Six Months from First Contact to Certification: ISO 27001 for a Tech Startup
Sector: Technology | Scope: ISO 27001 implementation | Outcome: Certified with no non-conformances in six months; client subsequently achieved Cyber Essentials independently
There is a version of ISO 27001 implementation that takes years, costs a great deal, and leaves the organisation dependent on external support to maintain what has been built. And then there is this.
First contact was made in August 2025. ISO 27001 certification was achieved in February 2026, with no non-conformances. Six months, start to finish.
The client was a technology startup — a fast-moving business that needed certification and needed it done properly, without unnecessary complexity or delay. The relationship came via a referral: a former contact who had been through the ISO 27001 process with Cambridge Risk Solutions at a previous organisation, understood exactly what the work involved, and knew it would be delivered efficiently and well.
That prior relationship mattered. There was no time lost establishing trust or explaining the methodology. The work began immediately, the information security management system was built on foundations that were proportionate to the size and nature of the business, and the audit was passed first time.
Speed without shortcuts is a particular discipline. Achieving certification in six months requires clarity about what is genuinely required, the ability to make pragmatic decisions about implementation without compromising the integrity of the system, and a client willing to engage actively with the process rather than hand it over and wait. This client did exactly that.
What happened next is perhaps the most satisfying outcome of any certification project. Having been through the process, the client’s internal lead was sufficiently equipped and confident to achieve Cyber Essentials independently — without external support. That is capability transfer in its most direct form: not just a certified management system delivered on time, but a team that understands what it has built and is capable of continuing to develop it.
In, done, and out. Exactly as it should be.