polara labs
Looking for SOC 2?

Get ISO 27001 compliant. Certified by an accredited certification body.

Polara takes your company from wherever it stands today to ISO 27001 ready: every Annex A control evidenced, every policy written, the management review minuted. The internal audit is performed in the platform by an independent internal auditor Polara arranges from its partner network, priced separately. The certificate comes from an accredited certification body, never from us.

Take the free assessmentWhat it costs

Start free. No payment, no card.

Made in the USA

What you get for ISO 27001.

The same platform every framework runs on, pointed at this one: your answers, your evidence, your documents.

Risk assessment and Statement of ApplicabilityThe two documents a certification body opens first. Your risks are scored and treated, and every Annex A control is marked applicable or justified as excluded.
All 93 Annex A controls, evidencedEvery control has its own page with an owner, the steps if it is not in place, and the proof that shows it is. Its status comes from that proof, never from a checkbox.
Internal audit and management reviewThe two clauses that most often stall a Stage 1 review. Both are run and minuted in the platform, so the certification body finds them already done.

Why ISO 27001 is easier here.

Specific things the platform does for you that a consultant or a template pack does not.

Bring your SOC 2 report

Upload the SOC 2 report you already have and we suggest which ISO 27001 tasks it already proves. You confirm each one, and nothing closes on its own.

Your Statement of Applicability arrives seeded

All 93 Annex A controls arrive pre-filled from your answers, with applicability and a justification each way. You confirm rows rather than authoring a 93-row spreadsheet from nothing.

Policies come from your stack

Eighteen ISMS policies drafted from your risks, tools and answers, mapped to their Annex A references, and refused when there is not enough to write from. Not a template pack with your logo on it.

The internal audit runs in the platform

Clause 9.2 usually means finding a consultant yourself. Here Polara arranges an independent internal auditor from our partner network who works your controls in a workspace built for it. Priced separately.

A handoff package a body can trust

When the package issues it is frozen and hashed, every document prints its reference, and anyone the body sends can verify it at a public URL. A folder of PDFs cannot do that.

The certificate is never taken on faith

We are not a certification body and never pretend to be. A certificate number is recorded as yours, and shown as verified only once a named person has checked it against the register.

How ISO 27001 runs here.

In this order, with the handoff to the certification body at the end.

  1. Step 1

    Scope and context

    What the management system covers, the issues inside and outside the company that bear on it, and who requires what of you. Clause 4, written once and approved.

  2. Step 2

    Risk and the Statement of Applicability

    Every risk gets an owner, a score and a treatment. All 93 Annex A controls arrive seeded from your intake answers and you confirm each one yourself.

  3. Step 3

    Policies and evidence

    Eighteen policies drafted from your stack and answers, and you read each one in full before you approve it. Proof attaches to the control it shows.

  4. Step 4

    Operate

    Objectives, competence and monitoring records, kept where the certification body will look for them.

  5. Step 5

    Internal audit and management review

    Clause 9.2 and 9.3 run inside the product: an independent internal auditor from our partner network works the controls, findings get corrective actions, management attests to the review. Priced separately.

  6. Step 6

    Package and handoff, then Stage 1 and Stage 2

    A frozen, hashed handoff package for the certification body, verifiable at a public URL. The body performs Stage 1 and Stage 2 and issues the certificate; we record it and verify it against the register.

What ISO 27001 costs.

Our figure is published. The certification body prices its own audit on your scope, so that half is quoted rather than guessed at.

$5,000 one time.

That covers the intake, the gap analysis, your policies, the evidence and the finished package.

The certification body sets and quotes its own audit fee, which you pay to them directly.

An ISO/IEC 27001 certificate is issued by an accredited certification body, and the certification audit is done by an accredited certification body that you contract and pay directly; we introduce two or three accredited bodies and help you compare quotes and book dates, and we take no referral fees.

What the certification body charges turns on your headcount and the scope you set, which is why scope is the first step here and not a formality.

Polara Labs is not a certification body. Certification audits are performed by independent accredited certification bodies.

ISO 27001 questions.

What buyers ask, and what the work actually involves.

The Polara Labs side is $5,000 one time, which covers the management system, the Statement of Applicability, the policies, the evidence and the management review. The internal audit is priced separately and arranged by Polara with an independent internal auditor from our partner network.
That is a separate engagement you contract and pay directly, and we do not publish a figure for it, because the body prices it on your headcount and scope. We introduce two or three accredited bodies that know our package and help you compare quotes and book dates; we take no referral fees and no money passes between us and any body.
No, and neither can any platform that tells you otherwise. Under ISO/IEC 17021-1 the body that certifies you cannot also have consulted for you, which is exactly why the two are separate and always will be.
SOC 2 is a report a CPA firm writes about a point in time or a period. ISO 27001 is a certificate that says you run a management system, so it carries an internal audit, a management review and annual surveillance. Buyers outside the United States usually ask for the certificate.
The readiness work is measured in weeks once your answers are in. The certification body then schedules Stage 1 and Stage 2, and their calendar is usually the longest part of the timeline.
The certificate runs three years with a surveillance audit in each of the two years between, then a full recertification. The management system keeps running in the platform, so the surveillance visits find live evidence rather than a scramble.

Unblock the deal.

Tell us where you are with ISO 27001 and we will tell you what is left.

Take the free assessmentSee every framework
polara labs

Polara Labs builds both sides of the audit: the readiness platform startups use to earn a SOC 2 report or an ISO 27001 certificate, and the practice OS audit firms use to run the examination. Every price is published on the page it belongs to.

© 2026 Polara Labs Inc. All rights reserved.Polara v4.11.0Contact: help@polaralabs.com

Polara Labs is not a CPA firm. SOC 2 examinations are performed by independent licensed U.S. CPA firms in our network; the audit opinion is theirs alone and is not regulated by Polara Labs. We generate custom policies, evidence checklists, and remediation guidance. You remain responsible for implementing controls and owning audit outcomes. Replace placeholders with your actual controls and have final documents reviewed by qualified professionals before your audit.