ISO 27001 for UK SaaS, Without the Consultancy Drag

ISO 27001 is the international standard for information security management systems. Enterprise buyers use it as independent proof that you manage security risk in a structured, audited way. It often removes the need for long security questionnaires.

With NodeForce, you're audit-ready in 4–6 weeks. The certification audit with your certification body (Stage 1 and Stage 2) is scheduled afterwards, and its lead time depends on the body you choose.

Our fixed fee is £7,199 for under 50 staff, or £9,599 for larger teams (50–100 employees). Typical total including the certification audit: roughly £10,000–£15,000 (under 50 staff) or roughly £12,500–£17,500 (larger teams). More people means more access reviews and policy rollout, which is why the larger tier costs more. Not included: Certification audit fee (paid to your UKAS-accredited body), Legal advice, Ongoing monthly support. If your auditor raises gaps within our scope, we fix them at no extra cost. We don't promise a certification or an audit result. Independent bodies decide that.

No. Certification must be issued by an independent, accredited certification body. We prepare your ISMS, evidence and team for that audit.

No consultant can, because the outcome is decided by the auditor. We run a full internal audit first, so you go into the external audit with known gaps already closed. If your auditor raises gaps within our scope, we fix them at no extra cost. We don't promise a certification or an audit result. Independent bodies decide that.

ISO 27001:2022 is the current version of the standard. It updated the Annex A controls from 114 to 93, grouped into four themes. All our work is aligned to the 2022 version.

Stage 1 is a documentation review of your ISMS. Stage 2 is a full assessment of whether your controls are implemented and working. We prepare you for both.

No, but compliance automation saves a lot of manual evidence collection. We can set up whichever platform you prefer, or work without one.

Three years, with annual surveillance audits in between.

ISO 27001 is a certification against an international standard and is widely recognised in the UK and Europe. SOC 2 is an attestation report that US buyers commonly ask for. The two share many controls, so doing one makes the other faster.

Not legally, but if your customers are enterprises, regulated firms or public bodies, it's often a procurement requirement. We scale the ISMS to your team size so it isn't over-engineered.

A named point of contact, admin access to your cloud and identity systems, and some engineering time during the sprint. We agree the exact commitment with you at the start.