Atlassian doesn’t ask Marketplace Partners to hold both SOC 2 and ISO 27001. It asks for one of them, a SOC 2 Type 2 report or an ISO/IEC 27001:2022 certificate, and only once you reach Gold or Platinum in the Marketplace Partner Program or go after the new Atlassian Enterprise Certified badge. What trips most partners up is timing. Atlassian reviews partner levels every July, your evidence has to exist before July 1, and you can’t rush a SOC 2 Type 2 report. Below you’ll find what each program requires, which standard to pick, how to scope the audit around your app, the controls auditors push hardest on, and a timeline that gets you certified before your next review. Why Atlassian Marketplace Partners Now Need SOC 2 or ISO 27001 For years, a Marketplace app’s security story was really Atlassian’s story. Customers trusted Jira and Confluence, and the apps came along for the ride. Enterprise buyers don’t see it that way anymore, and neither does Atlassian. Enterprise Procurement and Vendor Security Reviews of Marketplace Apps Enterprise security teams treat a Marketplace app like any other vendor. Signing off on Jira doesn’t mean signing off on the reporting or time-tracking app
Most companies pursuing ISO 27001 certification for the first time will spend between $10,000 and $50,000 in year one, and far less than half of that goes to the auditor. A 50-person SaaS company typically pays $10,000 to $22,000 in certification body fees alone, then doubles or triples that figure in implementation work, tooling, and internal hours before the Stage 2 audit even begins. The wide range exists because ISO 27001 certification cost is not a price tag; it is the sum of a dozen separate decisions: your scope, your security maturity, your certification body, and whether you build the ISMS yourself, hire a consultant, or run it through a compliance automation platform. This article breaks down every one of those costs, stage by stage and region by region, including the ones that never appear in vendor quotes. Startups under 50 employees can price the readiness work up front. Axipro’s Achievement Plan starts at $4,000 for companies of that size. That fee covers the implementation work, not the certification body’s audit, which is billed separately and is the other large line in your budget. The sections below show what each piece costs and where fixed-fee readiness fits. What Determines ISO
Your managed service provider will show up in your SOC 2 audit whether you plan for it or not. The moment an MSP administers your endpoints, identities, backups, or monitoring, those become your controls operated by someone else’s staff, and your auditor will test them as such. Outsourcing the work never outsources the accountability. That makes MSP selection one of the most consequential decisions a company takes before pursuing SOC 2 compliance or ISO 27001 certification. The right provider shortens your audit, hands over evidence on request, and operates controls you would otherwise have to build yourself. The wrong one turns every evidence request into a negotiation and every finding into a finger-pointing exercise. Here’s what to evaluate before you sign. Understanding the MSP’s Role in SOC 2 and ISO 27001 Compliance How MSPs Impact Your Compliance Posture An MSP typically touches more of your control environment than any other vendor. Access provisioning, patching, endpoint protection, backups, log monitoring, incident response: in a typical growth-stage setup, the provider operates most of the controls an auditor will test. In SOC 2 terms, the MSP is a significant vendor or subservice organization whose work directly affects your Trust Services Criteria. Under ISO
Gartner predicts that by 2028, 90% of enterprise software engineers will use AI code assistants, up from less than 14% in early 2024. SOC 2 and ISO 27001 change management controls were written before that shift, and both rest on an assumption that AI-generated code breaks outright: the person who approved a change wrote it, or at least fully understood it. Neither the AICPA nor ISO has published AI-specific change management requirements, so auditors apply the existing controls, SOC 2 CC8.1 and ISO 27001 Annex A 8.32, to commits no human authored. Most teams discover the mismatch mid-audit, when a sample pulls up a 2,000-line agent-generated pull request that was approved in four minutes. This guide maps AI code generation to both frameworks: what each one requires, the risks AI coding assistants introduce, the workflow that satisfies auditors, and the evidence they request when GitHub Copilot, Cursor, or Claude Code shows up in your SDLC. Why AI-Generated Code Breaks Traditional Change Management Change management controls assume a human bottleneck. AI removes it in three places at once. The Volume Problem: AI Commits at Machine Speed A single developer running an agentic coding tool can open more pull requests in a
Compliance software collects the evidence. A consultant builds the system that evidence is meant to prove. That’s the real difference in the ISO 27001 consultant vs software decision, and most teams only figure it out after they’ve bought one and realized they still need the other. Below, we compare what each route covers, where it breaks down, and what it costs you in time, money, and your team’s hours. Short version: software on its own works for a small group of companies. For most SaaS and tech scale-ups trying to get an enterprise deal over the line, consultant-led implementation on a compliance platform is the faster and safer path to a certificate. Quick Answer: Consultant, Software, or Both? Software-only works if you already have an in-house security lead who’s taken a company through ISO/IEC 27001 before and has the time to own the project. Consultant-only still makes sense if you run mostly on-premise or legacy systems that platforms barely integrate with. For everyone else, which means most cloud-native companies under a few hundred people, a hybrid works best: a platform to handle evidence and monitoring, and a consultant to build the management system and stand behind it in front of
Most people asking this question fall into one of two camps. Either they already hold ISO 27001 and just shipped an AI feature, or they run an AI-native company and an enterprise buyer has asked for “your AI governance certification.” The answer is the same for both camps: ISO 27001 secures your information and ISO 42001 governs your AI. Neither certificate covers the other. If AI is part of what you sell or how you make decisions, you’ll need both. If it’s just a productivity tool humming away in the background, ISO 27001 on its own is still fine. Below: what each standard governs, where they overlap, what your existing ISMS doesn’t say about AI, how to decide, and how to run both as one management system rather than two. The Short Answer: When You Need Both (and When You Don’t) You need both when AI is part of your product or part of a decision that affects people, and a customer, regulator, or board could reasonably ask how you govern it. That covers most SaaS companies with a generative feature, every AI-native vendor, and any firm using AI to screen candidates, score credit, or make health or safety calls.
If your ISO 27001 certificate covers all of your health and care data processing, the NHS Data Security and Protection Toolkit does two useful things with it. It marks the applicable evidence items as complete on its own, and it shrinks the scope of any independent audit to whatever your certification doesn’t already cover. A certified vendor who does the mapping properly walks into a DSPT submission with most of the technical and organizational evidence already written, already audited, and already versioned. What ISO 27001 won’t do is get you out of the DSPT. It says nothing about the NHS-specific information governance items, clinical safety, the national data opt-out, or Caldicott principles. Vendors who assume “certified means done” usually discover this in the last two weeks of June. This piece is for the founder, CTO, or ops lead at a UK health-tech company who owns compliance without being a compliance person. It covers what each framework asks for, which Annex A controls line up with which DSPT requirements, which evidence you can reuse as-is, which needs reframing around patient data, and a five-step workflow for turning an existing ISMS into a DSPT submission. One more thing on timing: NHS England
Most companies start their first SOC 2 or ISO 27001 project in a spreadsheet, only to have it fall apart in week 6. This is typically when they’ll call us asking us to implement a GRC system that scales. Excel holds 154 controls fine. The trouble starts when an auditor sends over an evidence request list, two frameworks need updating at once, and a control owner who hasn’t opened the file since March edits the wrong row. This article gives you a free GRC workbook template built to take into consideration the hundreds of engagements we’ve guided. It walks you through each tab and tells you plainly when you’ve outgrown it. We’ve worked with hundreds of companies implementing SOC 2 + ISO 27001 and to be honest, for 80% of cases, using excel is feasible and even advised. Its a tool most of the staff knows and using it cuts onboarding times from weeks to a few hours. It also makes it accessible to the whole organization. The workbook covers all 33 SOC 2 Common Criteria plus the Availability, Confidentiality, Processing Integrity, and Privacy criteria, all 93 ISO 27001:2022 Annex A controls, a crosswalk between the two, and the evidence,
ISO/IEC 27001 certificates nearly doubled in a single year, from 48,671 in 2023 to 96,709 in 2024, according to ISO’s own certification survey. A big share of that jump comes from startups, not enterprises. The reason is simple: buyers stopped taking “we take security seriously” at face value, and a certificate is the fastest way to prove it. This guide covers when a startup should pursue ISO 27001, what it costs, how long it takes, and how a small team gets certified without a dedicated security department. What Is ISO 27001 and Why It Matters for Startups ISO/IEC 27001 is the international standard for information security management. It doesn’t hand you a checklist of firewalls to buy. Instead, it asks you to build and run an Information Security Management System (ISMS): a documented, repeatable way of finding your security risks and doing something about them. Certification means an accredited third party checked that your ISMS works and matches the standard. For a startup, that distinction matters. You’re not being graded on whether you own expensive tools. You’re being graded on whether you can show a system, which is exactly what an enterprise buyer’s procurement team wants to see before they
