ISO 27001 for AI-native SaaS teams without a CISO

The security questionnaire lands while the enterprise deal is still open. Legal wants an ISMS. Procurement wants a certificate number. Engineering is shipping model features. Nobody on the founding team has run ISO 27001, and there is no security hire to own it. That stall is the whole problem.

Buyers say ISO 27001. The requirements they mean are ISO/IEC 27001:2022: an information security management system. Searchers type the short name. Certificates use the full ISO/IEC name. Both matter if you sell to US and EU enterprise from India without a GRC team.

What ISO 27001 actually requires

The standard is not a spreadsheet you finish and forget. ISO/IEC 27001:2022 requires you to establish, implement, maintain, and continually improve an ISMS. Those rules sit in Clauses 4 through 10. Claim conformity and you cannot drop a clause because it is annoying. Exclude any of Clauses 4 to 10 and you are not claiming conformity.

Annex A is a reference set, not optional homework. The 2022 edition lists 93 controls in four themes: organizational, people, physical, and technological. You do not implement every row on instinct. You treat information security risk, then check Annex A so nothing relevant is skipped. The Statement of Applicability records which controls apply, why exclusions are justified, and how applicable controls run. Auditors sample it at Stage 1 and Stage 2. A SoA that does not match production access, vendor reviews, or backup tests fails the same way an empty SoA fails.

For an AI-native product, the ISMS still starts with scope, context, and interested parties. Buyers will ask about training data, model vendors, prompt logs, and customer isolation. Those questions belong in the ISMS as assets, risks, treatment, owners, and evidence. The standard does not replace ISO 42001 or the EU AI Act. It is the information security system those questionnaires assume you already run. See how Packets frames this for AI companies.

Certification is a third-party opinion on that system. An accredited certification body audits against ISO 27001. Management represents how the ISMS actually operates. The auditor issues the opinion. No software vendor, consultant, or implementation partner certifies you. If a sales page blurs that line, treat it as a yellow flag.

Where a tool-only approach stalls

A compliance product can store policies, map Annex A, ping integrations, and nag owners. That volume work is real. The program still fails when nobody is accountable for decisions the tool cannot make.

Scope is the first stall. Indian SaaS selling into the US and EU often mixes one cloud, a support laptop fleet, a founder-owned domain, and a model API on a personal card. A tool will ask you to type a scope statement. It will not sit with the CEO and decide what belongs in the ISMS. Get scope wrong and ISO 27001 evidence is too thin for the deal or too wide for the team.

Risk treatment is next. Annex A is a completeness check, not the risk assessment. Teams dump 93 rows into a tracker, mark most as applicable, and never change access, logging, or vendor contracts. ISO 27001 wants residual risk leadership accepted, with treatment that matches how engineers ship. Green checks are not that.

Then evidence. Questionnaires ask for the certificate, the SoA, access reviews, incident records, and backup tests. Tools collect screenshots. Someone still has to run the review, close the gap, and keep the artifact dated. Without a named owner, the program becomes a panic week before the auditor or the customer security team. Evidence automation helps with volume. It does not replace the owner.

The questionnaire is the fourth stall. Enterprise packs mix ISO 27001, SOC 2, and AI-specific asks. Policy templates do not answer who can prompt a model with customer data unless a person mapped that control to the real architecture. A product cannot attend that customer call.

How Packets runs the work end to end

Packets is compliance automation with a named specialist inside your team who is accountable for implementation. Agents handle volume: control mapping, evidence collection, reminders, questionnaire drafts. A person owns the outcome: scope, SoA judgments, risk acceptance, auditor-ready narrative, and the exceptions every 20–200 person company has. That is expert advisory sitting in the work, not a slide deck after kickoff.

For ISO 27001, the split matters. The specialist helps leadership write a scope that matches how you sell: product, regions, subprocessors, and AI components that actually process customer information. Agents keep the control set and evidence requests moving. The specialist does not sign the certificate. They keep management ready to make representations the auditor can test. The product page for this job is ISO 27001.

Implementation means operating the ISMS, not decorating a portal. Access reviews happen. Vendors get reviewed. Incidents have a path. Internal audit and management review are real meetings with minutes. When a US or EU buyer sends a security pack, the answers come from the same system you will show the certification body.

Packets does not issue certificates and does not replace the certification body. If you already have a CISO or a GRC team running the ISMS, this model is not the beachhead. The beachhead is Indian B2B SaaS, roughly 20 to 200 people, selling upmarket, with no dedicated compliance hire, and a questionnaire sitting on a live deal.

Packets vs Scrut for this job

Scrut is a compliance tool. Treat it that way: software that helps teams organize ISO 27001 work. Packets is for teams that need the work done, not only tracked. Missing software is a tool problem. Missing ownership is not. Buying another tracker will not close ISO 27001. Read the live write-up at Packets vs Scrut.

Keep the other columns generic. A consultant can run a project and leave. A hire can own the ISMS if you can recruit, ramp, and retain them while the deal is open. A tool stores the program. Packets puts a specialist on implementation and uses agents for volume so that person is not buried in copy-paste. That is a depth claim about accountability, not a claim that Packets covers every framework on earth.

Judge the job on evidence: who writes the SoA, who sits in management review, who answers the questionnaire when engineering is heads-down, and who stays after the certificate. Continual improvement is part of the standard. A one-time scramble is not an ISMS.

What done looks like before the auditor arrives

Done is not a folder of policies dated last night. Leadership can explain scope and context. Interested-party requirements, including contracts and questionnaire commitments, are listed and owned. Risks match how the product runs, including model and data flows. The SoA covers Annex A with justifications a skeptical auditor can follow. In-scope controls have operating evidence, not intent.

Internal audit has run with some independence from the people who built the control. Management review happened, with actions, not a slide. Corrective action has a trail. You do not need a 200-person security org. You need someone who will not let ISO 27001 become a side quest.

Still collecting screenshots the week before Stage 2? You do not have an ISMS. You have a certification attempt. Buyers who have been through this hear that on a call.

ISO 27001 next to SOC 2 and AI questionnaires

Many Indian SaaS teams hit ISO 27001 and SOC 2 in the same quarter. US buyers grew up on SOC 2. EU buyers grew up on ISO. The programs overlap on access, change, vendors, and availability. They are not the same opinion. Do not promise one certificate as a substitute for the other. The side-by-side is SOC 2 vs ISO 27001.

AI questionnaires sit on top. Evaluation, logging, training-data rights, human oversight. The ISMS is where those answers live as risks and controls. It does not automatically satisfy ISO 42001 or the EU AI Act. Treat AI governance as a related workstream, not a rebrand of the information security program.

When a pack asks if you are ISO 27001 certified, the honest answers are certified, in implementation, or not started. "We use a platform" is not a status. If you are in implementation, say what is in scope, when Stage 1 is planned, and who owns gaps. A buyer can work with that. A vague timeline they cannot.

Keep claims tight. Packets does not advertise a certificate for itself here. No customer names, no pass rates, nothing we cannot source. The work is implementation of your ISMS so an auditor can issue an opinion on your company, not on your vendor.

Frequently asked questions

Is ISO 27001 the same as ISO/IEC 27001:2022?

ISO 27001 is the everyday name. The current requirements standard is ISO/IEC 27001:2022, jointly published by ISO and IEC. Certificates should cite the full reference, including the year. If a vendor or a buyer uses the short name, ask which edition they expect. New work should be against the 2022 edition.

Do we have to implement all 93 Annex A controls?

No. ISO 27001 requires you to consider Annex A when treating risk and to document applicability in the Statement of Applicability. Exclusions need a justification tied to your context, not "we are a startup." Inventing exclusions for cloud, people, or logging because they are hard is a common finding.

Can software certify us to ISO 27001?

No. A certification body issues the certificate after audit. Management is responsible for the ISMS. A tool or an implementation partner can prepare you. Anyone who implies they certify your company is overselling. Packets does not issue the opinion.

How does ISO 27001 show up in a security questionnaire?

Expect the certificate, scope statement, SoA excerpts, policies, and samples of operating evidence. AI-native buyers add questions about models and data. If ISO 27001 is in progress, answer with scope, owners, and dates rather than a claim you cannot defend on a customer call.

We are 40 people in India selling to US enterprise. Is ISO 27001 realistic?

Yes, if scope is honest and someone owns implementation. The standard is written to be generic across size and sector. The failure mode for this beachhead is not "too small." It is nobody accountable, a tool-only program, and a questionnaire due Friday. That is the job Packets is built to run with you.

If a live deal is blocked on ISO 27001 evidence, start with a clear scope and a named owner, then run the ISMS underneath. Get a free audit score when you want a baseline of where the system actually stands versus what buyers are already asking.