ISO 27001 as a subscription, with a guarantee

Until now, ISO 27001 meant assembling a project yourself: consultants for the documentation, tools from several vendors, someone to run them, and an auditor at the end. We have packaged that whole road into one subscription. It is called Secured by FM CyberSecurity, and it carries a guarantee on the certificate.

I run the commercial side of FM CyberSecurity, so I sit in the buying conversations. The same pattern keeps repeating: a small or medium-sized business loses a tender or a large customer because the certificate is missing, then discovers that closing the gap means several contracts and a hiring plan. This subscription removes that problem.

What is in the subscription

Secured by FM CyberSecurity is designed for small and medium-sized businesses. One vendor, one contract, one price.

We set up the security tools and run them for you. Our own SOC monitors and responds around the clock, built on CrowdStrike. Vulnerability management shows you what needs fixing first, and application security covers the code you build, with pentest reports you can show your customers. You get access to everything we run, a vCISO who gives advice and helps with tenders, and a monthly report on status and what we recommend next.

At the core sits the certificate. We build the management system, the documentation and the controls with you, and store the evidence in a GRC tool so it is ready for the auditor. A typical run is certification-ready in four to six weeks, and the pace depends mostly on how quickly you answer our questions. The audit itself is performed by an accredited certification body. If it does not go through within the agreed window, we cover the next attempt. Gross negligence on the customer side voids the guarantee.

The same controls work does double duty as the documentation NIS2 asks for, so nothing is single-use.

Who it is for

This package exists for companies locked out of enterprise contracts and public tenders because the certificate is missing. Why buyers gate on it is covered in what ISO 27001 is, and why you lose tenders without it. If you already have a security team, or you are a larger organization, the same capabilities are available as separate engagements through our consulting practice, including ISO 27001 as a dedicated project.

The decision for the board

The question is a single yes or no: does ISO 27001 become a funded objective this quarter, bought as one subscription instead of staffed as a project? The inputs you need are which live and target customers require the certificate, what revenue sits behind them, and one price from us. That is a short meeting, not a study.

Next step

See what is inside the package at Secured by FM CyberSecurity. FM CyberSecurity’s credentials and partner certifications are at our partners overview. Or set up a 30-minute board-level conversation about whether the missing certificate is blocking deals you should be winning.

Drafted with AI assistance, reviewed and edited by Fredrik Standahl and the FM CyberSecurity editorial team.

FAQ

What exactly does the guarantee cover?

If the certification audit does not go through within the agreed window, FM CyberSecurity covers the next attempt. The terms are agreed before we start, and gross negligence on the customer side voids the guarantee.

Who does the monitoring?

Our own SOC at FM CyberSecurity monitors and responds around the clock, built on CrowdStrike. You get access to the same tools we work in, so you can see alerts and status whenever you want.

What happens after we are certified?

The subscription continues as your security function: the SOC keeps watching, the vCISO keeps advising, the monthly reports keep coming, and the evidence stays current for the yearly surveillance audits that keep the certificate valid.

We are a larger organization. Is this for us?

The subscription is designed for small and medium-sized businesses. Larger organizations get the same capabilities through our consulting practice, scoped as separate engagements instead of one package.