Compliance as a Service (CaaS)

Two controls decide whether your ISO 27001 business continuity plan survives an audit: Annex A 5.29 and Annex A 5.30. One keeps your security controls working while everything else is failing. The other gets your systems back online before the damage becomes permanent. Plenty of teams write a continuity policy that satisfies neither in the way a certification auditor expects, and they discover the gap during the Stage 2 audit, when it is expensive to fix. This article covers what ISO 27001:2022 actually requires for business continuity, the components an auditor will ask to see, the step-by-step build, and the mistakes that turn a continuity plan into a non-conformity. What Is an ISO 27001 Business Continuity Plan? An ISO 27001 business continuity plan is the documented set of procedures that keeps information security effective and critical ICT services available during a disruption. It is not a generic “keep the lights on” binder. Under ISO 27001, the plan protects the confidentiality, integrity, and availability of information when normal operations break down: a ransomware event, a cloud outage, a data center failure, or a supplier collapse. The plan lives inside your Information Security Management System (ISMS). It draws on your risk assessment, your asset register, and your Business Impact Analysis (BIA), and it feeds your disaster recovery procedures. Scope is the part people get wrong. ISO 27001 cares about the information security aspects of continuity, not every operational hiccup a full business continuity program might cover.   Why You Need a Business Continuity Plan for ISO 27001 Compliance Downtime is expensive, and the bill arrives fast. For most organizations, the question is not whether a disruption will happen, but how quickly they recover when it does. There is also a hard compliance reason. You cannot certify to ISO 27001 while ignoring continuity. The standard requires you to maintain information security during disruption and to keep ICT able to support recovery, and an auditor will ask for the evidence. A continuity plan is where availability stops being a promise and becomes a tested capability. Let Axipro help you build a business continuity plan that’s practical, compliant, and audit-ready. Strengthen Your Business Continuity Strategy Schedule A Consultation ISO 27001 Requirements Related to Business Continuity Planning ISO/IEC 27001:2022 carries 93 Annex A controls across four categories: organizational, people, physical, and technological. Continuity sits in the organizational set, and two controls do the heavy lifting, supported by two more on the technical side. Annex A 5.29 – Information Security During Disruption A.5.29 requires you to maintain information security at an appropriate level when a disruption hits. The point is that security controls have a habit of degrading under pressure. People disable multi-factor authentication to “speed things up,” logging stops on a failover system, or access controls loosen while everyone scrambles. A.5.29 says the confidentiality and integrity of your information must be maintained even while availability is under threat. It is classed as both a preventive and a corrective control, meaning it should reduce the chance of an incident and also help resolve one already underway. Annex A 5.30 – ICT Readiness for Business Continuity A.5.30 is the technical engine. It requires that your ICT readiness is planned, implemented, maintained, and tested against business continuity objectives and ICT continuity requirements. In plain terms, your servers, networks, applications, and cloud services need a defined recovery path, each with a Recovery Time Objective (RTO) and Recovery Point Objective (RPO), and you need to prove the path works. This control is entirely new in the 2022 revision. It has no precedent in ISO 27001:2013, which is exactly why teams migrating from the older version so often have a gap here. Important: A.5.30 did not exist in ISO 27001:2013. If your continuity documentation was written against the old Annex A 17 cluster and never updated, you are missing a control the auditor will specifically test. Treat ICT readiness as a fresh requirement, not a relabel. Two technological controls back these up. Annex A 8.13 (Information Backup) requires backups to be taken and tested in line with an agreed policy, and Annex A 8.14 (Redundancy of Information Processing Facilities) covers the failover and redundancy that let critical systems keep running when a component dies. Relationship Between ISO 27001 and ISO 22301 This is where confusion is common. ISO 27001 requires the information security aspects of continuity. ISO 22301 is the dedicated standard for a full Business Continuity Management System (BCMS), covering people, facilities, supply chain, and operations far beyond information security. An ISO 27001 certificate does not certify your wider continuity program. The good news: both standards share the Annex SL high-level structure, so risk assessment, internal audit, management review, and document control carry across. Teams that already run ISO 27001 can layer ISO 22301 on top with far less effort than starting from scratch. Key Components of an ISO 27001 Business Continuity Plan Business Impact Analysis (BIA) The BIA is the foundation. It identifies your critical business processes, the ICT systems they depend on, and the cost of losing each one over time. It is where your recovery objectives come from, not from a vendor datasheet. A BIA also sets the Maximum Tolerable Period of Disruption (MTPD): the point beyond which an activity’s failure causes unacceptable damage. Risk and Disruption Scenario Assessment Your risk assessment identifies what could cause a disruption and how likely it is, feeding the Risk Treatment Plan and the Statement of Applicability (SoA) that records which controls apply. Continuity planning then runs concrete scenarios: ransomware, a regional outage, a key supplier failure, the loss of a data center. Response and Recovery Strategies For each critical system, you define how you will respond and recover: failover to a secondary site, restore from backup, or switch to a manual workaround. This links incident response to crisis management, the executive-level decision-making that kicks in when an incident escalates beyond a routine fix. Roles and Responsibilities Name real people, not departments. “IT will handle it” is the single most common

Most companies pursuing ISO 27001 certification cost analysis for the first time will spend between $10,000 and $50,000 in year one, and far less than half of that goes to the auditor. A 50-person SaaS company typically pays $10,000 to $22,000 in certification body fees alone, then doubles or triples that figure in implementation work, tooling, and internal hours before the Stage 2 audit even begins. The wide range exists because ISO 27001 certification cost is not a price tag; it is the sum of a dozen separate decisions: your scope, your security maturity, your certification body, and whether you build the ISMS yourself, hire a consultant, or run it through a compliance automation platform. This article breaks down every one of those costs, stage by stage and region by region, including the ones that never appear in vendor quotes. What Determines ISO 27001 Certification Cost? Six variables drive almost all of the variance between a $10,000 certification and a $150,000 one. Company Size and Employee Count Headcount is the single biggest cost driver because certification bodies calculate audit days (mandays) primarily based on the number of people working within the scope of your Information Security Management System (ISMS). The calculation is not arbitrary: accredited bodies follow the audit time tables in ISO/IEC 27006, which means a 20-person company and a 200-person company will receive structurally different quotes no matter how hard they negotiate. More employees also means more interviews, more evidence sampling, and more Annex A controls applied across more people. Scope and Complexity of the ISMS Scope is the variable you actually control. Your Statement of Scope defines which business units, systems, products, and locations fall inside the ISMS. A scope limited to one product line and the engineering team that runs it costs dramatically less to implement and audit than a whole-of-company scope. Complexity compounds this: bespoke infrastructure, regulated data types, and heavy third-party dependency chains all add controls, evidence, and audit time. Number of Physical and Cloud Locations Each physical site within scope can require its own audit visit, with travel costs on top. Multi-site organisations can reduce this through sampling (more on the square root rule later), but every additional location still adds something. Cloud environments count too: multiple cloud providers, regions, and tenancy models expand the technical scope auditors must cover, even when no travel is involved. Existing Security Maturity A company that already runs access reviews, maintains an asset inventory, and documents its incident response process is buying a much shorter journey than one starting from a blank page. The gap analysis exists precisely to price this difference. Organisations already aligned to SOC 2, NIST CSF, or Cyber Essentials Plus typically reuse 50 to 70 percent of their existing controls and evidence, which translates directly into lower implementation cost. Choice of Certification Body Certification bodies are not interchangeable on price. Large international names like BSI, Bureau Veritas, LRQA, and DNV charge premium day rates, often 30 to 50 percent above smaller accredited bodies, and their brand carries weight with enterprise procurement teams. What matters most is accreditation: a certificate issued by a body accredited by UKAS, ANAB, or another IAF (International Accreditation Forum) member carries international recognition. An unaccredited certificate is cheaper and close to worthless in serious sales conversations. Internal vs. External Implementation Approach The final driver is who does the work. Internal teams cost salary hours. Consultants cost fees. Platforms cost subscriptions. Each approach lands at a very different total, which is why this article dedicates a full section to it below. Average ISO 27001 Certification Cost Ranges The ranges below cover total first-year cost: implementation, tooling, and certification audits combined. They assume an accredited certification body and a sensibly defined scope. Cost for Small Businesses and Startups (1–50 Employees) A focused startup with a single product, cloud-native infrastructure, and a tight scope can realistically certify for $10,000 to $35,000 all-in. Lean implementations using templates or an automation platform sit at the bottom of that range. UK micro-businesses can find UKAS-accredited audit fees starting around £6,250, with day rates near £1,250. Cost for Mid-Sized Organizations (50–250 Employees) This is where most certifications happen, and where costs spread widest. Expect 8 to 12 initial audit days, $30,000 to $80,000 in total first-year spend, and a six to nine month timeline. Multiple departments, more mature customer requirements, and the first real multi-team coordination overhead all show up in the budget. Cost for Large Enterprises (250+ Employees) Enterprise certifications routinely exceed $100,000 in year one once you include program management, multiple sites, and large-scale audits. The audit fee alone can pass $50,000 for complex, multi-site scopes. At this scale, the internal time investment, covered under hidden costs below, often outweighs every external invoice. ISO 27001 Cost Breakdown by Stage Here is where the money actually goes, in roughly the order you will spend it. Cost of Purchasing the ISO 27001 Standard The official ISO/IEC 27001:2022 document costs CHF 155 (roughly $170) from the ISO store. Most teams also buy ISO 27002, the implementation guidance for the Annex A controls, for a similar amount. Budget $300 to $400 for both. Do not skip this purchase: implementing against second-hand summaries of the standard is a common source of audit findings. Gap Analysis Costs A consultant-led gap analysis before committing to anything else runs $2,000 to $10,000 depending on scope, while platform-based readiness assessments are often bundled into the subscription. The output, a clear map of where you stand against every clause and control, is what makes the rest of the budget predictable. ISMS Implementation Costs This is the largest and most variable line item: building the risk assessment, the risk treatment plan, the Statement of Applicability (SoA), and operationalizing the controls you have selected. Done internally, it consumes 200 to 600 hours of staff time over four to eight months. Done with consultants, expect $10,000 to $50,000 in fees for a typical SMB. Documentation and Policy Development Costs ISO 27001 requires a defined set of documented

31% of organizations have caught former employees accessing SaaS applications after their departure (source). Seventy percent of intellectual property theft happens in the ninety days surrounding a resignation announcement. The pattern is so consistent that auditors now treat termination day as one of the highest-risk windows on the security calendar. This article is a working employee offboarding checklist for IT, security, and HR teams who want to close that window cleanly. It walks through ten steps that revoke access without leaving gaps, then covers edge cases (remote workers, hostile exits, lost devices), the manual-versus-automation tradeoff, and post-offboarding monitoring. Use it as a baseline and adapt it to your environment. What Is Employee Offboarding and Why Does Access Revocation Matter? Employee offboarding is the structured process of separating a person from an organization: removing their access, recovering company property, documenting their exit, and updating records. The access revocation piece is the part where most programs fail quietly. Accounts get disabled in the identity provider but stay active in a dozen SaaS tools. Badges get collected but VPN tokens stay valid. The person is gone; the keys to the building are not. Why Employee Offboarding Is a Critical Security Risk Offboarding fails because access has multiplied faster than the processes designed to manage it. The average enterprise now operates somewhere between 275 and 660 SaaS applications depending on size, with employees touching dozens of them each week. Each application is a separate place that needs to be cleaned up, and each one creates an independent point of failure. The departing employee is a particularly acute version of this risk because the motivation to walk away with something often peaks during the same window that access is supposed to be revoked. The Cost of Leaving Access Open After Departure The financial picture is well documented. The 2025 Ponemon Cost of Insider Risks report puts the average annual cost of insider-related incidents at $17.4 million per organization, with containment taking an average of 81 days. Even when a departed employee never actively misuses their access, the existence of a forgotten account is enough to compromise a SOC 2 audit, trigger a breach notification, or create the credentialed beachhead that an outside attacker eventually exploits. The cases keep appearing. Cash App was breached in 2022 when a former employee accessed the records of 8 million customers after leaving. In May 2024, FinWise Bank disclosed that a former employee accessed internal systems after departure because access had never been fully revoked. Intel sued a former engineer in 2024 for downloading roughly 18,000 sensitive files in the days before he left. Ponemon’s 2025 report found that containment costs scale steeply with time. Incidents resolved in under 30 days averaged about $11 million, while those over 90 days averaged $17 million. The biggest variable is not detection capability. It is how fast access actually came down on day one. Compliance and Legal Implications of Incomplete Offboarding Access revocation is not a “best practice.” It is an explicit control requirement in nearly every framework against which an organization is likely to be audited. NIST SP 800-53 control PS-4 requires that on termination, organizations disable system access within an organization-defined time period, terminate or revoke any authenticators, and retrieve organizational property. ISO/IEC 27001 includes equivalent expectations under its Annex A controls for termination of employment. The AICPA Trust Services Criteria for SOC 2 cover this under Common Criteria CC6.2 and CC6.3, and auditors routinely pull a sample of terminated employees and verify timestamps in the identity provider against the HR system. GDPR adds a separate dimension. If a former employee still has access to the personal data of EU residents, that constitutes unauthorised processing under Article 32, and it is the controller’s responsibility, regardless of intent. HIPAA does the same for protected health information. Whatever the framework, the question an auditor or regulator will ask is the same: how quickly was access revoked, and can you prove it? Who Is Responsible for Employee Offboarding? Offboarding fails most often because no one owns the whole process. Four groups need to be in the loop, and each one has a distinct job. HR and People Operations HR is the source of truth for the termination event. Their job is to capture notice of departure, set the official last day, communicate timing to the rest of the business, and serve as the trigger that starts every downstream task. If HR does not record the termination in the HRIS, nothing automated will fire. IT and Security Teams IT executes the access teardown. They disable accounts in the identity provider, revoke SSO and OAuth tokens, remove SaaS application access, suspend email, and recover devices. Security teams typically run the audit trail and post-offboarding monitoring, and they are the ones answering when an account flagged six months later turns out to belong to a person who left in March. Legal and Compliance Legal handles NDA reminders, IP assignment confirmations, non-disclosure obligations, and any contractual surprises. Compliance owns the documentation: the evidence trail that proves the offboarding actually happened and met the relevant control requirements. For regulated industries this becomes audit evidence; for everyone else it becomes legal cover. Direct Managers Managers know things HR does not. They know which shared drives the person owned, which third-party vendors they had standing access to, which client passwords they may have rotated themselves, and which projects need a transition plan. A solid offboarding process forces the manager into the workflow with a checklist of role-specific items, because no central team can guess them. Employee Offboarding Checklist: 10 Steps to Revoke Access Without Leaving Gaps This is the core sequence. The order matters: starting with notification and inventory before disabling accounts means you do not lock the person out of a system you still need them to hand off. Step 1: Initiate Offboarding Immediately Upon Notice of Departure The moment notice is given — resignation, termination decision, or end of contract — the offboarding workflow should start. This means