knowledge

ISO 27001 Guide

ISO 9001 Guide

ISO 45001 Guide

ISO 14001 Guide

<h1>Unlock Your Business Potential</h1>
Finding your way through the ISO maze can be confusing. If you are at the start of your journey have a look at our guides for ISO 9001, ISO 14001, ISO 27001 and ISO 45001 for a comprehensive but common-sense explanation of the requirements.

SOC 2 vs ISO 27001: which framework does your business need?

How much does ISO 27001 certification cost?

Get governing your GenAI usage

Building an (ISO) Management System That Works

World Quality Week 2024!

Chris Passmore of 2SB with the F E Burman team

It’s 2SB’s 18th anniversary!

Earth Day 2024

Lick using FSC® to strengthen eco-friendly range

2SB supports local charity Dandelion Time

Today is World Mental Health Day! 

Week in the life of a 2SB consultant

It’s World Accreditation Day 2023!

TechMed achieves ISO 9001 certification

Internal Auditing Support at Tarkett

F E Burman recertified for the 3rd time

Rhino Exteriors successfully ISO 9001 recertified

It’s World Quality Week!

Seacourt success at annual ISO external audit

It’s 2SB’s 16th anniversary!

All Hands on Deck at 2SB’s Away Day

Bansal flows back to ISO

It’s World Accreditation Day!

2SB is a corporate supporter of Kent Wildlife Trust

Earth Day 2022

UK 2022 Plastic Packaging Tax: What does this mean for you?

Jacked Supplements Achieve ISO 9001

2SB away day on the Medway

Arden Lea get FSC

Xpress keeps moving forward

Burmans benefits from external certification

Standard Plant Hire delivers a high quality Service

Wilmot-Budgen working to the highest of standards

ISO System leads to Global Projects

PJ Keary achieve 100% for third year in Achilles audit

The World can dance on FSC® floors

Planet positive printer supports responsible forest management

100% remote implementation

Hughes Pumps keep up the pressure

Obart Pumps gets flexible support

Setting the Standard – 2SB Consultant Embarks on NEBOSH Diploma

Albion let UKAS accredited certification take the strain

Lucent lights up the environment

UKAS accredited certification gives confidence to clients during lockdown

Hydraulic Engineering Services achieve success under pressure

2SB recommended for continued certification to ISO 9001 & 14001

Agency making good use of their time

Is Covid-19 reportable under RIDDOR 2013?

What should I do about my ISO audit during the Covid-19 outbreak?

Coventry Scaffolding gets support from 2SB

Practical Business Continuity Planning for Covid-19

Tyk ISO 27001 Certification

ISO supporting rapid international growth

Klair Group building ISO system on sound foundations

5 tips for effective information security

Thorne revives ISO certification after nearly 25 years

2SB supports Two Sides

Barnes Offshore guards the future

Jellyfish start ISO 14001 with 2SB

ISO Success

2SBs client RAP Interiors – helping the homeless locally

Servo Connectors continues to benefit from ISO 9001:2015 training

2SB discuss ISO 27001 and Cyber Security on KMTV

2SB certified for iso-9001-14001-certification

How much does ISO certification actually cost?
This is the question almost everyone asks first, and it is also the one most consultancies are vague about. So here is a straightforward breakdown. The total cost of ISO certification depends on three things: the complexity of your organisation, which standard you are pursuing, and how much of the work you handle in-house versus with support.
For a small to mid-sized UK business, a realistic all-in cost for implementing a single standard, usually falls in the range of £3,500 to £12,000. The low end of this would be an ISO 9001, ISO 14001 or ISO 45001 implementation for a small organisation. The middle of this range would be for an ISO 27001 or ISO 42001 implementation into a startup or smaller organisation; or for an ISO 9001, ISO 14001 or ISO 45001 implementation into a mid-size business with more than one site. The top end of the price range would be for an ISO 27001 implementation into a scale up or mid-size organisation undertaking development work.
If you choose to implement multiple standards simultaneously, there are generally cost savings due to the overlap of the standards.
The external certification audit itself (conducted by a UKAS-accredited body) typically costs £2,000 to £8,000 depending on the standard and scope. Consultancy fees to prepare you for that audit are the larger variable, and they are where experience and approach matter most.
ISO 27001 tends to be the most investment-intensive of the main standards, because of the breadth of its control requirements and slightly more prescriptive nature. ISO 9001 and ISO 14001 are typically lighter, particularly for service businesses. ISO 42001 is relatively new, so the cost landscape is still settling, but for most organisations it is comparable to ISO 27001 in terms of effort.
Where costs balloon is when the process is poorly scoped at the outset, building a system that is too heavy for the organisation, or not understanding what the auditors are actually looking for. The biggest saving a consultant provides is not just the work they do, but the time and rework they help you avoid. twoSB will always give you a clear, fixed-scope quote before starting, not a number that grows as the engagement progresses.

How much does ISO certification cost?

The honest answer is between three and twelve months for most organisations, depending on the standard, your starting point, and how much resource you can commit to the process.
ISO 9001, ISO 14001 and ISO 45001 typically takes three to six months to implement for a small to mid-sized business starting from scratch, less if you already have documented processes in place.
ISO 27001 usually takes three to six months to implement and a further 6 weeks to certify. We find many startups require ISO 27001 in very short timeframes. We can compress our implementation into 2.5 months with the external audit process condensed to a further 4-5 weeks. (Note: If you are receiving quotes that say implementation and certification can be completed faster than this, we would suggest questioning whether this is really achievable).
ISO 42001 is would typically require 3 to 6 months to implement and a further 6 to certify, however like with ISO 27001 a slightly more concentrated timeframe can be achieved.
If you are pursuing multiple standards simultaneously, the timeline does not simply multiply. Because all four standards share the same High Level Structure, the foundational work (context of the organisation, risk assessment, leadership commitment, objectives etc.) is done once and applies to all.
twoSB will plan a realistic timeline as part of initial scoping, based on what we find in your business however some representative timeframes for the implementation period are:
<ul>
<li>ISO 9001 – 2 to 6 months</li>
<li>ISO 14001 – 2 to 6 months</li>
<li>ISO 27001 – 3 to 6 months</li>
<li>ISO 42001 – 3 to 6 months</li>
<li>ISO 45001 – 2 to 6 months</li>
<li>ISO 9001 + ISO 14001 – 3 to 8 months</li>
<li>ISO 9001 + ISO 27001 – 4 to 8 months</li>
<li>ISO 9001 + ISO 14001 + ISO 45001 – 5 to 9 months</li>
<li>ISO 9001 + ISO 14001 + ISO 27001 – 5 to 9 months</li>
</ul>
The timeframes above cover the implementation. You will require an additional 4-6 weeks for certification, to cover the stage 1 and stage 2 audit, with a mandatory gap in between.
The single biggest variable is internal resource. Certification requires your team&#8217;s involvement in context-setting, process documentation, internal audits, and a management review before the external audit. Businesses that treat this as an add-on to someone&#8217;s existing workload tend to take longer. Those that assign clear ownership and protected time move through it much more quickly.

How long does it take to get ISO certified?

<div class="content-area up-down small">
<div class="grid-container">
<div class="grid-x grid-padding-x">
<div class="cell">
<div class="cms-block">
A certification body is an independent third-party business that employs competent auditors who can conduct external audits on your business. They will visit and audit your business to check for compliance against the <a href="https://www.iso.org/home.html">ISO</a> standard(s). Some certification bodies specialise in certain industries, some have international reputations, and some are more competitively priced than others.
If you’re looking to be certified in an ISO standard, we strongly recommend selecting a certification body that has been accredited by <a href="https://www.ukas.com/">UKAS</a>. UKAS is the sole national accreditation body for the UK and is recognised by the UK Government. UKAS conduct very thorough annual external audits of all UKAS accredited certification bodies to ensure that they are allocating the correct number of days to each client audit and are using auditors with good knowledge of the market in which you operate. Most larger businesses and government departments require suppliers to have UKAS accredited certification since they know that UKAS accredited audits are conducted properly, and will not recognise ISO certificates from non-UKAS accredited certification bodies.
There are around 100 certification bodies who are accredited by UKAS and we can help you complete the necessary documentation that they need to get you a price. You can browse UKAS accredited organisations in their directory: <a href="https://www.ukas.com/find-an-organisation/">https://www.ukas.com/find-an-organisation/</a> All certification bodies should do a similar job, however like with anything, the level of service given can vary.
Costs for certification also vary from certification body to certification body. While cost shouldn’t be the sole determining factor, it is still important to compare the pricing structures of different certification bodies. Ensure you understand what is included in the cost and any additional charges that may apply. You should always get the costs for a three year cycle of audits so that you can get a full comparison.
twoSB are consciously not affiliated with any certification body so we can help you select the right certification body to use for your business.
Some popular ISO certification bodies include:
<ul>
<li><a href="https://isoqar.alcumus.com/">Alcumus ISOQAR</a></li>
<li><a href="https://auvacertification.com/">Auva</a></li>
<li><a href="https://www.british-assessment.co.uk/">BAB</a></li>
<li><a href="https://www.bmtrada.com/">BM Trada</a></li>
<li><a href="https://www.bsigroup.com/">BSI</a></li>
<li><a href="https://www.bureauveritas.co.uk/">Bureau Veritas</a></li>
<li><a href="https://www.dnv.com/">DNV</a></li>
<li><a href="https://www.lrqa.com/en-gb">LRQA</a></li>
<li><a href="https://www.nqa.com/en-gb">NQA</a></li>
<li><a href="https://www.sgs.com/">SGS</a></li>
<li><a href="https://www.dnv.com/">TUV</a></li>
</ul>
</div>
</div>
</div>
</div>
</div>
<div class="content-area">
<div class="grid-container">
<div class="grid-x grid-padding-x"></div>
</div>
</div>

How do I choose an ISO certification body?

The ISO assessment process can be quite confusing. Understanding the difference between <a href="/faqs/what-is-iso-who-are-ukas-what-are-certification-bodies/">ISO, UKAS (the national accreditation body) and the certification bodies</a> is the first step:
ISO
ISO is the International Organisation that writes standards for many different industry sectors. <a href="/services/iso-9001/">ISO 9001</a>, <a href="/services/iso-14001/">ISO 14001</a>, <a href="/services/iso-27001/">ISO 27001</a> and <a href="/services/iso-45001/">ISO 45001</a> are some of the best known but there are over 22,000 different ISO standards to date. ISO will review standards and issue updates, and write new standards where there is a need. It sits right at the top.
UKAS
ISO write the rules, but it is <a href="https://www.ukas.com/about/working-with-business/" target="_blank" rel="noopener">UKAS</a> who oversees them at the highest level in the UK. UKAS is the sole national accreditation body for the UK and is recognised by government. UKAS visit certification bodies to ensure that they and their assessors are performing to a sufficiently high level. Certification bodies seek to get accreditation from UKAS to demonstrate their competence. If you&#8217;re looking to be certified in an ISO standard, we suggest you choose a certification body that has been accredited by <a href="https://www.ukas.com/about/working-with-business/" target="_blank" rel="noopener">UKAS</a>. Some certification bodies are not UKAS accredited and may not always demonstrate full compliance to the ISO standard.
Certification Bodies
The next step down is the Certification Bodies (DNV, NQA, ISOQAR, BSI, SGS, etc). A certification body is an independent third party that can conduct external audits on your business. They will visit and audit your business to check for compliance against the ISO standards. Some certification bodies specialise in certain industries, some have international reputations, some are more competitively priced than others. There are around 100 certification bodies who are accredited by UKAS and it is up to your business who you ask to assess your ISO system. All certification bodies should do a similar job, however like with anything, the type of service given can vary. twoSB can help you select the right body to use for your business (and are not affiliated with any certification body).
Consultants
Consultants (like twoSB) are used to help guide businesses implement management systems. They understand the standards needed to achieve certification but also look to add value to your business. It is possible for a business to successfully gain certification without the use of consultants however it can require considerable internal resources. Consultancies possess the experience, knowledge and training that can streamline the process and provide cost effective guidance as well as bring added value to your systems.

What is ISO? Who are UKAS? What are certification bodies?

Documentation requirements vary depending on which standards you are implementing. Contrary to popular opinion, ISO systems do not need to be heavily documented.
Each standard has specific requirements for certain items to be documented to ensure that you are able to meet the requirements of the standard. Other clauses in standard may not require documentation, but its easiest to prove that its being done if its documented.
We can advise you on exactly what documentation is required and how to structure and record it.

How much do I need to document for ISO certification?

Yes. We have conducted an analysis against our client base, and the average size of organisation to pursue certification is 15 personnel (although this does differ by sector). There is however a wide range within this figure, and twoSB have undertaken implementations for teams of 2 up to teams of 300.
ISO standards explicitly apply to organisations of any size, and the requirements are intended to be proportionate to the complexity and scale of your operations. A management system for a 12-person consultancy should look fundamentally different from one designed for a 500-person manufacturer. A good consultant will build something that reflects your business, not a template scaled down from a larger one or up from a smaller one.
The &#8216;is it worth it for a small business&#8217; question is really a commercial question. If you are in a market where clients ask for certification, or where you want to compete for contracts that require it, then yes, unambiguously. If you are in a market where your customers are individuals or smaller businesses that have never asked for it, the calculation is different and worth having an honest conversation about.
The operational benefits of going through the process are often most visible in smaller organisations, or in growing organisations that need to formalise a particular aspect of their operations (e.g. information security). Many SME founders describe the process as the first time they have properly documented how their business works and the value of that goes well beyond the certificate itself.

Can a small business get ISO certified? Is it worth it for an SME?

The certification audit is conducted in two stages by an independent, UKAS-accredited certification body, an organisation completely separate from your consultancy. The separation matters as no single organisation can act as both your consultant and your certifier, which is what gives the certification its credibility.
Stage 1 is the first part of the audit. It is a documentation review, often called the &#8216;readiness review&#8217; or &#8216;desktop audit&#8217;. The auditor reviews your management system documentation &#8211; your policies, procedures, risk assessments and supporting records, to confirm that what you have built on paper meets the requirements of the standard. They will flag any gaps and areas of concern before the Stage 2 audit. For most organisations and standards this takes one to two days. A typical question may be “Have you got a risk register and a documented risk procedure” – but the auditor will not be looking in depth at the actual detail in the risk register – at this point they just want to know you have one and it looks sensible at a high level.
Stage 2 is the implementation audit, and it is where your management system is tested in practice. The auditor will interview your team, observe your processes, and examine objective evidence that your controls are actually working day-to-day in practice and not just in theory. They will be comparing how you operate in relation to the ISO standard, your own documented processes and to prevailing legislation (where applicable). Stage 2 typically takes one to six days depending on the standard, your scope, the number of sites and size of your organisation.
If the auditor finds minor nonconformities during Stage 2, areas where the evidence does not fully meet the standard, you will normally have a defined period (typically 90 days) to provide explanations of how these will be closed out before certification is confirmed. Major nonconformities normally require a follow-up visit, but a good consultant should help you avoid these! twoSB prepares clients thoroughly for both stages, including running internal audits and a management review beforehand, so the external audit holds no surprises.

What does the ISO certification audit actually involve? What should I expect?

ISO certification is not a one-off event but is instead a three-year cycle. Once you receive your certificate, you are committed to demonstrating that your management system continues to operate effectively through a programme of surveillance audits and, at the end of the cycle, a full recertification audit.
In years one and two, the certification body will conduct annual surveillance audits. In theory, these are slightly lighter-touch than the original Stage 2 audit and focus on pre identified elements of your management system rather than a full review. Their purpose is to confirm that the system is being maintained, that corrective actions from previous audits have been addressed, and that the system is evolving as your business changes. An ISO management system however isn’t about scraping through an external audit each year, and you should be maintaining every element of your system the whole time. Although the auditor may not plan to look at a specific process or clause in a surveillance audit, due to the interconnected nature of systems, anything is really fair game to be audited. We suggest treating every audit the same, making sure you feel prepared, but ultimately aiming to create a living management system that runs continuously, audit or no audit.
Year three brings the recertification audit, which is closer in scope to the original Stage 2. This is a comprehensive review of the entire management system, confirming that it still meets the requirements of the standard and that it has been continually improved over the certification cycle. Passing this resets the three-year clock.
External audit aside, maintaining a good management system involves running your internal audit programme, holding regular management reviews, keeping processes and documentation current as your business evolves, progressing your objectives, treating risks, dealing with nonconformities and corrective actions, and a range of other tasks. We encourage organisations to maintain as much of this in house as possible, but consultants are typically be involved in helping with internal auditing and other key touch points to help you keep discipline in your system. Having external support available when things change (new services, new geographies, new regulations) can be useful, and ultimately we all benefit from a constructive external voice from time-to-time!

Once we are ISO certified, what ongoing support, maintenance and surveillance do we need?

The ongoing cost of ISO certification is made up of two components: the external surveillance audit fees paid to your certification body, and any internal or consultancy resource you use to keep the management system in good shape between audits.
On the external audit side, ISO certification runs on a three-year cycle. In years one and two, your certification body will conduct annual surveillance audits. These are focused reviews of specific parts of your management system, shorter than the original Stage 2 audit, and typically cost between £1,200 and £3,500 per year depending on the standard and the size of your scope. In year three, you will need a recertification audit, which is a more comprehensive review of the full management system. Recertification audits are broadly comparable in cost to the original Stage 2 audit, typically £2,000 to £6,000.
The standards that cost more to implement also tend to cost more to maintain. ISO 27001 and ISO 42001 surveillance audits typically run at the higher end of that range because the scope of auditable controls is broader. ISO 9001 and ISO 14001 audits tend to be at the lower end, although for medium size organisations with multiple sites, more time is naturally required. If you hold multiple standards under an integrated management system, most certification bodies will conduct combined surveillance audits rather than separate ones for each standard.
Companies often keep some consultant support to help them maintain discipline in the system, evolve it as organisation changes and to conduct internal audits. This means running your internal audit programme, completing a management review at least once a year, updating policies and risk assessments when your business changes, and ensuring your team is following the processes they were trained on. The amount of support varies (for example some companies take on consultants in a fractional role) however annually support could be in the range of £1,200 to £5,000+ depending on the level of involvement and the size of the organisation. Small organisations and startups with one standard would be towards the lower end &#8211; organisations with multiple standards would be at the higher. twoSB offers a flexible support for clients who want that reassurance without committing to a fixed contract. No two organisations support needs are the same so we suggest speaking to us to discuss this further.

How much does ISO certification cost to maintain each year?

An Integrated Management System (IMS) is a single, unified management system that meets the requirements of two or more ISO standards simultaneously. Rather than building and maintaining separate systems for quality, environment, and information security (for example), an IMS consolidates the shared elements like leadership commitment, context of the organisation, risk management, objectives, internal audits and management review, into one framework, with standard-specific requirements layered on top.
This is possible because ISO 9001, ISO 14001, ISO 45001, ISO 27001, and ISO 42001 all follow the same High Level Structure (sometimes called Annex SL). The clause numbering and the core requirements are intentionally aligned so that organisations pursuing multiple standards do not have to reinvent the wheel for each one. Once the foundational elements are in place, adding a second or third standard becomes a matter of addressing the specific requirements unique to that standard, not starting from scratch.
There are practical benefits. A combined implementation typically costs less than pursuing standards sequentially. Less duplication in documentation, fewer consultancy days, and the possibility of combined certification audits that reduce time spent with external auditors. Ongoing maintenance is also more manageable with one integrated system than with multiple separate ones sitting in silos.
For businesses that want multiple certifications, twoSB generally recommends scoping the integration from the start (although this should be considered on a case-by-case basis), even if you plan to stagger the actual certification dates. Building the shared foundations correctly the first time makes each subsequent certification faster and cheaper. We will always be transparent about whether an integrated approach makes sense for your organisation, and what it saves you compared to doing each standard in isolation.

What is an Integrated Management System, and can we pursue more than one ISO standard at the same time?

For most UK businesses, ISO certification is not a legal requirement. There is no statute that requires you to hold ISO 9001, ISO 14001, ISO 27001, or ISO 42001 as a condition of operating. The decision is commercial rather than legal.
The question to ask is not &#8216;do I have to get it?&#8217; but &#8216;what am I unable to do without it?&#8217;. For many businesses, the answer to that second question is growing. Public sector tender frameworks frequently list ISO 9001 as a pass/fail requirement at the qualification stage. Enterprise procurement teams increasingly require ISO 27001 as part of vendor onboarding. ESG commitments from large clients are driving demand for ISO 14001 further down supply chains. None of these are statutory obligations, but failing to meet them can block you securing commercial opportunities.
There are also sectors where regulatory alignment with ISO standards is expected even if not explicitly mandated. Financial services organisations supervised by the FCA, for example, face expectations around information security governance that ISO 27001 directly supports. Healthcare and legal businesses handling sensitive personal data face similar pressure. In these contexts, the absence of certification is increasingly something that requires explanation.
The simplest test: look at the contracts you want to win in the next two to three years, and check their qualification requirements. If ISO certification appears there, it is effectively mandatory for that business and the investment needs to be measured against the revenue at stake.

Is ISO certification mandatory? Do I legally have to get it

ISO 27001 and SOC 2 both exist to give your customers confidence that you take information security seriously, but they are built on different foundations, recognised in different markets, and carry different implications for how you run your security programme. Understanding the distinction matters, because choosing the wrong one at the wrong time can cost a startup months of effort and real money.
ISO 27001 is a certifiable international standard. It requires your organisation to build a formal Information Security Management System (ISMS), a documented framework covering how you identify risks, implement controls, and continuously improve your security posture. At the end of the process, you are audited by an independent, accredited certification body and, if you pass, you receive a publicly shareable certificate valid for three years. ISO 27001 is globally recognised, heavily weighted in European and UK enterprise procurement, and increasingly expected in regulated sectors like financial services, healthcare, and legal.
SOC 2 is an attestation standard developed in the United States by the American Institute of Certified Public Accountants (AICPA). Rather than a public certificate, it produces a private audit report (a SOC 2 report) which you share with customers under NDA or as part of a vendor onboarding process. You choose which of the five Trust Services Criteria (security, availability, processing integrity, confidentiality, and privacy) your report covers. SOC 2 comes in two types: Type I reports on whether your controls are designed appropriately at a point in time; Type II reports on whether they actually worked over a defined observation period, typically six to twelve months.
For a UK startup, the decision is primarily a question of where your customers are and what they are asking for. UK and European enterprise buyers almost universally ask for ISO 27001. US enterprise buyers and procurement teams tend to ask for SOC 2 Type II. If your sales motion is primarily domestic or European, ISO 27001 is the correct starting point. If you are actively selling into the US or have US investors whose portfolio company obligations require SOC 2, the answer may be different. The two standards have approximately 60–70% control overlap, which means if you build one well, moving to the other later is significantly less work than starting from scratch.

What is the difference between ISO 27001 and SOC 2 for a UK startup?

Unfortunately, there is no straight forward answer here.
In terms of breadth of requirements, ISO 27001 is generally the more demanding of the two. ISO 27001 is slightly more prescriptive. It requires you to build a comprehensive management system across your entire organisation, not just your product or a defined service, auditors will likely ask questions about your sales and marketing process for example, not just your software development. You must implement controls drawn from a defined set of 93 Annex A controls (selecting those relevant to your organisational activities), run internal audits, hold management reviews, and maintain documented evidence of all of it.
SOC 2 can be more flexible but has a different kind of difficulty. You choose your scope and which Trust Service Criteria to include, which makes it feel more manageable on paper. The real challenge is SOC 2 Type 2, which requires you to demonstrate that your controls operated consistently over an observation period, a minimum of three months, but usually 12 months. For a startup, where systems change rapidly, teams grow, and priorities shift constantly, maintaining that consistency is harder than it sounds. Although SOC 2 does not look quite as broadly as ISO 27001 overall, the assessments typically take a deeper look into the way you manage your software development and platform infrastructure.

Is ISO 27001 harder to achieve than SOC 2?

The right answer depends on four factors: where your customers are based, what they are specifically asking for, where you plan to grow, and what your current security maturity looks like.
Typically we recommend choosing ISO 27001 if the majority of your customers and target customers are based in the UK, Europe, or international markets outside North America. ISO 27001 is the default expectation for UK and European enterprise buyers and appears in procurement questionnaires, supplier qualification frameworks, and public sector tender requirements as a named standard. It also aligns well with UK GDPR obligations, meaning the control implementation process addresses many of the same questions your customers&#8217; data protection teams will be asking. If you are in financial services, professional services, healthcare, or any regulated sector, ISO 27001 is almost certainly what your market expects.
We suggest opting for SOC 2, or considering it alongside ISO 27001, if a significant portion of your revenue comes from, or is actively targeted at US enterprise customers. SOC 2 is the standard those buyers will typically ask for in their vendor questionnaires, and producing an ISO 27001 certificate in response to a SOC 2 request will not always satisfy a US procurement team, even though the underlying security posture has a broad overlap.
The practical guidance for most UK startups is: if you are pre-Series A and your customers are domestic, start with ISO 27001. It is what your buyers will ask for, it builds a robust and demonstrable security foundation. ISO 27001 will typically allow you to get an initial foot hold in the US, and if you later need SOC 2 for a full US expansion, the groundwork is largely in place. If you are at Series A or beyond, actively selling into the US, and have US enterprise names in your pipeline, the conversation becomes more nuanced and is worth having with a consultant who understands both frameworks before you commit to either.

When should a startup choose ISO 27001, and when does SOC 2 make more sense?

If you are like many other organisations, you will be keen to understand how you can reduce your greenhouse emissions… but where do you start and where do you concentrate your efforts?
To know where to make reductions you must first identify and then establish the significance of each source of greenhouse gas emission in your business and supply chain. Although some sources of emissions are easy to calculate accurately, others are more complex. Don’t let this intimidate you… we have outlined below the starting point for how to calculate your emissions groups.
Scope 1 Emissions
Gas
<ul>
<li>If you use gas to heat your water or for heating, get hold of your gas bills – first you will need to identify how much you have used in kWh (on a monthly or annual basis) and then you will need to determine the emissions per kWh. The bills often tell you the emissions related to each kWh, or will at least point you to an online source which gives this information. If you cannot find the emissions related to your exact gas usage you can do a simple calculation to convert the gas measurement into kgCO2e emissions using the conversion factor in the <a href="https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/1049333/conversion-factors-2021-full-set-advanced-users.xlsm">government produced data set</a>.</li>
</ul>
Fuel in plant and company cars
<ul>
<li>If you purchase fuel for company owned (or leased) vehicles or plant, collect information related to the purchase of fuel. You will need to convert either the volume of fuel used; the mileage driven; or the amount spent (depending on your data) into kgCO2e emissions. Data on the conversion factors can be found in the <a href="https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/1049333/conversion-factors-2021-full-set-advanced-users.xlsm">government produced data set</a>.</li>
<li>If you have electric vehicles charged using company electricity, this will be captured in Scope 2.</li>
<li>Air conditioning – If you have significant use of air conditioning check your servicing records and establish if any of the gas has leaked. If there is a release you will need to determine the type and quantity of the refrigerant and the related CO2e emissions.</li>
</ul>
&nbsp;
Scope 2 Emissions
Electricity
<ul>
<li>These emissions are related to the amount of electricity you use on site. Collect your electricity bills to determine how much electricity you are using in kWh. You will also need to determine the energy mix, i.e. how is your electricity made, coal? nuclear? renewables? a mix if the above?</li>
<li>On some bills the energy company will tell you the exact mix and the related CO2e emissions per kWh. If you are not that lucky you will need to find out the mix from the energy company or in the worst-case scenario base your calculations on grid averages which can be found here in the <a href="https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/1049333/conversion-factors-2021-full-set-advanced-users.xlsm">government produced data set</a>.</li>
</ul>
&nbsp;
Scope 3 Emissions
This is where you will need to do some exploration and apply judgement as to which emissions you want to monitor. Of the 15 categories of scope 3 emissions only some will be significant depending on the type of business you are in. The way in which you calculate the emissions will vary depending on how much data you have. The reality is that you won&#8217;t have a complete set of data so you will need to make assumptions and justifications to determine the emissions.
This can take some experience, and you have a couple of options. You can either read up and study how to calculate these scope 3 emissions (there are some good resources about – we recommend starting with the <a href="https://ghgprotocol.org/scope-3-technical-calculation-guidance">GHG Protocol Scope 3 guidance</a>), or you can engage a third party to undertake these calculations for you.
You do not need to address every scope 3 emission; however, you should try and address all those which are material. Some typical methods to gather data are as follows:
<ul>
<li>Travel for work – This would include collecting data on flights, trains, taxis, tube but only where each of these are not for commuting (e.g. getting to the main place of work). Distance data should be collected on all travel for work, and converted to kgCO2e using the <a href="https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/1049333/conversion-factors-2021-full-set-advanced-users.xlsm">government produced data set</a>. Where spend is known but distance is not, this will need to be converted to distance and then have the conversion applied.</li>
<li>Employee Commute – This is for travel from home to the office. Generally this data can be collected by issuing a survey that asks employees to complete information on their typical commute. I.e record the mileage they travel, the transportation method and frequency. You can calculate emissions by multiplying the distances by the emission factors in the <a href="https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/1049333/conversion-factors-2021-full-set-advanced-users.xlsm">government produced data set</a>.</li>
<li>Remote working – Although there is no official data on the average figures for electricity and gas usage at home a widely used source is the <a href="https://info.eco-act.com/hubfs/0%20-%20Downloads/Homeworking%20emissions%20whitepaper/Homeworking%20Emissions%20Whitepaper%202020.pdf">Ecoact whitepaper</a>. If you want to produce a more accurate figure, you may want to ask employees if they use renewable providers of electricity, otherwise you could apply the average grid electricity emission factors found in the <a href="https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/1049333/conversion-factors-2021-full-set-advanced-users.xlsm">government produced data set</a>.</li>
<li>Purchased services – These are GHG emissions from third party services – consultants, cloud computing, accountants etc. Typically you can export your spend on services from your accountancy software and use the <a href="https://www.ons.gov.uk/economy/environmentalaccounts/datasets/ukenvironmentalaccountsatmosphericemissionsgreenhousegasemissionsintensitybyeconomicsectorunitedkingdom">ONS data set</a> to approximate emissions for each service sector based on spend.</li>
<li>Purchased goods – Depending on your industry this could be a significant source of your emissions. This category can be highly involved but for an office based service business you will want to look at emissions related to purchases such as computer equipment – a lot of electronic equipment has good data attached to it, for example see this <a href="https://www.apple.com/environment/pdf/products/notebooks/14-inch_MacBook_Pro_PER_Oct2021.pdf">Macbook data sheet</a>. Try a search with the device model followed by ‘environmental data sheet’. If you are a manufacturing or construction company you will need to either get data from suppliers, or refer to sources such as the <a href="https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/1049333/conversion-factors-2021-full-set-advanced-users.xlsm">government produced data set</a> which has details of emissions related to certain materials.</li>
<li>Waste – Depending on your industry, waste may represent a large or small part of your emissions. Once you have collected data about the amount of waste you produce (e.g. from waste transfer notes) and the method of end of life treatment (recycled, landfill, energy for waste etc.) you can use the <a href="https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/1049333/conversion-factors-2021-full-set-advanced-users.xlsm">government produced data set</a> to convert this to emissions.</li>
<li>Upstream transportation and distribution – This includes transportation and distribution of products between your supplier and yourself (in vehicles not owned or operated by you); and third-party transportation and distribution services purchased by you including inbound logistics, outbound logistics (e.g., of sold products), and third-party transportation and distribution between your own facilities. It is really important to note that emissions relating to sold product for which you pay the distribution counts in the upstream category. You will need to look at all shipments and the associated distances (including vehicle type/transport method). Then use the <a href="https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/1049333/conversion-factors-2021-full-set-advanced-users.xlsm">government produced data set </a>to arrive at emissions.</li>
<li>Downstream transportation and distribution – Where a customer pays for the transportation or distribution, the emissions should be recoded in this category. You will need to look at all shipments and the associated distances (including vehicle type/transport method). Then use the <a href="https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/1049333/conversion-factors-2021-full-set-advanced-users.xlsm">government produced data set</a> to arrive at emissions.</li>
<li>Transmission and distribution – This category is associated with the losses that come from distributing power to your office/employee houses. Total all your electricity usage in kWh and then apply the conversion factor in the <a href="https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/1049333/conversion-factors-2021-full-set-advanced-users.xlsm">government produced data set</a> for distribution losses.</li>
</ul>

How do we calculate our greenhouse gas emissions?

Understanding Scope 1, 2 and 3 emissions
When talking about carbon emissions, it doesn’t take long to run into the terms ‘Scope 1, Scope 2 and Scope 3’ – it is essential to understand what these are as everything else builds upon them.
The three scopes of greenhouse gas emissions first came into use in the Greenhouse Gas Protocol of 2001 as a way of categorising the different types of emissions produced by a company in its production chain. The Greenhouse Gas Protocol remains one of the central standards for greenhouse gas reporting in the UK and worldwide.
Scope 1 emissions are direct emissions from assets owned or controlled by a company. E.g. your office or your company cars (imagine the emissions being created directly from the company asset). The most common sources are: 
•    gas used in heating your facility (e.g. emissions created by the boiler) 
•    fuel used in your fleet or plant (e.g. emissions created by the engine) 
•    escapes of gases from your air conditioning
Scope 2 emissions are emissions from the generation of purchased energy (e.g. electricity). You are still using the energy to run your company assets, but the assets do not directly create emissions. Instead the emissions are released at the point of power generation, e.g. upstream at the power station and not by your bulb. Electricity is the primarily what we are talking about here.
Scope 3 emissions are all the other emissions which occur in the chain of production of your company, including both upstream and downstream processes. Upstream emissions refer to the emissions that occur upstream of your own processes. Downstream emissions are those such as distribution that happen after your own processes.
Upstream Scope 3 emission examples: 
•    Purchased goods and services (e.g. IT equipment, production materials, data centres, consultancy, contractors) 
•    Transportation and distribution (getting goods and materials to you) 
•    Waste generation 
•    Business travel (excluding travel in your own vehicles which would be counted in scope 1) 
•    Employee commuting (excluding travel in your own vehicles which would be counted in scope 1) 
•    Home working
Downstream Scope 3 emission examples: 
•    Transportation and distribution (sending goods from you) 
•    Use of sold products (e.g. emissions relating to the use of what you make) 
•    End of life treatment of your sold products
Do I really need to consider Scope 3 emissions?
The short answer is yes – these often account for a significant proportion of a company’s emissions and you can influence them in many cases. For example, a website company may design websites that produce less CO2 per page opened (‘use of sold product’); a consultancy may decide that they can reduce business travel emissions by requiring the use of public transport over cars and planes (‘business travel’). There are many more examples.
Although Scope 1 and 2 remain the starting point for monitoring, any thorough approach to calculating and then reducing emissions must consider Scope 3 emissions.
Emission scopes visualised
Here is an example of the emission scopes visualised for the manufacturing industry:

What are Scope 1, Scope 2 and Scope 3 Carbon Emissions?

Unlock Your Business Potential

Implementation Guides