ISO 27001 · ISO 27701 · Certification readiness · Client Vision by 3HUE
ISO 27001, certifiable.
Privacy included.
An ISMS a certification body can audit, not a binder nobody opens: scope and Statement of Applicability decided, the 93 Annex A controls mapped to evidence that updates with every scan, internal audit done, and the ISO 27701 privacy extension built on the same system when you process personal data for customers. Run it yourself on the Assurance Multi packs, or let 3HUE run it with you.
Outcomes at a glance
What certification-ready looks like.
Four things an auditor asks for on day one, all kept current in the workspace rather than rebuilt before each audit.
Scope and Statement of Applicability
The ISMS boundary, the interested parties, the risk criteria and every Annex A control marked applicable or justified out, signed off by leadership.
Risk treatment with evidence
A risk register and treatment plan where each control points at the evidence that proves it runs: scan results, policies, tickets, reviews.
Internal audit and management review
Clauses 9 and 10 done and documented: the internal audit, the findings, the corrective actions and the management review minutes.
Privacy extension (ISO 27701)
PII controller and processor controls layered on the same ISMS, so GDPR, CCPA and customer DPAs are answered from one system.
Who it is for
Three reasons ISO lands on a desk.
A European or APAC customer, or a global parent, asks for the certificate rather than a SOC 2 report. ISO 27001 is the common language outside North America.
The controls overlap by more than half. The work is the management system around them: scope, risk method, internal audit and the Statement of Applicability.
Processors and controllers under GDPR or state privacy law add ISO 27701 to show privacy is governed, not just promised in a DPA.
What you get
Two standards, one management system.
ISO 27001 builds the ISMS. ISO 27701 extends it for personal data. Both are governance packs in Client Vision, so the controls, the evidence and the audit trail live where the scans do.
The information security management system
- Clauses 4 to 10: context, leadership, planning, support, operation, performance evaluation and improvement, each with the documents and records the auditor samples.
- Annex A, 93 controls: organizational, people, physical and technological controls cross-walked to your cloud findings and policies, with the eleven 2022 additions (threat intelligence, cloud services, data masking, secure coding and more) called out.
- Risk method and register: a repeatable assessment, treatment decisions recorded, residual risk accepted by name.
- Statement of Applicability: generated from the control baseline and kept current as decisions change.
- Internal audit program: the audit, the nonconformities and the corrective actions, scheduled before Stage 1.
- Certification support: certification body selection, Stage 1 and Stage 2 preparation, and surveillance audits in years two and three.
The privacy information management extension
- Privacy context: PII roles (controller, processor, or both), applicable privacy law and the PII you hold, added to the ISMS scope.
- Controller controls: purpose, lawful basis, consent and notice, data subject rights, retention and disposal, and transfer rules.
- Processor controls: customer instructions, sub-processor management, breach notification timing and the records a customer DPA demands.
- Privacy risk assessment: privacy impact added to the same risk register, with DPIAs where processing is high-risk.
- Trust center answers: the privacy posture published to customers from the same evidence, never from a separate questionnaire.
- One audit: the privacy extension is assessed alongside the ISMS, so there is one audit cycle to run and one certificate to maintain.
How delivery works
Three phases to a booked audit.
Most organizations reach Stage 1 in four to six months from a standing start, sooner with a SOC 2 program already running. Executive-led throughout; the same practitioner scopes the ISMS and sits beside you at the audit.
Scope and gap
ISMS boundary, interested parties and risk criteria agreed. Every Annex A control assessed against what runs today. Output: the gap register, the draft Statement of Applicability and the plan.
Build and operate
Policies, risk treatment and the missing controls implemented in order, with evidence attached as each one lands. Output: the ISMS running, records accumulating, the SoA final.
Internal audit and certification
Internal audit, corrective actions and the management review completed, the certification body briefed and Stage 1 booked. Output: an audit-ready ISMS and a calendar through Stage 2.
SOC 2
Controls cross-walked once; evidence collected for one framework counts for the other in the same workspace.
Client Vision
The ISO 27001 and 27701 governance packs ship in Assurance Multi; the posture score and the SoA read from the same scan.
Privacy law
GDPR, UK GDPR and US state privacy obligations mapped to the 27701 controls, so legal reviews the same register.
The Managed lane
Under the vCISO seat, the ISP program keeps the ISMS operating between audits and runs the surveillance cycle.
Free tool · ISMS readiness check
Ten things Stage 1 asks for. How many could you show?
Tick each item you could hand a certification auditor tomorrow. Your answers stay in this browser.
Ways to work with 3HUE
See pricing for all three lanes →Questions
What buyers ask first.
We have SOC 2. How much of ISO 27001 is left?
Less than half of the control work, most of the management-system work. SOC 2 proves controls operate; ISO 27001 also wants the system that chooses them: a documented scope, a risk method, a Statement of Applicability, an internal audit and a management review. Those are the gap, and they are mostly decisions and records rather than new technology.
Do we need ISO 27701 as well?
Only if you are a controller or processor of personal data for customers who ask how privacy is governed. If the questions arrive as DPAs, privacy questionnaires or GDPR clauses, 27701 answers them once from the ISMS. If they do not, certify 27001 first and add the extension at a surveillance audit.
Can we do this self-serve?
Yes. The Assurance Multi plan includes the ISO 27001 and ISO 27701 governance packs: the control baseline, the policy set, the evidence mapping and the SoA. Teams with a security lead and time run it themselves; teams without one take the Managed lane, where a named vCISO and the ISP program run the system and sit the audit with you.
Who issues the certificate, and how long does it last?
An accredited certification body, after a Stage 1 document review and a Stage 2 implementation audit. The certificate runs three years with surveillance audits in years two and three, then recertification. 3HUE helps you choose the body and prepares both stages; we do not certify, which is what keeps the audit independent.
What does it cost?
Self-serve is the Assurance Multi plan. Managed is the vCISO seat plus the ISP program, and a fixed-scope readiness build is quoted from the gap register. Every number is on the Pricing page and the rate card; the certification body's fees are separate and quoted by the body.
Certified once. Current always.
Scope the ISMS on a fifteen-minute call, or start free in Client Vision and turn on the ISO packs when you are ready. We respond within one business day.