Fast-track ISO 27001 certification - and stop losing global deals.
Operators prepare and review ISMS materials and request the evidence for your agreed scope. Your organization owns business decisions and policy approval. Strategic program leadership and certification coordination require separate scope.
- Risk records and prepared policy materials, with customer decisions clearly assigned
- Statement of Applicability written from your risks, not copied from a sample
- Operator-led evidence requests and follow-up for scoped Annex A controls
A management system, not a binder.
ISO 27001 certifies that you operate an information security management system - so auditors look for evidence it ran, not evidence it exists. That distinction is where most programs fail.
See what your ISMS still needs
We request and review evidence of your risk assessments, corrective actions, and management reviews. Your team owns implementation and decisions; internal audit engagements and program leadership are separately scoped.
A Statement of Applicability you can defend
Every Annex A control is included or excluded against a documented risk and justification. Exclusions are the first thing an auditor probes, so we write them to survive that.
Maps onto SOC 2 without doubling the work
The controls overlap. We map reusable evidence to both programs and review the remaining gaps. Each additional framework is $3,000/year on top of the base plan.
Prepare evidence for certification review
We provide existing scoped evidence and correct our deliverables. The certification body determines the outcome. Certification coordination, internal audit engagements, and consulting meetings are separately scoped.
What ISO 27001 actually requires.
The certifiable requirements are in clauses 4 through 10. Annex A is the control catalogue you select from - 93 controls in four themes under the 2022 revision.
Context & scope
clause 4Interested parties, ISMS boundaries, and what is deliberately outside them. Scope decides the cost of everything downstream.
Leadership & policy
clause 5Top-management commitment, the information security policy, and assigned roles with real authority.
Risk assessment & treatment
clause 6 - SoAA repeatable risk method, a populated risk register, treatment decisions, and the Statement of Applicability that falls out of them.
Annex A controls
93 controlsOrganizational (37), People (8), Physical (14), and Technological (34). You apply the ones your risk treatment calls for and justify what you exclude.
Performance & internal audit
clause 9Monitoring, measurement, a genuine internal audit programme, and management review with recorded outputs.
Certification cycle
3-year cycleStage 1 documentation review, Stage 2 certification audit, then annual surveillance audits and full recertification in year three.
We scope to ISO/IEC 27001:2022 and the restructured Annex A. ISO 27017 and ISO 27018 extensions can ride on the same ISMS when cloud or PII-processor commitments call for them.
From scoping call to certificate.
Two phases are gated - ISMS scoping and the certification audit. Getting scope wrong is the single most expensive mistake in an ISO programme, so we hold that line hard.
Scope the ISMS
We fix the boundary - which entities, systems, locations, and people are in. Too wide and you evidence things forever; too narrow and your customers reject the certificate.
Risk assessment and SoA
We run the risk assessment, agree treatment, and write the Statement of Applicability from the results - including the justification behind every excluded Annex A control.
Operate and evidence
Your team implements and operates controls. We request and review the resulting evidence in the platform. Internal audits, implementation work, and consulting meetings require separate scope.
Stage 1, Stage 2, certificate
The body reviews documentation and operation. Operators track findings and correct Sythe deliverables. Hands-on fixes and certification coordination require separate scope; the body decides whether to certify.
ISO 27001: $20,000 a year total.
Startup base plus one framework.
$20,000/year including one framework. Each additional framework is $3,000/year. For companies under $5M revenue or 50 staff. The SOC 2 Type I, Security-only bundle includes the independent auditor fee. Type II audits, additional audit criteria, and other certification fees are quoted separately. Enterprise pricing is custom. The SOC 2 Type I, Security-only bundle is $20,000/year total, including the $3,000 independent auditor fee. Sythe coordinates preparation and the audit through the platform. The independent auditor performs the audit and issues the report. Type II audits and additional criteria are quoted separately.
For companies under $5M revenue or 50 staff. Base security services plus ISO 27001 support.
- 2 scoped penetration tests per year
- One scoped retest per penetration test
- 2 risk assessments per year
- 12 host-limited vulnerability scan runs per year
- Third-party risk document uploads and Q&A
- Compliance & GRC support for one included framework
- The Sythe Labs platform, run by us
Over $5M revenue or 50 staff. Negotiated to your scale and obligations.
- Enterprise scope agreed separately
- Additional assets and testing quoted to scope
- Service levels defined in your agreement
Sythe operators request and review evidence, prepare materials, and follow up in the platform. You supply business information and approve your organization's policies. Routine clarification, corrections, and supported platform integration repairs are included.
Ongoing security monitoring and incident response are additional services. We recommend fixes; hands-on changes to your systems require a separate implementation scope.
Strategic compliance advice and expressly delegated decisions use a vCISO retainer at $250/hour, with hours approved in advance. Kickoff and pentest scoping and closure meetings are included. Other routine delivery happens in the platform; recurring consulting meetings are extra.
The people who already handed it over.
"Jarred, Andrew, and their team are trusted partners - extensive penetration testing, code analysis, and security reviews that protect our users. We share a vision of prioritizing customer security above all else."
"Sythe Labs was great to work with. Extremely knowledgeable, responsive, and trustworthy. I'd recommend them to anyone looking for security or penetration testing."
"The strategic security recommendations from Sythe Labs have been invaluable. Their expertise helped us put real protection in place while keeping us moving fast."
Real engagements. Real outcomes.
The same programme, run for teams who had no security function when they started.
ISO 27001, honestly answered.
The questions that come up on every ISO 27001 scoping call, answered before you have to ask them.
- How long does ISO 27001 certification take?
- Three to six months is realistic for a company with reasonable engineering hygiene. The binding constraint is operating evidence - certification bodies want to see the ISMS having actually run, not just documented.
- Do you issue the certificate?
- No. An accredited certification body issues the certificate. We prepare and review scoped materials and track findings. Your organization owns implementation and management decisions unless specific work is separately agreed.
- Is the certification body's fee included?
- No. The $20,000/year plan includes one framework and routine operator-led evidence work. Additional frameworks cost $3,000/year each. The certification body bills separately; coordination and meetings also require separate scope.
- We already have SOC 2. How much extra is ISO 27001?
- An additional $3,000/year on top of the existing base and framework fees. The control sets overlap and some evidence can be reused. What ISO adds is the management-system machinery - risk method, internal audit, management review - which SOC 2 does not require in the same form.
- What changed in the 2022 revision?
- Annex A was restructured from 114 controls in 14 domains to 93 in four themes, with 11 new controls covering things like threat intelligence, cloud services, and secure coding. We scope to the current revision.
Certified, and still certified next year.
A 30-minute call. We will tell you what your ISMS scope should be, what Stage 2 will actually probe, and what the path to a certificate costs - whether or not you hire us.