ISO/IEC 27001 for US MSPs and IT Services Firms: What Clients Require

• Done for you, end to end

  We write the policies, set up the controls and evidence, run the internal audit and coordinate the independent audit. You deal with one team from first call to final report.

• Simple and quick

  A free gap assessment, then one plan with dates from day one. Effivity, our GRC automation platform, is included to keep the evidence moving.

• 8,100+ client engagements

  In 60+ countries over 20+ years, with experts who bring 30+ years of experience.

• Under US$10,000, all-inclusive

  For most start-ups and SMEs: SOC 2, ISO 27001, ISO 42001, HIPAA or ISO 9001, including the independent audit. A fixed quote follows a free gap assessment.

Every Sterling consulting engagement comes with the following, so you are not buying extras to get to the finish line:

• Effivity, Sterling's GRC automation platform, with a full-year subscription, to run your controls, evidence, tasks and audits in one place.
• Sterling Academy: preferential course access, with complimentary awareness training for your people.
• Internal auditor training for your audit team, as applicable to your standard.
• For information-security engagements, a vulnerability assessment.

These are part of the engagement, not a separate purchase. The details depend on the standard you are working toward, which we confirm during the free gap assessment.

Consulting and auditing are always separated: the people who consult never audit you. That keeps your internal audit objective and protects the independence of the CPA firm, Qualified Security Assessor or certification body that performs the final step.

Behind this are 8,100+ client engagements in 60+ countries over 20+ years, led by experts with 30+ years of experience.

What the fee covers, and what it doesn't:

• It is the fee for your first SOC 2 report or your first certification only.
• Annual work is always additional and billed the following year: later SOC 2 report periods, and ISO surveillance and recertification audits.
• It assumes a typical start-up or SME scope: one product or service and one main location.
• Larger or multi-site scopes get a fixed quote after the gap assessment.
• PCI DSS is quoted separately: a fixed quote follows a free gap assessment.

^[1] Occupational Employment and Wage Statistics, May 2025: 15-1212 Information Security Analysts, national annual median wage. US Bureau of Labor Statistics. accessed October 23, 2026.

The outcome: one certificate, issued by an accredited certification body, that answers the security section of most customer reviews, so your sales engineers stop rebuilding the same evidence pack for every renewal. We do the preparation; the accredited body audits you and decides on the certificate.

No US statute names ISO/IEC 27001^[1]. The pressure reaches you because your US clients carry their own duties over the vendors who run their systems, and an MSP holding administrator rights is the first vendor they look at.

• US lenders, brokers and other FTC-regulated financial firms. The FTC Safeguards Rule requires these institutions to select service providers capable of appropriate safeguards, to require those safeguards by contract, and to assess providers periodically based on the risk they present^[2]. A provider with access to their customer information is in that circle^[2].
• US public companies. Item 106 of Regulation S-K has registrants describe how they manage material cybersecurity risks, including, as applicable, whether they oversee risks from their use of third-party service providers^[3]. Their vendor teams turn that into questions for you.
• Multinational clients and overseas parents. In Sterling's experience, groups headquartered in Europe and Asia write ISO 27001 into supplier policy, and their US subsidiaries pass the condition to local IT providers.

The outcome: a scope statement that matches the managed services your US clients actually sign for, so a reviewer reading the certificate sees their own contract in it.

• Service lines. Managed endpoints, help desk, network and cloud administration, backup, co-managed security.
• Delivery tooling. Remote monitoring and management, PSA and ticketing, remote-access tools, scripting, the credential vault.
• Your own IT. Identity provider, laptops, mail, file storage and the hosting accounts behind your platforms.
• People and places. Offices, technicians working from home in several states, and any offshore or nearshore delivery center.

Your clients' systems sit outside your management system. Your access to them sits squarely inside it, and the risk assessment treats that access as the headline risk. We fix the boundary at the gap assessment, before any auditor sees it.

The outcome: the areas where reviewers dig hardest are evidenced before the audit. These are Sterling's own descriptions, not a quotation of the standard's control list.

1. Privileged access to client environments. Named accounts, multi-factor sign-in, approval and logging for elevated sessions, and quarterly proof that leavers lost access. 2. Separation between clients. One client's scripts, credentials and documentation are unreachable from another's tenant in your tools. 3. Change control on your tooling. A bad RMM policy or script push reaches every client at once, so it is reviewed and recorded. 4. Suppliers. Tool vendors, hosting providers and staffing agencies assessed before use and checked afterward. 5. Incidents and client notice. A tested route for telling each client quickly, and records from real events or exercises. 6. Service desk continuity. How support carries on if your main site or platform is lost.

Around these sit the management-system disciplines: a Statement of Applicability with a reason for every choice, internal audit and management review.

The outcome: we clear these before the certification body arrives.

• A certificate narrower than the sales pitch. If your website sells round-the-clock managed security and the scope covers only back-office IT, buyers notice.
• Policies the help desk has never seen. Auditors interview technicians, not just managers.
• Night-shift and agency staff left out. Anyone holding client credentials is in scope in practice.
• A copied risk register. Each risk needs an owner, a decision and a control that fits a services business.
• Treating year one as the finish. Surveillance audits follow, and records must stay current between them.

If your US buyers also name SOC 2, plan the two together: much of the evidence carries across, and our comparison guide shows how to choose the order.

The outcome: a certificate on schedule, with the work done for you. Sterling's record is 100% success and on-time completion across 8,100+ client engagements in 60+ countries over 20+ years, led by experts with 30+ years of experience. The people who consult never audit you, and Sterling does not certify.

1. Free gap assessment. We map your services, tools and current practice, propose a scope and rank the gaps. 2. Design. We write the risk method, Statement of Applicability, policies and procedures around your service desk and staffing model. 3. Evidence. Your team runs the system and real records build up: access reviews, supplier checks, incident logs, training. Effivity, our GRC automation platform, holds the registers. 4. Internal audit and management review. We test the system first and close findings. The vulnerability assessment included in every information-security engagement gives you a technical view of exposure as well. 5. Certification body audit. You choose an accredited body; we coordinate the audit, prepare your technicians for interviews and support you to the decision.

Want a dated plan for your firm? Select Get started and a Sterling expert will reply.

ISO management system standards such as ISO/IEC 27001, ISO/IEC 42001 and ISO 9001 are certified by an accredited certification body, not by a consultant^[1]. Sterling never certifies. The certificate carries the name of the body that issued it, and that independence is what makes it credible to your buyers.

What Sterling does is prepare your company so that the certification body's audit goes smoothly. We coordinate:

• a gap assessment against the standard;
• the management system itself: scope, risk assessment, policies, procedures and records, sized for your company;
• training for your people and an internal audit before the certification audit;
• management review and corrective actions;
• the certification audit process, from choosing an accredited body to closing any findings.

Consulting and auditing are always separated. The people who consult never audit you, so the internal audit is a genuine test and the certification body's audit is independent.

Sterling has completed 8,100+ client engagements in 60+ countries over 20+ years, and our experts bring 30+ years of experience.

^[1] About the IAF MLA (multilateral recognition arrangement). International Accreditation Forum (functions transferred to Global Accreditation Cooperation Inc., 1 Jan 2026). accessed October 23, 2026.

• ISO/IEC 27001: standard overviewStandard overview
• Meet US Contract, MSA and RFP Compliance Clauses FastUnited States
• ISO 27001 Timeline for US Companies: How Long Certification TakesUnited States
• SOC 2 vs ISO 27001 for US Companies: Which to Start WithUnited States
• SOC 2 for US MSPs and IT Services Firms: What Buyers RequireUnited States
• PCI DSS for US MSPs and IT Services Firms: What Merchant Clients RequireUnited States
• Sterling in the United StatesUnited States

1. ISO/IEC 27001:2022, Information security, cybersecurity and privacy protection, Information security management systems, Requirements. ISO. accessed October 23, 2026.

2. 16 CFR Part 314, Standards for Safeguarding Customer Information (Safeguards Rule), sections 314.1, 314.2(s) (service provider) and 314.4(f) (oversee service providers). eCFR (Office of the Federal Register). accessed October 26, 2026.

3. 17 CFR 229.106 (Item 106 of Regulation S-K), Cybersecurity, paragraph (b)(1)(iii). eCFR (Office of the Federal Register). accessed October 26, 2026.

The information on this page is provided for general informational purposes only. It is not legal advice, and it is not a substitute for advice from a qualified attorney about your own situation.

Requirements depend on your scope, your customers' contracts, your industry and the regulations that apply to you. Two companies asking for the same standard can have very different obligations. We confirm yours during a gap assessment, and we update our content as standards change, but you should check the current text of any standard or rule that matters to you.

Sterling consults and prepares. It does not decide whether you meet a standard. That decision belongs to the independent party that performs the final step: the US-licensed CPA firm for a SOC 2 report, the Qualified Security Assessor or acquirer for PCI DSS, and the accredited certification body for ISO certificates. Timelines and outcomes depend on your readiness and on those parties.

Standards and marks named on this site belong to their respective owners.