Who issues the certificate?

An independent certification body accredited by a national accreditation body such as ANAB or UKAS issues the certificate, and this is verifiable in the public registry. QuillAudits builds and runs your ISMS and manages the audit, but never certifies its own work. That separation is what makes the certificate valid.

Which edition will we be certified against?

ISO/IEC 27001:2022. The 2013 edition is no longer available for new certifications. This means your ISMS covers the 93-control Annex A, the 11 controls added in 2022, and the 2024 amendment's context requirements in Clauses 4.1 and 4.2.

We hold customer keys. How does the ISMS handle that?

Key management becomes a dedicated risk and control domain covering generation ceremonies, key segregation, signing quorums, and compromise protocols. We benchmark these controls against ISO/TR 23576 for custodians and CCSS wherever customer keys are held.

We also need SOC 2. Do we run two programs?

No. The ISMS and the SOC 2 control base overlap significantly, so we build the controls once and map them to both frameworks. The second credential adds incremental evidence and audit logistics rather than a second program.

What does maintaining the certificate involve?

Maintaining certification requires annual surveillance audits by the certification body and a full recertification in year three. Between audits, we keep the ISMS audit-ready through scheduled internal audits, management reviews, and evidence maintenance.

TVL Protected: $3B+Projects Secured: 1500+Years in Web3 Security: 7+

ISO 27001 Consulting and Certification Readiness for Web3

ISO/IEC 27001 is an international information security management standard. Certification can provide recognized evidence of a governed information security program. We build an ISMS around how a Web3 organization actually operates, then prepare you for accredited certification.

We respond within 24 hours

Why Web3 Companies Pursue ISO 27001 Certification

Certification to ISO/IEC 27001:2022 demonstrates that your organization operates an information security management system that has been independently assessed. For Web3 businesses expanding across borders, it is the credential that travels.

Licensing and Regulation

Regulated markets start from an ISMS.

Crypto licensing regimes, including EU CASP authorization, VARA in Dubai, and ADGM in Abu Dhabi, require demonstrable, governed information security. A certified ISMS is the evidence base those applications are built on.

International Procurement

The certificate partners recognize everywhere.

Where SOC 2 dominates North American diligence, ISO 27001 is the reference credential across Europe, the Middle East, and Asia, accepted by exchanges, banking partners, and enterprise buyers without translation.

Web3 Context

An ISMS that speaks key management.

Your riskiest assets are signing keys, upgrade authorities, and validator infrastructure. We build the risk register, Statement of Applicability, and controls around that reality, not a generic IT template.

What Our ISO 27001 Consulting Services Include

ISO 27001 consulting from ISMS build to certification. QuillAudits designs and implements the management system, runs the internal audit, and manages the certification audit. The certificate itself is issued by an independent accredited certification body from our partner network. That separation is what the scheme requires, and we run the full handoff.

01 / ISMS Build

A management system that fits.

Clauses 4-10, built around your operation.

Scoping and context analysisISMS scope drawn around the systems your counterparties care about, including the 2024 amendment's context requirements
Risk assessment and treatmentA risk register that includes on-chain threats, key compromise, and validator failure, not only phishing and lost laptops
Annex A implementation: 93 controls, 2022 editionStatement of Applicability built around your custody model and cloud stack, with the 11 new 2022 controls covered
Web3 control overlaysCustody controls aligned to ISO/TR 23576, governance to ISO/TS 23635, and CCSS where customer keys are held

Milestone: an operating ISMS with policies adopted, risks treated, controls running, and evidence flowing.

02 / Certification Support

Through Stage 2, to the certificate.

We manage the accredited audit through certificate issuance.

Internal audit and management reviewThe Clause 9 requirements every certification audit checks first, run by assessors independent of the implementation team
Accredited certification body selectionANAB/UKAS-accredited bodies from our partner network, pre-qualified for digital-asset clients and verifiable in the public registry
Stage 1 and Stage 2 audit managementDocumentation review, implementation audit, findings triage, and corrective actions, managed through to certificate issuance
Surveillance and recertification cycleAnnual surveillance audits and the year-three recertification, with continuous evidence maintenance in between

Deliverable: an ISO/IEC 27001:2022 certificate issued by an independent accredited certification body, maintained on its three-year cycle.

ISO 27001 Certification Process and Related Standards

Extensions layer onto the same ISMS, so each additional credential is an increment, not a new program.

Standard	What it adds	Best for	Outcome
ISO/IEC 27017	Cloud-specific security controls layered on your ISMS.	Exchange, RPC, or indexing infrastructure on AWS, GCP, or Azure.	Certifiable extension
ISO/IEC 27018	Protection of personal data processed in public clouds.	Platforms holding KYC data and user PII.	Certifiable extension
ISO/IEC 42001	AI management systems for how you govern AI development and deployment.	DeFAI products, AI trading agents, AI risk engines.	Certifiable
ISO 22301	Business continuity management systems.	Custodians and validators with hard uptime and recovery obligations.	Certifiable
CCSS	CryptoCurrency Security Standard for key generation, storage, usage, and compromise protocols.	Wallets, exchanges, any system holding customer keys.	Assessed Levels I-III

Timeline, Deliverables and Ongoing Maintenance

A named engagement lead, a shared evidence workspace, and a fixed-milestone plan after the gap assessment. No open-ended consulting meter.

01 / Scope

Draw the boundary.

Free scoping call. We map your services, custody model, and jurisdictions, and draw an ISMS scope your counterparties will accept.

02 / Assess

Find the gap.

Gap assessment against Clauses 4-10 and Annex A. You get a control matrix, maturity score, and prioritized roadmap at a fixed budget.

03 / Build

Stand up the ISMS.

Risk assessment, Statement of Applicability, policy pack, and control implementation with your engineers, including Web3 overlays.

04 / Prove

Operate and audit.

The ISMS runs; we perform the internal audit and management review, close corrective actions, and QA the evidence for Stage 1.

05 / Certify

Pass Stage 2.

The accredited body audits; we manage findings to closure and certificate issuance, then run the surveillance cycle with you.

Frequently Asked Questions

Certification typically takes 4 to 8 months from kickoff to certificate, depending on scope and starting maturity. The gap assessment and ISMS build come first, followed by the Stage 1 and Stage 2 audits. You receive a fixed-milestone plan after the gap assessment, not a drifting estimate.

A regulator or partner just asked for your ISO 27001? Let's get you certified.

Tell us who is asking and leave with a recommended ISMS scope, a realistic timeline, and a clear picture of your gap, whether or not you engage us.

We respond within 24 hours

QuillAudits provides ISO/IEC 27001 readiness, implementation, and audit-support services. Certification audits are performed and certificates issued by independent, accredited certification bodies.
Related frameworks: SOC 2 Type II Readiness · NIS2 Readiness

Related QuillAudits services