packets.build00 ISO 27001
ISO 27001 certification, run for you
A Forward Employee in your team, an ISO expert at every milestone and AI agents on one platform. Your ISMS, risk assessment, Statement of Applicability and Annex A controls, built with you and kept running after the certificate.
For AI-native, IT services, fintech and healthtech teams selling to enterprise.
ISO 27001 readiness
- A.5.15 Access controlPassing
- A.8.8 Technical vulnerabilities2 tasks open
- Clause 9.2 Internal auditScheduled
ISO 27001 at a glance
What to expect before you start.
- 3–4 months
Typical time from kickoff to certificate: about 2–3 months of readiness, then about a month of audits.
Typical packets plan - 5 days
Working days until your Forward Employee joins your team.
packets commitment - 93
Annex A controls in ISO/IEC 27001:2022, all in the packets template.
The standard - 3 years
Certificate validity, with a surveillance audit in years one and two.
The standard
01 Typical certification schedule
Your path to ISO 27001
Five stages from kickoff to certificate, and who does what at each.
Forward Employee, scope and gaps
Weeks 1–2Agree what the ISMS covers and find the gaps.
Platform
- ISO 27001:2022 template: clauses 4–10 and Annex A
- Guided ISMS scope workflow
Agents
- Read your onboarding answers and connected tools
- Draft a first list of assets and risks
Your packets team
- Run the kickoff and the gap assessment
- Agree the scope: company, product or both
You
- One kickoff call
- Name an owner and approve the scope
Output ISMS scope and gap list
02 Who works on it
Three kinds of help, one programme
Not a tool you run alone, and not a consultant who hands over a report. The strip under each card shows when they are working on your certification.
- Within 5 working days
Forward Employee
Embedded in your team
Joins your team and drives the ISO work end to end: evidence, documents, internal audit preparation and follow-up. Full support until the certificate is issued.
- Runs the weekly cadence with your owner
- Chases evidence and fixes
- Prepares you for every audit
- Every milestone
ISO 27001 expert
At every milestone
Leads scoping, the risk assessment, control mapping and the internal audit, and introduces you to certification bodies. No separate consulting fee.
- Scope and risk assessment
- Internal audit and management review
- Certification body introduction
- From day one
AI agents
Working from day one
Work from your company's context. They draft policies and risks, suggest controls from your library, save check results as evidence and surface gaps. A person approves what counts.
- Draft policies and risks
- Suggest controls
- Collect evidence from your tools
03 Trust portal
Show progress before the certificate
Publish a Trust Center with your ISO 27001 status, live controls and published policies, synced from your packets workspace. Share one link instead of answering the same security questionnaire again.
- Access controlImplemented
- Encryption at restImplemented
- Incident responseIn progress
Synced from your packets workspace · just now
04 How ISO 27001 gets done
Platform, agents and people, for ISO 27001
The platform holds the controls. Agents do the volume work. People implement the parts of ISO 27001 that need judgement.
Platform
What it holds
- Clauses 4–10 and Annex AThe ISO 27001:2022 template, with requirements, controls and tasks.
- Statement of ApplicabilityGenerated from your controls and kept with them.
- Risk registerRisks linked to the controls that treat them.
- Audit workspaceReadiness, findings and remediation for each audit.
Autonomous agents
What they do
- Policy draftsTailored to your company and waiting for your approval.
- Risks and controlsGenerated risks wait in a review queue. Controls come from your own library.
- Integration checksGitHub, Microsoft 365 and ten more tools, checked daily.
- EvidenceSaved on the control task, dated and versioned.
Humans →
What they implement
- ISMS scope and contextClause 4, agreed with your leadership.
- Risk assessment and treatmentClauses 6.1 and 8.2–8.3, run with your owners.
- Internal auditClause 9.2, run by an ISO expert.
- Management reviewClause 9.3, prepared and recorded with you.
On file
- GitLab · protected branchesApproved
- Cloudflare · zones activeApproved
Agents collect it
Your team approves it
Agents save evidence and drafts into the platform. A person on your team approves them there.
05 Compare
Four ways to get ISO 27001. One comes with someone accountable.
| Question | A compliance tool | A consultant | A hire | packets |
|---|---|---|---|---|
| Who is accountable | Your engineer | Nobody, after the engagement | Whoever you hired, once ramped | Your packets team, from week one |
| Who does the work | You | Advises; you implement | One person, part-time | Agents at volume, plus specialists |
| Policies and evidence | Templates to fill in | Document set, handed over | Written from scratch | Drafted and mapped; you approve |
| Statement of Applicability | A template to fill in | Written once, handed over | Written from scratch | Generated from your controls |
| Internal audit and management review | Left to you | Often a separate engagement | If they have run one before | Run by an ISO expert |
| Checking controls | Yes, automated | No system | Manual, or a tool too | Daily checks, same system |
| Adding a framework | Start the checklist again | A new engagement | More work, same person | Reuses controls in place |
| Surveillance audits | Your team prepares | A new engagement | Depends on them staying | Same system, nothing restarts |
| What it costs | Licence, plus the work | Project fee, no system | ₹30–35L a year, plus time to hire | One fixed price |
Hire cost from the packets comparison on packets.build. Your quote depends on scope and frameworks.
06 Features
What runs your ISO 27001 programme
Specific to ISO 27001
Statement of Applicability
Generated from your controls, with each Annex A control marked as applicable or not and why.
Guided ISMS workflow
Scope, risk assessment and treatment, and the SoA, step by step.
Internal audit workspace
Requirements, readiness, findings and remediation tasks for each audit.
In every packets programme
Controls
Each control maps to the requirements it satisfies, so work counts once.
Policies
A full policy set drafted for how you operate, with approvals recorded.
Evidence collection
Evidence on each control task, with owners, versions and expiry.
Integrations
GitHub, Microsoft 365, GitLab, Cloudflare and more, checked daily.
Risk register
Risks drafted from your context, approved by you, linked to controls.
Vendor management
Your suppliers, their risks and the records behind them.
Trust portal
Your status, controls and policies on one public page.
Employee portal
Staff read and accept policies and complete their own tasks.
07 Framework overlap
Already doing ISO 27001? Much of the next one is done.
One control can satisfy requirements in several frameworks, so ISO 27001 gives you a head start on the next one. Each card shows how much of the main work is already done, and what is left.
StartingSOC 2after ISO 27001
5 of 8already done
- Access control, encryption and logging controls
- Asset inventory and change management
- Risk assessment and vendor management
- Policies and incident response
- Evidence already on your control tasks
- Mapping to the Trust Services Criteria
- An observation window of 3–12 months for Type II
- A licensed CPA firm to issue the report
StartingISO 42001after ISO 27001
3 of 6already done
- Management system clauses: context, leadership, internal audit, management review
- Risk process and document control
- Security controls around your AI systems
- An AI system register
- AI risk and impact assessments
- AI controls from ISO 42001 Annex A
StartingGDPRafter ISO 27001
3 of 6already done
- Security of processing controls
- Incident response and breach handling
- Supplier register and due diligence
- Records of processing activities
- A lawful basis for each activity
- DPIAs and data subject request handling
StartingHIPAAafter ISO 27001
2 of 4already done
- Access, logging and encryption controls
- Risk assessment
- Business associate agreements
- HIPAA breach notification rules
Counts are of the main pieces of work, not a measured percentage of controls. Your scope decides the rest.
08 Which one first
Your buyers decide which framework you need
Not sure? We map it with you on the first call.
- Enterprise buyers in India, Europe and the Middle EastISO 27001 This page
- Indian enterprises, telecom, banks and governmentISO 27001 and DPDP readiness This page
- US and Canadian enterprise buyersSOC 2 Type II →
- Anyone whose users are in EuropeGDPR readiness →
- Buyers reviewing an AI productISO 42001 →
09 After the certificate
Certification is a milestone. Governance is continuous.
The same system and the same team keep you certified, so year two does not start from scratch.
- Every day
Integration checks run and expired evidence is flagged for refresh.
- Every quarter
Access, risk and policy reviews, ready for you to sign off.
- Years 1 and 2
Surveillance audits, prepared from the evidence already in place.
- Year 3
Recertification, on the same system. Nothing restarts.
Already using another tool or consultant?
Bring your controls, policies, risk register and vendor list. We plan the move around your audit dates, so your certification timeline does not have to change.
10 Questions
Questions about ISO 27001
01How long does ISO 27001 take with packets?
Typically three to four months from kickoff to certificate: two to three months of readiness, then about a month for the Stage 1 and Stage 2 audits. Your scope and your certification body's calendar change this.
02Who issues the certificate?
An accredited certification body. packets prepares you, coordinates the audits and supports you until the certificate is issued. We do not issue certificates or guarantee the outcome.
03What is a Forward Employee?
A packets specialist who joins your team within five working days and drives the ISO work day to day, alongside an ISO expert who leads each milestone.
04How much of our team's time does it need?
One owner for a few hours a week, policy approvals, engineering fixes with our guidance, and security awareness training for your staff. We do the heavy lifting. You make the decisions.
05What do the AI agents do, and what don't they do?
They draft policies and risks, suggest controls from your library, save integration check results as evidence and surface gaps. They do not approve anything: generated risks and policies wait for a person.
06What is the Statement of Applicability?
The list of Annex A controls, whether each applies to you and why. packets generates it from your controls, and your ISO expert reviews it with you.
07Do you run the internal audit and management review?
Yes. An ISO expert runs the internal audit (clause 9.2) and prepares the management review (clause 9.3) with you.
08How long is the certificate valid?
Three years for your ISMS scope, with surveillance audits in years one and two and recertification in year three.
09Should we do ISO 27001 or SOC 2 first?
Start with what your buyers ask for. Enterprise buyers in India, Europe and the Middle East usually ask for ISO 27001; US and Canadian buyers for SOC 2. Much of the control work carries over to the second.
10What is not included?
Penetration testing, engineering work on your systems, legal advice and certification body fees are separate. We help you plan for each.
11 Keep exploring
Before you book a call
- ToolAudit readiness scoreFind out where you stand in two minutes, no call.→
- GuideDigital Resilience HandbookA practical guide to building resilience in.→
- PlatformEvidence collectionHow evidence sits next to the controls it supports.→
- PlatformRisk assessmentsHow risks are drafted, reviewed and linked to controls.→
Get ISO 27001 certified. Then stay that way.
Talk to us about your scope, your buyers and your timeline.
- A Forward Employee in your team within five working days
- An ISO expert at every milestone
- AI agents that draft and collect; you approve