ISO 27001 isn't a law. Nobody forces a startup to get it. What forces it is an enterprise buyer's security review that ends with "send us your certificate". When that happens, the engineers with repo, CI or production access are part of the system the auditor examines, and that includes the contractors and nearshore developers who aren't on your payroll.
Four of the five sources behind this page are compliance vendors or service providers with something to sell, so treat their cost and timeline figures as estimates, not quotes. We name each one where it's used.
What ISO 27001 certification is (and is not)
You certify an information security management system (ISMS), not a product and not your code. The ISMS is the set of policies, risk decisions and controls you run and can prove you run. Drata's guide describes Annex A as 93 controls in four domains. You don't implement all of them blindly. You decide which apply and record that decision in a Statement of Applicability (SoA).
The audit comes in two parts. Drata describes Stage 1 as a documentation and readiness review and Stage 2 as a check that you've implemented what you documented. After that you get annual surveillance audits, and recertification every three years. Vanta puts the same cycle as a new full audit after three years.
Vanta also says plainly that ISO 27001 is technically not legally required. Customers, not regulators, create the demand. If your obligations come from a regulator, the relevant page is more likely our piece on NIS2 supplier clauses for dev vendors, which covers the opposite direction: you vetting a supplier. This page is about you being audited.
Should a startup certify now, later, or do SOC 2 first?
Don't certify because a competitor's blog says everyone does. ComplyJet, itself a vendor, says ISO 27001 is not mandatory for every startup at every stage, and lists the cases where it's overkill: a prototype, no customer data, an SMB customer base, and no enterprise pipeline for the next 12-18 months.
The other side comes from Workstreet. It says SOC 2 is often sufficient for startups selling into North America, while ISO 27001 is more widely recognised outside North America and effectively mandatory for some enterprise and international deals. Note the wording: outside North America, not specifically the EU.
Here's a decision rule. It's our judgment, not a sourced finding.
- A named buyer asked for ISO 27001 and the deal is real: start now. The certificate has a buyer attached.
- Your pipeline is North American enterprise: check whether SOC 2 satisfies them first.
- Your pipeline is international enterprise: plan for ISO 27001, and start early enough to fit the timelines below before the first serious security review.
- No customer data, no enterprise pipeline, a prototype: wait. Write down who has access to what, and revisit.
That "who has access to what" list isn't wasted effort. You'll need it for scope anyway.
What is in scope
Scope is a written statement of which parts of the business, systems, locations and people the ISMS covers. Drata warns that imprecise scoping causes either overextension (you audit things you didn't need to) or gaps (you leave out something the auditor expects). For a startup the aim is the smallest honest scope: the product, the infrastructure it runs on, and the people who touch both.
Honest matters. An auditor will test whether the boundary matches how you actually work. Carving out the production database because it's awkward to cover fails that test.
Where contractors and outside engineers fall
Scope follows access, not employment status. Anyone who can touch the repository, the CI pipeline, production, or customer data sits inside the ISMS, whether they have an employment contract, an invoice or an agency badge. A contractor with deploy rights is a bigger exposure than a salaried marketer with none.
Drata's guide supports the principle: it says to record job duties, access permissions and security tasks for employees and contractors. For suppliers it says to document who the providers are, what data is exchanged and what security agreements exist, and points to ISO/IEC 27036 for supplier relationships.
Someone with a sandbox-only environment and no path to production or customer data can plausibly be documented out of scope. That's judgment, not a rule, and the auditor decides. For the evidence side, such as how to prove access and offboarding, see how to answer the contractor rows on a security questionnaire. We don't repeat it here.
Controls the auditor maps to them
DQS, a certification body, publishes a guide to the supplier controls A.5.19 to A.5.23. ComplyJet lists the people controls by title. The table below uses the 2022 numbering.
| Control | Title | Why it matters for outside engineers |
|---|---|---|
| A.5.19 | Information security in supplier relationships | A policy for suppliers that can reach your assets |
| A.5.20 | Addressing information security within supplier agreements | Security requirements agreed per supplier, by risk, and documented |
| A.5.21 | Managing information security in the information and communication technology (ICT) supply chain | Confirm the supplier's own subcontractors and pass requirements down |
| A.5.22 | Monitoring, review and change management of supplier services | Review supplier services regularly and reassess when something changes |
| A.6.1 | Screening | Background checks at hiring |
| A.6.5 | Responsibilities after termination | Offboarding when the engagement ends |
A caveat on the last two. ComplyJet lists these titles but never mentions contractors, and Drata only says contractors' duties and access should be recorded. Whether A.6.1 and A.6.5 reach a contractor is our reading, not a sourced rule. Expect to be asked.
Practically, A.5.20 means a written agreement per supplier, and A.5.22 means a recurring review, so a contractor onboarded in a hurry with a handshake deal is a finding waiting to happen. Our contractor onboarding and offboarding checklist covers the access and exit evidence these controls ask for.
What drives cost and timeline
Nobody publishes a neutral price list, so these are vendor estimates, and they don't agree.
ComplyJet estimates a total of USD 10,000-40,000. Its components: compliance software at USD 3,000-12,000 per year, consultants at USD 5,000-20,000 (optional), the certification auditor at USD 6,000-15,000, and 30-80 hours of internal time. Add those ranges and they don't cleanly produce its stated total, which tells you to treat them as a rough shape rather than a budget. Its timeline guidance varies too: ComplyJet's estimates run from 4 to 14 weeks depending on scenario, 6-12 weeks in its FAQ, and 6-12 months without guidance.
Workstreet gives USD 10,000-50,000 or more, with a typical timeline of 3-6 months.
The honest summary is five figures in both vendors' ranges (Workstreet's is open-ended), and weeks to months, depending on whose estimate you believe; Workstreet's typical figure is 3-6 months. Past that, the vendors' numbers stop being comparable. What moves your number is more useful to know:
Software against manual work is the first driver: tooling costs money and, in our judgment, saves internal hours, while doing it by hand costs the hours instead. A consultant is optional. The auditor's fee is a separate line, and a tighter scope gives the auditor less to examine. Internal hours are the hidden one, because someone has to write policies, run the risk assessment and chase evidence, and at a startup that's usually the CTO. Add-ons come on top. Readiness matters most: a company that already has access reviews, an offboarding routine and signed supplier agreements spends less than one that has to build them first.
Outside engineers affect several of these. Every person in scope needs access records, an agreement and an exit step, so a large contractor bench raises the internal-hours line.
What this means for your next enterprise deal
The decision is whether to certify now, later, or take SOC 2 first, and it should hang on one question: is there a named buyer who has asked for ISO 27001 in writing? If yes, you're looking at Workstreet's typical 3-6 months (ComplyJet's scenarios run shorter) and a five-figure budget on both vendors' estimates, so start before the contract is signed, not after. If the buyer is North American, ask whether SOC 2 closes the review. If nobody has asked, spend the effort on the access list instead.
Start there regardless: list every non-employee with repo, CI or production access. That is our judgment, not a sourced rule. The list drives scope, drives the supplier controls above, and decides whether any external engineer should keep production access until scope is set. Revoke what nobody can justify.
For the related contracting and compliance decisions, the hub on EU engineering hiring compliance: contracts, IP and GDPR collects the guides. If you're weighing where outside engineers are based, the legal requirements for hiring developers in Europe is the guide to read next.
FAQ
How much does ISO 27001 cost for a startup?
Vendors disagree. ComplyJet estimates USD 10,000-40,000 in total and Workstreet USD 10,000-50,000 or more. Software, an optional consultant, the auditor's fee and internal time are the main drivers. Both are sellers of compliance help, so use the figures to size a budget, not to quote one.
Is ISO 27001 hard to get?
It's more work than hard. ComplyJet estimates 30-80 internal hours, and Workstreet a typical 3-6 months. The usual trouble is scope: Drata says imprecise scoping leads to overextension or gaps. A small, honest scope and a clear owner make it manageable.
Do I need ISO 27001 or SOC 2?
It depends on who buys. Workstreet says SOC 2 is often sufficient when selling into North America, while ISO 27001 is more widely recognised elsewhere and sometimes effectively mandatory for enterprise and international deals. Ask your largest prospect which they accept before you pay for either.
Are contractors in scope for ISO 27001?
If they have access to your repo, CI, production or customer data, yes. Scope follows access, not employment status. Drata says to record duties, access permissions and security tasks for employees and contractors. A sandbox-only contractor can plausibly be documented out, but the auditor decides.