Tailored solutions for startups and scale-ups
Young companies grow through customers that are larger than they are. Those customers check how you handle data before they sign. Sightadel helps you build a lean ISO 27001 foundation early, one that grows with the company and later supports SOC 2 or NIS2 as well.
Starting point
In the early years, every hour counts for product and sales. Information security runs alongside, often well, but rarely written down. Access, backups and encryption are set up, yet nobody could show straight away who checked what and when.
That changes with the first big customer. Purchasing sends a security questionnaire, the legal department a data processing agreement, and IT wants to see a certificate. In a funding round, investors ask about the same topics in due diligence.
Starting early makes it easier. A small team with few systems is quick to describe, and good habits form before bad ones set in. As the company grows, the ISMS grows with it instead of being rebuilt later with a lot of effort.
Why now
The deal depends on a certificate or a completed questionnaire. Without proof, the contract is delayed or goes to a competitor.
Investors review information security and data protection in due diligence. Answers backed by evidence save time and follow-up questions.
Customers in the USA usually ask for a SOC 2 report. If you have already built ISO 27001, you can use a large share of the controls for it.
Every new person brings access rights, devices and tools. Without rules for onboarding and offboarding, you quickly lose track.
Banks, insurers and companies subject to NIS2 have to assess their service providers. Even a small software company receives these requirements through the contract.
From 50 employees or more than €10 million in turnover and balance sheet total, NIS2 can apply directly, for example to cloud providers or managed service providers. If you grow quickly, keep this in view.
Relevant frameworks
Summarised in our own words, not legal advice. The original text in its current version is authoritative.
The usual proof in the European market. A small, clearly defined scope, such as one product and its environment, keeps the start manageable. The certificate from an accredited body is valid for three years, with annual surveillance audits.
View framework →Requested as soon as customers in the USA come on board. Type I describes the design of the controls at a point in time, Type II their effectiveness over a period. The report is issued by a CPA firm.
View framework →Applies from the first customer with personal data. If you process data on behalf of others, you need contracts under Art. 28 GDPR, a list of sub-processors and documented technical and organisational measures.
View framework →For young companies usually not a direct topic yet, because the size thresholds are not reached. For certain services, however, the BSIG applies regardless of size. If the requirements come via customers, an ISMS under ISO 27001 is often enough as an answer.
View framework →For companies whose product is based on AI. Customers and investors ask how models are selected, data is used and risks are assessed. ISO 42001 has the same structure as ISO 27001.
View framework →Recommended order
Which customers do you want to win, and which proof do they require? Usually that is ISO 27001, for US customers SOC 2. You need data protection in any case.
One product, its environments and the people who work on it. A narrow, well-justified scope can be extended later.
A lot is already happening: code reviews, backups, multi-factor authentication. What it needs is a short policy and dated evidence. Whatever is missing becomes a task.
Access reviews, onboarding, offboarding and changes need evidence on a regular basis. If you only collect shortly before the audit, there will be gaps.
The ISO certificate is issued by an accredited certification body. After that, you show the certificate, measures and subcontractors in the Trust Center instead of answering every questionnaire from scratch.
Focus
An ISMS for ten people looks different from one for two hundred. These points help you avoid building it twice.
One product and one site are a good start. When products, sites or companies are added, you extend the scope instead of starting again.
SOC 2, NIS2 or ISO 42001 use the evidence you already keep for ISO 27001. Only what the additional framework requires on top is new.
Investors ask about policies, risks, incidents and vendors. With a maintained ISMS, you put the documents together without working extra shifts.
Developers work as Contributors only on their own tasks and upload evidence there. There is no integration with development tools.
How Sightadel helps
ISO 27001 and SOC 2 are worked through control by control, with an explanation and answer options. Where requirements overlap, one piece of evidence is linked to both frameworks.
Learn more →Policies start from a template instead of an empty document. The AI helps with wording based on your input, and decisions for management stay marked.
Learn more →Evidence carries a date, version and expiry date. Recurring controls run as a cycle, and Sightadel sends a reminder before the deadline.
Learn more →A dedicated page with certificates, approved documents, security measures and subcontractors. Sales refers to it instead of answering every questionnaire individually.
Learn more →Cloud platform, email delivery, monitoring and support tools are listed with risk and evidence. This feeds the list of subcontractors in the Trust Center.
Learn more →Sightadel checks the attack surface of your domains that is visible from the outside. Customers use exactly this view when they assess you.
Learn more →Effort and duration
The ranges are based on experience, not a commitment. The biggest factors are the size of the scope, the number of services in use and how much time the team can spare alongside product work.
What you license · typically Basic
A young company with one product typically starts with ISO 27001 and the GDPR in the Basic edition. It includes five users and ten vendors. Licence for ISO 27001: from €750 per month. Because ISO 27001 is included, the GDPR and later SOC 2 cost permanently less. As the team or the number of services grows, you switch to Professional.
Licence per framework, minimum term one year, payable monthly or annually. You will find all prices, discounts and a calculator on the pricing page. Fees of a certification or audit body are charged separately.
Questions and answers
More in our FAQ or directly via our contact form.
The standard does not set a minimum size. For a small team, the ISMS is leaner: fewer systems, fewer roles, shorter policies. What matters is that you meet and evidence the requirements for your scope.
With the proof your most important customers require. In Europe, that is usually ISO 27001; in the USA, SOC 2. If you have both markets in view, you often start with ISO 27001 and later use the evidence for SOC 2.
Before a customer sets a fixed date. Even for a small team, it takes a few months to reach audit readiness. If you start earlier, you do not negotiate under time pressure.
As long as you do not reach the size thresholds, usually not directly. There are exceptions for certain services that are covered regardless of size. The requirements do reach you, though, through customers who are covered themselves. Clarify the classification of your case with your advisers.
Often policies, access rules, incidents in recent years, data protection, subcontractors and existing certificates. With a maintained ISMS, these documents are in one place.
You extend the scope, users and vendors and switch to a larger edition if needed. Existing evidence and tasks are kept.
14 days, full access, no payment details. Everything you set up carries over into the paid plan.
