ISO/IEC 27001 Information Security Management
ISO/IEC 27001 is the international standard for information security management systems (ISMS). It complements ISO/IEC 42001 (AI management systems) and is often held by AI governance vendors as a baseline information-security certification. Required by many enterprise procurement processes globally.
This is an attestation a vendor obtains for its own operations — it is distinct from the AI-specific obligations the vendor’s tooling can help you meet. Vendors hold this certification or they don’t; we don’t use partial-coverage tiers here.
Standard owner
International (ISO)
Typical certification cycle
See overview
Penalty for misrepresentation
Loss of certification; legal exposure
Vendors that hold ISO 27001
Vendors below have a current third-party attestation against this standard. We list the certification, not coverage levels.
3 vendors
| Vendor | HQ | Founded | Size | Pricing | Coverage | Last checked |
|---|---|---|---|---|---|---|
| Scrut Automation | Palo Alto, United States | 2021 | 51-200 | Contact for pricing | Certified | Sep 21, 2026 |
| TrustArc | Walnut Creek, United States | 1997 | 501-1000 | Enterprise subscription; contact sales for quote; modular pricing based on scope and modules | Certified | Sep 21, 2026 |
| Harmonic Security | London, United Kingdom | 2023 | — | Three packages, Explore, Guide and Command (marked most popular), are listed on Harmonic's pricing page without prices; the page offers a demo. AWS Marketplace lists "Harmonic Security - Explore" at $163.00 per user per year on a 12-month contract, with a 200-user minimum and private offers for custom quotes. | Certified | Oct 15, 2026 |
Platforms that help you achieve ISO 27001
Products that document support for running a ISO 27001 program (evidence, controls, auditor workflows). This is product coverage, not the vendor’s own certification. Sorted by coverage level.
11 platforms
| Vendor | HQ | Founded | Size | Pricing | Coverage | Last checked |
|---|---|---|---|---|---|---|
| Hyperproof | Bellevue, United States | 2018 | — | No public prices or plan names on its pricing page; quoted on request. The AI-native third-party risk product includes a baseline of AI credits, with more sold at discounted tiers. | Comprehensive | Oct 15, 2026 |
| Secureframe | San Francisco, United States | 2020 | 201-500 | Three plans: Fundamentals (starting at $7,500/year, one compliance framework), Complete (quote only; adds advanced versions of third-party risk, risk management, user access reviews, Trust Center and questionnaire automation, plus SSO/SCIM and custom integrations) and Defense (quote only; CMMC tooling such as SSP and POA&M). Additional workspaces are an add-on. | Comprehensive | Oct 15, 2026 |
| Sprinto | India | 2020 | — | No public prices. Three plans (Foundation, Growth, Platform) are quoted by sales. Foundation includes 25+ automated frameworks, 20 AI-powered security questionnaires a year and an AI systems inventory. Add-ons include additional frameworks, AI Governance, Enterprise Risk Management, Enterprise Trust Management and Enterprise Vendor Risk Management. | Comprehensive | Oct 15, 2026 |
| Thoropass | New York, United States | 2019 | — | No public prices or plan tiers. Services (Thoropass Audit, Audit-Ready Pentesting, Vulnerability Scanning, Compliance Suite) are sold on a tailored quote. | Comprehensive | Oct 15, 2026 |
| Drata | United States | 2020 | — | GRC plans (Foundation, Advanced, Enterprise) and Assurance plans (Trust Center and questionnaires) are quoted; drata.com shows no prices. Its AWS Marketplace listing charges a $25,000 platform fee for a 100-FTE organization plus $7,500 per framework, for a 12-month contract. | Comprehensive | Oct 15, 2026 |
| Vanta | San Francisco, United States | 2018 | 501-1000 | Four plans: Essentials, Plus, Professional and Enterprise. No prices on vanta.com; its AWS Marketplace listing gives 12-month starting prices for 1-20 employees: Essentials $14,000, Plus $21,500, Professional $23,000. Enterprise is quoted. Third-party risk management is a separate product ($13,600 a year for up to 50 vendors on AWS). | Comprehensive | Oct 15, 2026 |
| QL Security | United Kingdom | — | — | Contact for pricing | Partial | Sep 21, 2026 |
| PrivacyScrubber | United States | — | — | Contact for pricing | Partial | Sep 21, 2026 |
| SetAIComply | European Union | — | — | Contact for pricing | Partial | Sep 21, 2026 |
| Naaia | Louveciennes, France | 2021 | 11-50 | No public pricing tiers; demo and quote requested via website. | Adjacent | Sep 21, 2026 |
| Nightfall AI | San Francisco, United States | 2018 | — | Two packages, priced per user per year: Foundation Edition (DLP across SaaS, email, AI apps and endpoints, with real-time blocking) and Premier Edition (adds AI agent security: hooks for Cursor, Claude Code and VS Code, MCP discovery, Claude Cowork and Claude Enterprise monitoring, SIEM export), offered as Tier 1 (up to 3 apps) or Tier 2 (all supported apps). The pricing page shows no amounts; it says final pricing depends on user count and data volume and offers a free 7-day proof of value. Each user license covers two endpoint devices. Data Discovery and Classification is an add-on with 150 GB included and paid 1 TB, 3 TB, 5 TB and 20 TB packs. | Adjacent | Oct 15, 2026 |
Compare across industries
See which vendors support ISO 27001 in your sector.
Last reviewed April 24, 2026. Informational summary only — not legal advice. Consult qualified counsel for specific obligations.