Inside the ISG BuildingGuided Tour Tour

ISO 27001 · ISO 27701 · Certification readiness · Client Vision by 3HUE

ISO 27001, certifiable.
Privacy included.

An ISMS a certification body can audit, not a binder nobody opens: scope and Statement of Applicability decided, the 93 Annex A controls mapped to evidence that updates with every scan, internal audit done, and the ISO 27701 privacy extension built on the same system when you process personal data for customers. Run it yourself on the Assurance Multi packs, or let 3HUE run it with you.

Book an ISO readiness call Check your ISMS readiness
Trusted in regulated industriesA transit technology companyA large North American bankA marine services company
3 regulated industries10 business-day Snapshot100% executive-led delivery

Outcomes at a glance

What certification-ready looks like.

Four things an auditor asks for on day one, all kept current in the workspace rather than rebuilt before each audit.

01

Scope and Statement of Applicability

The ISMS boundary, the interested parties, the risk criteria and every Annex A control marked applicable or justified out, signed off by leadership.

02

Risk treatment with evidence

A risk register and treatment plan where each control points at the evidence that proves it runs: scan results, policies, tickets, reviews.

03

Internal audit and management review

Clauses 9 and 10 done and documented: the internal audit, the findings, the corrective actions and the management review minutes.

04

Privacy extension (ISO 27701)

PII controller and processor controls layered on the same ISMS, so GDPR, CCPA and customer DPAs are answered from one system.

Who it is for

Three reasons ISO lands on a desk.

Selling internationally

A European or APAC customer, or a global parent, asks for the certificate rather than a SOC 2 report. ISO 27001 is the common language outside North America.

Already SOC 2

The controls overlap by more than half. The work is the management system around them: scope, risk method, internal audit and the Statement of Applicability.

Processing personal data for others

Processors and controllers under GDPR or state privacy law add ISO 27701 to show privacy is governed, not just promised in a DPA.

What you get

Two standards, one management system.

ISO 27001 builds the ISMS. ISO 27701 extends it for personal data. Both are governance packs in Client Vision, so the controls, the evidence and the audit trail live where the scans do.

ISO 27001:2022

The information security management system

  • Clauses 4 to 10: context, leadership, planning, support, operation, performance evaluation and improvement, each with the documents and records the auditor samples.
  • Annex A, 93 controls: organizational, people, physical and technological controls cross-walked to your cloud findings and policies, with the eleven 2022 additions (threat intelligence, cloud services, data masking, secure coding and more) called out.
  • Risk method and register: a repeatable assessment, treatment decisions recorded, residual risk accepted by name.
  • Statement of Applicability: generated from the control baseline and kept current as decisions change.
  • Internal audit program: the audit, the nonconformities and the corrective actions, scheduled before Stage 1.
  • Certification support: certification body selection, Stage 1 and Stage 2 preparation, and surveillance audits in years two and three.
ISO 27701

The privacy information management extension

  • Privacy context: PII roles (controller, processor, or both), applicable privacy law and the PII you hold, added to the ISMS scope.
  • Controller controls: purpose, lawful basis, consent and notice, data subject rights, retention and disposal, and transfer rules.
  • Processor controls: customer instructions, sub-processor management, breach notification timing and the records a customer DPA demands.
  • Privacy risk assessment: privacy impact added to the same risk register, with DPIAs where processing is high-risk.
  • Trust center answers: the privacy posture published to customers from the same evidence, never from a separate questionnaire.
  • One audit: the privacy extension is assessed alongside the ISMS, so there is one audit cycle to run and one certificate to maintain.

How delivery works

Three phases to a booked audit.

Most organizations reach Stage 1 in four to six months from a standing start, sooner with a SOC 2 program already running. Executive-led throughout; the same practitioner scopes the ISMS and sits beside you at the audit.

PHASE 1 · 2–4 WEEKS

Scope and gap

ISMS boundary, interested parties and risk criteria agreed. Every Annex A control assessed against what runs today. Output: the gap register, the draft Statement of Applicability and the plan.

PHASE 2 · 8–16 WEEKS

Build and operate

Policies, risk treatment and the missing controls implemented in order, with evidence attached as each one lands. Output: the ISMS running, records accumulating, the SoA final.

PHASE 3 · 3–5 WEEKS

Internal audit and certification

Internal audit, corrective actions and the management review completed, the certification body briefed and Stage 1 booked. Output: an audit-ready ISMS and a calendar through Stage 2.

Connects to

SOC 2

Controls cross-walked once; evidence collected for one framework counts for the other in the same workspace.

Connects to

Client Vision

The ISO 27001 and 27701 governance packs ship in Assurance Multi; the posture score and the SoA read from the same scan.

Connects to

Privacy law

GDPR, UK GDPR and US state privacy obligations mapped to the 27701 controls, so legal reviews the same register.

Connects to

The Managed lane

Under the vCISO seat, the ISP program keeps the ISMS operating between audits and runs the surveillance cycle.

Free tool · ISMS readiness check

Ten things Stage 1 asks for. How many could you show?

Check each item you could hand a certification auditor tomorrow. Your answers stay in this browser.

0of 10 in place

Book an ISO readiness call

We send your result and nothing else. Add a question and we reply within one business day.

Ways to work with 3HUE

See pricing for all three lanes →
01 · Client VisionRun it yourselfFree workspace to start. Assurance adds CloudSignals, RiskOps and a governance pack; Multi adds all six. Annual or monthly.Start free →
02 · SnapshotKnow where you standAI & Security Risk Posture Snapshot. Ten business days, your tenant onboarded, written output you keep.Book the Snapshot →
03 · Managed by 3HUEWe run it with youA named vCISO and scoped programs (RMP, CIRP, ISP, VCP, SEA), run in the Client Vision plan you hold. Priced to your program in the builder.Book a vCISO strategy call →

Customer story · Transportation & logistics technology

Nine companies certified. Zero non-conformities.

A transit technology portfolio that had reached SOC 2 Type II under a managed 3HUE program took the same control baseline through initial ISO 27001 certification audits across nine companies, with no non-conformities raised, then added ISO 27701 and certified nine companies and SaaS products for privacy on the same management system.

Read the storyAll customer stories
Transit technology · Managed program 0non-conformities across nine ISO 27001 initial audits

One Statement of Applicability per company, one internal audit cycle, one register the certification bodies worked from.

Questions

What buyers ask first.

We have SOC 2. How much of ISO 27001 is left?

Less than half of the control work, most of the management-system work. SOC 2 proves controls operate; ISO 27001 also wants the system that chooses them: a documented scope, a risk method, a Statement of Applicability, an internal audit and a management review. Those are the gap, and they are mostly decisions and records rather than new technology.

Do we need ISO 27701 as well?

Only if you are a controller or processor of personal data for customers who ask how privacy is governed. If the questions arrive as DPAs, privacy questionnaires or GDPR clauses, 27701 answers them once from the ISMS. If they do not, certify 27001 first and add the extension at a surveillance audit.

Can we do this self-serve?

Yes. The Assurance Multi plan includes the ISO 27001 and ISO 27701 governance packs: the control baseline, the policy set, the evidence mapping and the SoA. Teams with a security lead and time run it themselves; teams without one take the Managed lane, where a named vCISO and the ISP program run the system and sit the audit with you.

Who issues the certificate, and how long does it last?

An accredited certification body, after a Stage 1 document review and a Stage 2 implementation audit. The certificate runs three years with surveillance audits in years two and three, then recertification. 3HUE helps you choose the body and prepares both stages; we do not certify, which is what keeps the audit independent.

What does it cost?

Self-serve is the Assurance Multi plan. Managed is the vCISO seat plus the ISP program, and a fixed-scope readiness build is quoted from the gap register. Every number is on the Pricing page and the rate card; the certification body's fees are separate and quoted by the body.

Certified once. Current always.

Scope the ISMS on a fifteen-minute call, or start free in Client Vision and turn on the ISO packs when you are ready. We respond within one business day.

Book an ISO readiness callSend an inquiry