Your ISO 27001 certification body will either understand your business or waste six months of your time. The difference shows up in week one: do they ask about your actual data flows and business processes, or do they hand you a 300-page generic checklist?
How do I choose an ISO 27001 certification body for my SaaS company?
Pick a certification body that’s ANAB-accredited under ISO/IEC 17021-1 for information security management systems, has recent audits in your industry (ask them to name a SaaS reference from the last twelve months), and prices surveillance plus recertification in writing before you sign. BSI tends to understand technology companies best. Avoid any body that promises certification in under twelve months, quotes a flat fee without discussing scope, or suggests skipping the Stage 1 audit — those are all red flags that the certificate won’t hold up to customer due diligence.
The rest of this post walks through each of those criteria — accreditation, scope definition, audit logistics, ongoing costs, and the questions to ask before signing.
The certification body decision matters more than the consultant
Most companies hire a consultant first, then let the consultant pick the certification body. This is backwards. Your certification body relationship lasts three years minimum. Your consultant relationship might last six months.
The certification body determines your audit schedule, your auditor quality, and your recertification timeline. A good body assigns auditors who understand your industry. A bad one rotates auditors every cycle and treats your SaaS company like a manufacturing plant.
Ask potential certification bodies: "Who was your last auditor for a company in our industry?" If they can't name one, keep looking.
BSI, SGS, and DNV are the three largest accredited bodies in the US market. BSI tends to understand technology companies better. SGS has stronger manufacturing expertise. DNV focuses on energy and maritime but has expanded into general business services.
Accreditation status is non-negotiable
Only use certification bodies accredited by ANAB (ANSI National Accreditation Board) in the US or equivalent national bodies internationally. Unaccredited certificates are worthless for customer requirements and M&A diligence.
Check the ANAB directory at anab.ansi.org before signing anything. Look for ISO/IEC 17021-1 accreditation specifically for information security management systems. Some bodies are accredited for quality management (ISO 9001) but not information security.
- Promises certification in under 12 months for companies over 50 employees - Cannot provide references from your industry vertical - Quotes a flat fee without understanding your scope - Suggests you can skip Stage 1 audit entirely - No ANAB accreditation visible on their website
Scope definition drives everything else
Your certification scope determines audit complexity, ongoing compliance burden, and customer acceptance. Get this wrong and you'll either over-certify (wasting money on systems that don't matter) or under-certify (failing customer due diligence).
Most SMBs should scope to their core business processes and customer-facing systems. Don't include HR systems unless you're in healthcare or financial services. Don't include development environments unless customers specifically require it.
The certification body should help you define scope during the initial consultation. If they accept whatever scope you propose without questions, they don't understand the standard or your business.
Stage 1 and Stage 2 audit logistics
ISO 27001 certification requires two formal audits. Stage 1 reviews your documentation and identifies gaps. Stage 2 tests implementation and interviews staff. Most bodies schedule these 4-6 weeks apart.
Stage 1 can be conducted remotely for most SMBs. Stage 2 requires on-site presence or detailed virtual access to systems and staff. Budget 2-3 days for Stage 1 and 3-5 days for Stage 2 depending on your scope.
Documentation Review (Stage 1)
Auditor reviews ISMS documentation, risk assessments, and policy framework. Identifies major gaps before Stage 2.
Implementation Testing (Stage 2)
Auditor interviews staff, tests controls, and validates that documented processes actually work in practice.
Certification Decision
Certification body reviews audit findings and issues certificate if no major nonconformities remain.
Ongoing surveillance and recertification costs
Certification isn't a one-time cost. Annual surveillance audits cost $5K-$15K depending on scope. Full recertification every three years runs $15K-$40K. Factor these into your total cost of ownership.
Some certification bodies offer multi-year pricing locks. Others adjust rates annually. Get the surveillance audit pricing in writing before signing the initial certification contract.
Total certification cost = Initial certification + (3 × annual surveillance) + recertification. For most SMBs, this runs $60K-$200K over three years.
What to ask before signing
Get specific answers to these questions before committing to a certification body:
- What's the total timeline from contract signing to certificate issuance? - Who will be our lead auditor and what's their background in our industry? - What's included in the quoted price vs. additional fees? - How do you handle scope changes during the certification process? - What's your policy on remote vs. on-site audit activities? - Can you provide three references from similar companies certified in the last 12 months?
The right certification body treats ISO 27001 as a business enabler, not a compliance checkbox. They understand that your goal is customer trust and deal velocity, not perfect documentation. Choose accordingly.
Frequently asked questions
Is ANAB accreditation required for ISO 27001 certification?
In the US, only ANAB-accredited certification bodies produce certificates that hold up to customer due diligence and M&A review. Look for ISO/IEC 17021-1 accreditation specifically for information security management systems — some bodies are accredited for ISO 9001 (quality management) but not information security. Check the ANAB directory at anab.ansi.org before signing anything. Unaccredited certificates are worthless for enterprise customer requirements.
How much does ISO 27001 certification cost for a SaaS company?
Total certification cost for SMBs runs $25K–$150K, with three-year total cost of ownership landing at $60K–$200K. That includes initial certification, three annual surveillance audits ($5K–$15K each), and recertification every three years ($15K–$40K). Get surveillance audit pricing in writing before signing the initial contract — some bodies offer multi-year pricing locks and some adjust rates annually.
How long does ISO 27001 certification take?
The average implementation timeline is 18 months from starting your ISMS to receiving the certificate. That includes documentation development, gap remediation, a Stage 1 audit (typically remote, 2–3 days), a Stage 2 audit (on-site or detailed virtual, 3–5 days), and certificate issuance. Any certification body promising certification in under 12 months for a company over 50 employees is a red flag.
What’s the difference between BSI, SGS, and DNV for ISO 27001 certification?
BSI, SGS, and DNV are the three largest ANAB-accredited certification bodies in the US. BSI tends to understand technology companies best. SGS has stronger manufacturing expertise. DNV started in energy and maritime and has expanded into general business services. For SaaS specifically, BSI is usually the closest cultural and technical fit.
Do I need both a Stage 1 and Stage 2 audit for ISO 27001?
Yes. Stage 1 reviews your ISMS documentation, risk assessments, and policy framework — it identifies gaps you must close before Stage 2. Stage 2 tests actual implementation: auditors interview staff, sample controls, and validate that documented processes work in practice. Most certification bodies schedule these 4–6 weeks apart. Any body suggesting you can skip Stage 1 is a red flag — the resulting certificate won’t hold up to customer or M&A due diligence.
Where this matters next
See how vCISO Lite handles ISO 27001 preparation — automated evidence collection and policy management to accelerate your certification timeline.
How to answer enterprise security questionnaires — ISO 27001 certification makes these conversations much easier.
ISO 27001 Certification: The Complete Guide for SMBs — the parent pillar for this cluster, covering the two-stage audit sequence, the four documents that make or break certification, and the three-year total cost of ownership.
GRC Software: 2026 Buyer's Guide — the six platforms for buyers whose ISO 27001 program is part of a broader multi-framework GRC picture.