Three years of ISO 27001: what it cost and what we learned
We finished our first full ISO 27001 cycle. What it cost a small team, what it changed, and what we would do differently.
We just passed eHour’s second ISO 27001 surveillance audit and thus completed the first, full cycle!
We got certified in 2024, had our first surveillance audit in 2025 and have now passed the second surveillance. Next year we’re up for recertification.
That makes this a good time to look back. Did certification help? What did it cost us? And would we do it again?
ISO 27001: Why we did it
A time tracking system holds interesting information: project data, some staff personal data, records who worked on what, etc.
For larger customers signing up with eHour, part of the procurement process is always the security questionnaire which can be 30 questions or 150 questions; ranging from whether there are cameras at the data center’s entrance to how we do secure software development. But the first question is always: is your org SOC2 or ISO 27001:2022 certified?
Answering no always put us on the back foot and meant more work explaining how we handled security. We already had many measures in place, but proving that to each prospective customer took time.
How we got started
In 2023 we decided to get ISO 27001 certified. When investigating which tools could help us, we ran into the usual suspects: Vanta, Drata, Secureframe, etc. After having demos with almost all of them we eventually picked Sprinto, purely on cost.
Vanta quoted us around $20k a year. Sprinto offered us a better deal and promised feature parity. Sprinto also had a package that included an audit, but we chose our own auditor.
During the stage 1 audit, we found gaps in Sprinto that we had to cover outside the tool. There was no Statement of Applicability (SoA) and the risk register couldn’t link risks to controls. Its export also left out the treatment our auditor required. Eventually we maintained a separate risk register and the SoA in Google Drive and kept them aligned with Sprinto.
In the last 3 years, our Google Drive setup grew to include the competency matrix, access registers, legal register, vendor register, compliance schedule… We were paying for a platform while also maintaining a substantial part of the system ourselves.
ISO 27001 requires organizations to perform their own internal audit regularly. The internal auditor should be able to assess the ISMS objectively and independently. With a team of our size, having someone in the organization who isn’t involved with ISO is nearly impossible so we hired an external person to do this. So yes, we have an external internal auditor and an external external auditor 🙂
Was it useful?
Yes! The security part of procurement became much easier. The first time we could tick the “yes, we’re ISO 27001 certified” checkbox felt pretty good! We still get security questionnaires, but I can’t remember any serious follow-up questions since.
It also improved our processes. We already had a lot in place but some of it wasn’t properly documented and there were a few gaps. For example, we added a full competency matrix spelling out what we expect our developers to know and a clear procedure for communicating with users if something serious happens. Luckily we haven’t needed that last one, but it’s good to have it ready.
What did it cost
Time and money. The figures below cover the tool, auditors, and an estimate of our own time over three years. They exclude the initial setup effort and penetration tests by an external agency.
Money first. Over the three years, we paid:
| Internal auditor | €3,000 |
|---|---|
| SprintoUS$10,500 | ≈ €9,300 |
| Certification audits£3,105 for Stage 1 and Stage 2 together plus two surveillance audits at £2,070 each. Total £7,245. | ≈ €8,500 |
| Total | €20,800 |
Time-wise: the internal audits take a day per year and the external audits take two. Preparing for them takes another five days in total. There are always a few things that need to be done just before an audit.
Add the extra work around policies, training contractors, etc. and I would estimate another 14 days a year. In total, roughly 22 person-days per year.
That gives us about €20,800 paid out plus circa 66 person-days over three years.
I’m leaving out the initial setup, as that took a lot more time, and also the costs for things like external penetration tests (required for the surveillance audits), since they have to be done anyway.
What should we have done differently
Perhaps we should have started with Google Drive instead of a tool. For a team with fewer than 10 people, I’m not sure a whole compliance platform is needed to keep track of the policies, registers and evidence as we ended up keeping quite a bit on Google Drive anyway.
That said, Sprinto was handy at the start. It gave us the initial policies and structure, which helped us figure out what needed to be in place. Starting with a blank folder would have meant more work upfront.
So if we were starting again, I’d first look at how far we could get with Google Drive and then decide whether a tool would make things easier once we know what we actually need from it.
Next, SOC2?
