepare audit readiness with your team. Your organisation owns operational controls, decisions and approvals. Start with the buyer’s requirement, your product scope and any existing security records in a discovery call.
KPIs to track, not promised results
Measure the value of certification
- Internal hours
- Track staff time spent on documentation, evidence and audit preparation before and after support.
- Total cost
- Compare consulting, audit fees and internal staff time on the same scope, including maintenance.
- Buyer confidence
- Track vendor assessments passed, tender eligibility and time spent answering customer checks. Certification alone does not guarantee more sales.
Reviewed by Amprovia editorial team
Official sources
We handle the path to certification.
Gap analysis, documents, implementation, evidence and audit preparation — managed with your team from start to certificate.
Book a free gap analysis