ISO 27001:2022 · Canada and the United States
ISO 27001 Certification Service
We build and operate your ISMS, prepare every document an auditor will ask for, and take you through Stage 1 and Stage 2 — on the current 2022 version of the standard. Delivered to companies across Canada and the United States.
3
Months to the certification audit
93
Annex A controls, scoped to your risk
3 yrs
Certificate cycle, annual surveillance
Canada
One ISMS, accepted by buyers in both markets
The service
ISO 27001 is not a checklist. It is a management system you have to run.
A risk assessment, a Statement of Applicability, internal audits and management reviews that an accredited body will test. Nank.ai builds that system and operates it with you — a named compliance manager owns the certification, supported by AI agents that collect evidence and monitor controls continuously.
Nank.ai does not issue the certificate. Only an accredited certification body can, and it must be independent of the party that built the ISMS. We prepare you, help you select the body, and support both audit stages.
Who it is for
Four situations that bring companies here
Selling into Europe or enterprise
ISO 27001 is the recognised standard outside North America, and increasingly the one procurement asks for alongside or instead of SOC 2.
No ISMS and no one to build it
The management system — not the controls — is where first-time certifications fail. It needs someone who has done it before.
Certified on the 2013 version
The transition deadline passed on 31 October 2025. Certificates against ISO/IEC 27001:2013 are no longer valid.
Holding a certificate already
Surveillance audits, scope changes and the three-year recertification still need running, without absorbing your security team.
The standard
What certification actually requires
Two things, and most projects underestimate the first. Clauses 4–10 are the management system requirements — context, leadership, planning, support, operation, performance evaluation, improvement. None can be excluded. Annex A is a list of 93 controls from which you select based on your risk assessment, and justify every inclusion and exclusion in the Statement of Applicability.
The mistake that costs the most time
Working through Annex A as a checklist before completing the risk assessment. ISO 27001 requires controls to be selected on the basis of risk, and auditors test whether your Statement of Applicability traces back to the risk register. Teams that implement controls first and reverse-engineer the risk assessment end up with controls they never needed and a document set that contradicts itself. We do these in the right order.
The engagement
How it runs, week by week
Weeks 1–2
Scope and gap assessment
We define what the ISMS covers — entities, products, locations, systems and people — because your certificate will state it verbatim and a customer will read it. Scope too narrow and the certificate does not answer the question you were asked; too broad and you are implementing controls across parts of the business that have nothing to do with the product.
Weeks 2–5
Risk assessment and treatment
A defensible risk assessment with a repeatable scoring method, risk owners, and a treatment plan — the document everything else is built on. This is done before we open Annex A, not after.
Weeks 4–8
Statement of Applicability and controls
Every one of the 93 controls recorded as applicable or excluded, with justification traceable to the risk assessment. Then implementation, sized to your risk rather than to the most thorough reading of the guidance. Policies are written against how your company actually operates — auditors notice template policies that describe a company that does not exist.
Weeks 6–11
Evidence, internal audit and management review
AI agents collect evidence continuously from your cloud, identity and ticketing systems. We then run a genuine internal audit — independent of the people who built the ISMS — and a documented management review. An internal audit that raises no findings is itself a finding. Ours will find things, which is what makes Stage 2 uneventful.
Weeks 10–14
Stage 1 and Stage 2 with an accredited body
We help you select a certification body accredited by the Standards Council of Canada, by ANAB in the United States, or by an equivalent IAF member, then support Stage 1 (documentation review) and Stage 2 (testing that the ISMS operates as documented). Your compliance manager handles the auditor relationship and any nonconformities.
Years 2–3
Surveillance and recertification
The certificate runs three years with annual surveillance audits. Monitoring, internal audits and management reviews continue so surveillance is routine rather than an annual scramble.
Deliverables
What you get
- A named compliance manager who owns the certification outcome
- A documented ISMS scope your certificate can stand behind
- A defensible risk assessment, register and treatment plan
- A Statement of Applicability that traces to the risk assessment
- A full policy and procedure set written for your operation
- Automated evidence collection and continuous control monitoring
- An independent internal audit and a documented management review
- Certification body selection, Stage 1 and Stage 2 support
- Surveillance audit support through the three-year cycle
Canada · United States · Remote
ISO 27001 certification across Canada and the United States
We run ISO 27001 certification programmes for companies across Canada and the United States, in your time zone, with a compliance manager who knows your architecture.
The standard is the same on both sides of the border. What changes is the accreditation body behind your certificate and, in some sectors, where the evidence has to live. We handle both.
The standard is the same on both sides of the border. What changes is the accreditation body behind your certificate and, in some sectors, where the evidence has to live. We handle both.
Anywhere in North America
Workshops, risk assessment sessions and management reviews run in your working hours, wherever your team sits. In person where that moves things faster and you are within reach of Toronto.
Accredited on both sides of the border
The same programme runs remotely across Canada and the United States, with a certification body accredited by the Standards Council of Canada, by ANAB, or by another IAF member.
SOC 2 and ISO 27001 together
Companies selling into North America and Europe are frequently asked for both. Run together, one programme satisfies both requests.
Where your evidence lives
ISO 27001 does not mandate where data lives. Your customers, your contracts and privacy law often do, and the ISMS is where you prove it. Your compliance evidence is hosted in the country your company resides in, and the controls are designed so any residency obligation is demonstrable rather than asserted. The regimes that usually drive the requirement:
- PIPEDA — federal private-sector privacy law, the baseline for most Canadian contracts
- PHIPA — Ontario health information, where residency and custodian obligations are explicit
- Quebec Law 25 — privacy impact assessments before transferring data outside Quebec
- Alberta and British Columbia PIPA — provincial private-sector privacy regimes
- Public-sector procurement — many RFPs in Canada require in-country hosting outright
- ISO 27701 — the privacy extension to ISO 27001, where these obligations get formalised
Choosing
ISO 27001 or SOC 2 — or both
They answer the same customer question in different ways. The control sets overlap heavily — run together, one evidence pipeline and one policy set can serve both. Sequenced separately, you largely pay twice. See our SOC 2 compliance service.
ISO 27001
- Output: a certificate
- Issued by an accredited certification body
- Recognised internationally
- Valid 3 years, annual surveillance
- Requires a running management system
SOC 2
- Output: an attestation report
- Issued by a licensed CPA firm
- Primarily recognised in North America
- Typically re-issued annually
- Controls meeting the Trust Services Criteria
Frequently asked questions
How long does ISO 27001 certification take?
Three to four months from kick-off to the Stage 2 audit is realistic for a focused scope with reasonable starting maturity. Organisations with no existing controls, complex infrastructure or a broad multi-entity scope should plan for longer. The constraint is usually evidence: controls need to have been operating long enough for an auditor to sample them.
Where do you deliver ISO 27001 certification programmes?
Across Canada and the United States. Everything is delivered remotely in your time zone. Clients within reach of Toronto, where we are based, can have workshops and management reviews run in person. We help you select a certification body accredited by the Standards Council of Canada, by ANAB, or by another IAF member.
Where is our compliance evidence hosted?
In the country your company resides in. ISO 27001 does not itself mandate data residency, but customer contracts and privacy law frequently do. In Canada that means PIPEDA federally, PHIPA for Ontario health information, Quebec Law 25 for transfers outside the province, and the PIPA regimes in Alberta and British Columbia. In the United States it means HIPAA and the state privacy statutes. Public sector RFPs in both countries often require in-country hosting outright. We design the ISMS controls so those obligations are demonstrable to an auditor rather than simply asserted.
Does Nank.ai issue the certificate?
No. Only an accredited certification body can issue an ISO 27001 certificate, and it must be independent of the party that built the ISMS. We prepare you, help you select the body, and support both audit stages.
Do we need all 93 Annex A controls?
No. You select controls based on your risk assessment and justify exclusions in the Statement of Applicability. Excluding a control is legitimate when nothing in the risk register requires it — what auditors challenge is an exclusion that contradicts your own risk assessment.
We are certified against the 2013 version. What now?
The transition period ended on 31 October 2025, so certificates issued against ISO/IEC 27001:2013 are no longer valid. Moving to the 2022 version means remapping to the four themes and 93 controls, addressing the 11 new controls, and updating your Statement of Applicability. We run this as a defined transition rather than a fresh certification.
Do we need to buy the standard?
You need ISO/IEC 27001 itself. ISO/IEC 27002 — the implementation guidance for the Annex A controls — is optional but hard to work without. See ISO 27001 vs ISO 27002 for how the two differ.
Can you work with our existing compliance platform?
Yes. If you already run a compliance automation platform, we can operate inside it. What we add is the expertise and the ownership of the deadline, not another tool.
Talk to an ISO 27001 team
A short call will tell you what your ISMS scope needs to cover, where your real gaps are, and how long certification will realistically take. We will tell you if you would be better served by SOC 2 first.
[EDITOR: insert engagement pricing before publishing. Deliberately left blank rather than invented.]