ISO 27001

Stage 1 reviews your documentation, Stage 2 tests whether the ISMS operates. Here is what auditors check at each.

The SoA is the document auditors scrutinise hardest. Here is what it must contain, how to justify exclusions, and the mistakes that fail Stage 1.

The honest answer depends on where your buyers are. Here is how to choose, and how to avoid paying twice when you eventually need both.

ISO 27001 certifies your information security management system. Here is what an ISMS is, how certification works, and when it beats SOC 2.