A working ISMS, ready for certification
We build the information security management system ISO 27001 asks for: the scope, the risk assessment, the Statement of Applicability, the policies, and the Annex A controls. Then we run your internal audit and management review and support you through Stage 1 and Stage 2.
$22,000 fixed, about 10 to 14 weeks. $12,000 if we built your SOC 2 program. Certification body fees are separate.
Everything the certification body will check
ISMS scope and context
What is in scope, the interested parties, and the objectives, in writing.
Risk assessment
A documented method, the risk register, and a treatment plan.
Statement of Applicability
Every Annex A control, whether it applies, and how you meet it.
Policies and procedures
Written for how your team works, approved by you.
Annex A controls
Access, logging, backups, supplier security, secure development, and more, configured in your tools.
Internal audit
An internal audit against the standard, with findings fixed before the real audit.
Management review
The review the standard requires, run with your leadership and written up.
Certification body selection
Accredited bodies with quotes, and help choosing.
Stage 1 and Stage 2
Support through both audits and any findings.
Pricing
SOC 2 and ISO 27001 share most of their controls, so doing SOC 2 with us first cuts the ISO 27001 price.
ISO 27001 Compliance Prep
Starting from scratch or from SOC 2 elsewhere
- Scope, risk assessment, and SoA
- Policies and Annex A controls
- Internal audit and management review
- Stage 1 and 2 support
ISO 27001 after SOC 2 with us
Your SOC 2 program was built by us
- The ISMS layer on top of the controls you already run
- Internal audit and management review
- Stage 1 and 2 support
Scope: one organization of up to about 50 people. Larger scopes are quoted in writing.
Common questions
Are you the auditor?
No. SOC 2 reports are issued by licensed CPA firms, and ISO 27001 certificates by accredited certification bodies. We prepare you, help you choose an auditor, and support you through the audit. Auditor fees are separate and paid to the auditor.
How is ISO 27001 different from SOC 2?
SOC 2 is a report on your controls, common with US buyers. ISO 27001 is a certificate for a management system, common in Europe and with global enterprises. The controls overlap heavily, which is why doing both with one team saves time and money.
How long is the certificate good for?
Three years, with a surveillance audit each year. We can own those as part of a Fractional CTO plan.
Is Broke Hold SOC 2 or ISO 27001 certified?
Not yet. We run a SOC 2 and ISO 27001 program for our own products, the controls are in place, and we are collecting the evidence for our audits. We will post the results on our Security page when the audits are complete. We never claim a certification we do not hold, and we will not let you either.
Get a written ISO 27001 proposal
Send your website, team size, where you operate, and any customer deadline. You will get a written proposal within one business day. No calls needed.
- Written reply within one business daySpecific to your store, with a price.
- No calls neededScope, price, and kickoff all happen in writing.
- NDA on requestYour data and numbers stay private.