Skip to content
New · AI governance: inventory your AI systems, check the controls, certify ISO 42001.New · AI governance for ISO 42001.See it
ISO 27001

ISO 27001 on evidence that proves itself

Build your ISMS on continuous checks and tamper-evident evidence, then run Stage 1 and Stage 2 in the same place the evidence lives.

Book a demo

What is ISO 27001?

ISO/IEC 27001 is the international standard for an information security management system, an ISMS: the policies, processes, people and controls an organization uses to manage information security risk, and the evidence that the system is maintained. Certification is issued by an accredited certification body after a two-stage audit. Stage 1 reviews the documentation and readiness of the ISMS; Stage 2 tests that the controls operate as described. The certificate is valid for three years with surveillance audits in between. The 2022 edition groups 93 controls into organizational, people, physical and technological themes, chosen through a documented risk assessment and recorded in a Statement of Applicability. Buyers across Europe, the UK and Asia-Pacific recognize ISO 27001 as the baseline proof that security is managed deliberately rather than assumed.

In one paragraph

ISO/IEC 27001 is the international standard for an Information Security Management System (ISMS). It's risk-based: you scope the ISMS, assess risks, treat them with controls, and get certified by an accredited certification body through Stage 1 and Stage 2 audits.

Who it's for

Companies selling globally, where ISO 27001 certification is the common security baseline buyers recognize.

With Viglyn

How Viglyn runs ISO 27001

  • Automated checks collect evidence continuously from your cloud, identity, device, code, and HR systems
  • The risk module covers the ISMS core: a library to start from, 5x5 scoring with inherent and residual values, four treatment paths with approvals, and risks linked to controls
  • Stage 1 and Stage 2 run inside Viglyn with structured evidence requests and exportable workpapers
  • One set of evidence maps across frameworks, so ISO 27001 work counts toward SOC 2 too
Straight answers

The ISO 27001 questions that decide it

How long does ISO 27001 certification take?

Three to six months is typical for a company that already runs basic controls, longer when the ISMS has to be built from scratch. Scoping the ISMS, the risk assessment and the Statement of Applicability are the slow parts; Viglyn's risk module and included practitioners do them with you rather than hand you templates.

How much does ISO 27001 cost?

With Viglyn, the platform, the implementation of your ISMS and audit support cost from $2,699 a year for a team of up to 25, and ISO 27001 counts as one of the two frameworks every plan includes. The certification body's fee is separate and paid by you directly; we take no commission.

Can we do ISO 27001 and SOC 2 together?

Yes, and most teams do. The two share most of their underlying control work, so in Viglyn one evidence base maps across both. Every plan includes two frameworks, which for most companies selling into both North America and Europe is exactly this pairing.

Compared with

ISO 27001 against the standards it is weighed with

FAQ

More ISO 27001 questions

Is ISO 27001 a certification?
Yes. An accredited certification body audits your ISMS in two stages and issues the certificate. Viglyn is where you prepare and where the audit workflow runs; the certification decision is the body's alone.
How does ISO 27001 relate to SOC 2?
They share a large amount of underlying control work. In Viglyn one set of evidence maps across frameworks, so evidence collected for ISO 27001 also counts toward SOC 2.
Does Viglyn handle the risk assessment?
The risk management module gives you a library to start from, 5x5 scoring with customizable labels, inherent and residual scores, and four treatment paths that each require an approval. Risks link to the controls that treat them.

See ISO 27001 run on your stack

A 30-minute walkthrough with your systems and your framework. No commitment.