Blog
Practical guidance on ISO 27001, SOC 2, ISO 42001, GDPR and penetration testing for scaling software companies.
How Much Does ISO 27001 Certification Cost? The Honest Breakdown
Last reviewed 8 August 2026 by Tom McNamara. This page is reviewed quarterly; the next review is due November 2026. Market facts are date-stamped “as of 06-08-2026”. ISO 27001 certification cost is four separate lines, not one number: implementation effort, certification body fees, tooling, and your own team’s time. Published figures put certification body fees…
ISO 27001 Internal Auditors for Software Companies (UK, Ireland, Europe)
Last reviewed 8 August 2026 by Daniyah Imran. This page is reviewed quarterly; the next review is due November 2026. Market facts are date-stamped “as of 07-08-2026”. Short answer: anyone competent and demonstrably independent of the work audited can perform your ISO 27001 internal audit, your own staff, a peer arrangement, or an outsourced provider.…
Is an ISO 27001 Internal Audit Mandatory?
Last reviewed 8 August 2026 by Daniyah Imran. This page is reviewed quarterly; the next review is due November 2026. Market facts are date-stamped “as of 07-08-2026”. Clause-text notice: ISO/IEC 27001 is a paywalled standard. Clause language below is drawn from the ISO/IEC Harmonized Structure (HS) template and corroborating certification-body guidance, paraphrased and reconstructed, so…
The SOC 2 Compliance Checklist That Reflects How Audits Actually Work
Last reviewed 8 August 2026 by Tom McNamara. This page is reviewed quarterly; the next review is due November 2026. Market facts are date-stamped “as of 06-08-2026”. There is no official SOC 2 compliance checklist. The AICPA publishes Trust Services Criteria, your organisation designs controls that meet them, and a licensed CPA firm examines those…
SOC 2 Requirements, Explained: Trust Services Criteria, Controls and Evidence
Last reviewed 8 August 2026 by Tom McNamara. This page is reviewed quarterly; the next review is due November 2026. Market facts are date-stamped “as of 06-08-2026”. SOC 2 does not have a fixed requirements list. It has criteria: the AICPA Trust Services Criteria, defined in TSP Section 100 (2017, with revised points of focus…
How Much Does SOC 2 Cost? Auditor Fees, Readiness and the Real Total
Last reviewed 8 August 2026 by Tom McNamara. This page is reviewed quarterly; the next review is due November 2026. Market facts are date-stamped “as of 06-08-2026”. The real cost of SOC 2 is three separate lines, and the auditor quote is only one of them. You pay for readiness work to design and implement…
SOC 2 in the UK and Ireland: Who Does the Readiness, Who Does the Audit
Last reviewed 8 August 2026 by Tom McNamara. This page is reviewed quarterly; the next review is due November 2026. Market facts are date-stamped “as of 07-08-2026”. If you run a software company in the UK or Ireland and a US enterprise buyer has just asked for your SOC 2 report, here is the short…
ISO 42001 Internal Auditors: Who Can Audit Your AI Management System?
Last reviewed 7 August 2026 by Mahrukh Fatima. This page is reviewed quarterly; the next review is due November 2026. Market facts are date-stamped “as of 07-08-2026”. The short answer: anyone competent and independent can perform your ISO 42001 internal audit, your own trained staff, or an external party acting on your behalf. ISO/IEC 42001’s…
How Much Does ISO 42001 Certification Cost? What Is Known So Far
By Mahrukh Fatima, AI Governance Manager at Atoro. Certified Lead Auditor, ISO 42001. No one publishes a fixed ISO 42001 certification cost, because the standard is under three years old (published December 2023) and the accredited certification market around it is younger still. No certification body publishes a fixed rate card; Schellman, the first accredited…
How Many Companies Are ISO 42001 Certified?
Public announcements from certification bodies and newly certified companies suggest that only around 350 organisations worldwide held ISO 42001 certificates by spring 2026. The standard was published in December 2023, so the certified population is still small, growing fast, and heavily weighted towards technology companies. Being certified today still puts an organisation in the earliest…