The ISO Quote

A fintech founder called me.

Their legal team had recommended ISO 27001 certification. Their security vendor had confirmed it. The quote came in at $40,000.

I ran the diagnosis.

ISO 27001 was 18 months from being relevant to that company. Their vendor didn't mention that.

That is a claim about timing, not about maturity. A certification becomes worth buying when something outside the company starts requiring it. A customer contract that names it. A procurement process that gates on it. A regulator that asks. The eighteen months was an estimate of when one of those would arrive. Until it does, what you have bought is a document. The work underneath it may well be worth doing, and that is a separate purchase at a separate price.

What we found instead

• Three gaps that actually mattered. None of them on the vendor's roadmap.
• A misconfigured access control that had been live for 14 months.
• A vendor integration with no data-handling agreement.
• A gap in incident response that would have taken two weeks to fix.
• Six things they had been paying for with no relevance to their stage, size, or threat profile.
• A SOC retainer sized for a 500-person company.

None of those were exotic. Most were configuration and one was paperwork. A certification programme would have reached them eventually, on a schedule set by the audit rather than by the exposure.

The $40,000 project became a $15,000 targeted sprint.

The saving was not really the point. The sequence was. The same money went to the things that were exposed, in the order the exposure justified. Not in the order an audit checklist happens to run.

Before you sign a certification quote

• Name the customer, contract or regulator that requires it. If you cannot name one, you are buying against a hypothetical.
• Ask what the scope excludes. You define the scope yourself, and it is often narrower than whoever approves the budget assumes.
• Ask what happens to the findings if the audit raises major nonconformities. A programme with no answer is selling the certificate rather than the posture.
• Price the alternative: the same money against whatever is most likely to be exploited this year.

ISO 27001 is a real framework. It is also frequently sold to companies that do not need it yet. Because it is the most expensive, most recognized, and most marketable thing a security vendor can propose.

The incentive does not have to be cynical to work. A vendor is asked what would improve the company's security posture. They answer honestly, with the largest true thing they can deliver. Nobody in that conversation is paid to say: less than you think, and not yet.

I tell you what you need. Nothing more.