A customer security requirement lands on your desk. The contract depends on it. Your team is somewhere between 12 and 35 people, everyone is already carrying two jobs, and nobody has a dedicated GRC (Governance, Risk and Compliance) lead to hand it to. The natural instinct is to hire a consultant, buy a compliance platform, or hand the task to the most organised person on the team and hope for the best.
Each of those paths can work. Each also has a version that costs far more than it should, either in time, money, or both. The problem is rarely effort. It is usually that the preparation starts without enough context about what the requirement actually covers.
That is the gap Sinope is built to close.
What preparation actually requires
ISO 27001 (formally ISO/IEC 27001) is an international standard for information security management. Achieving certification means an independent certification body has assessed your Information Security Management System (ISMS) and found it to meet the standard. Sinope does not certify anything. That part is always independent.
What Sinope supports is the preparation work that happens before a certification audit: understanding your scope, collecting the context that defines your environment, organising the evidence that supports your claims, and identifying the gaps that remain.
For a team without a GRC lead, that preparation work is where most of the confusion and most of the cost sits. Consultants often scope broadly to manage their own risk. Generic checklists describe what an average company might need, not what your company actually does. Policy templates describe intended processes. They do not prove those processes happened.
Over-scoping is one of the most common and expensive mistakes small teams make when they start this process. A scope that is wider than your customer requirement demands means more controls, more evidence, more gaps to close, and more audit time. None of that extra work is required by the customer. It is just carried.
The alternative is to start with the requirement itself: what the customer needs, which part of your business it covers, and what your team already does that is relevant. That context shapes everything else.
How Sinope's guided process works
Sinope is compliance readiness software for AI and B2B startups. The product is in development, with ISO 27001 as the first complete preparation path.
The core of the product is a guided interview flow. Rather than presenting a blank policy template or a long controls list, Sinope asks structured questions about your company's actual environment: how your team works, what systems you use, where your data lives, who has access, and what practices you already follow. The answers build a picture of your context, not a generic one.
This matters because ISO 27001 preparation is not primarily a writing exercise. It is a description exercise. You are describing what you do, what supports that description, and what remains to be resolved. A guided interview is a more reliable way to collect that description than asking a founder to write policies from scratch while also shipping product.
The output of the guided flow is organised evidence and a clear view of gaps. That distinction is important. Evidence is the dated record, the named owner, the log entry, the access review that actually happened. A policy document describes what should happen. Evidence shows what did. Sinope's structure keeps those two things separate, so you know what supports a claim and what still needs to be done.
Advisory evidence review supports human decisions throughout. Sinope does not replace the judgement of a founder or a certification auditor. It gives founders the organised material they need to make good decisions and to support a productive conversation with an independent auditor when that stage arrives.
What this means in practice for small teams
A pre-seed team with 15 engineers and no compliance function is not a scaled-down enterprise. The ISMS that fits that team is not a scaled-down enterprise ISMS either. It is a narrower, more precisely scoped system that reflects the actual environment, the actual risks, and the actual customer requirement.
Sinope is designed for that context. The guided interviews are built to surface what is relevant for a team of that size, not to generate a comprehensive controls library that a larger organisation might need. The SoA (Statement of Applicability) that emerges from preparation should be defensible, not exhaustive.
For founders, the practical effect is that preparation does not consume the engineering roadmap. The interview flow collects context systematically. The evidence organisation surfaces what you already have. The gap view tells you what remains. That structure means the founder or CTO driving the preparation can move through it without needing to become a compliance expert first.
Where cutting preparation costs without losing rigour becomes possible, it is usually because the scope is right and the evidence already exists in some form. Sinope helps teams find that evidence rather than recreate it.
Costs, what they cover, and what they do not
Sinope's target preparation fee is 5,000 EUR. Final scope and terms need confirmation before any engagement begins.
That fee covers the guided preparation path through Sinope's software. It does not cover independent audit fees, which are set by the certification body you choose and vary by scope and body. It does not cover implementation costs, such as the engineering time required to close specific technical gaps your team identifies during preparation. It does not cover team time, which is real and worth accounting for.
We keep those lines explicit because conflating them is how preparation budgets go wrong. A founder who plans for 5,000 EUR and then receives an audit quote for two or three times that amount has not been misled about preparation costs. They have been given incomplete information about the total picture. We would rather give you the complete picture at the start.
Independent certification bodies operate separately from Sinope. Acceptance of a pending certification, a preparation report, or any interim documentation is a buyer-specific decision. Confirm the actual procurement requirement with your customer before assuming that preparation progress will substitute for a completed certificate.
Starting with the requirement
The most useful thing a founder can do when a customer security requirement arrives is to read it carefully before doing anything else. Confirm what is being asked, which part of the business it covers, and when the customer needs it. The answers shape the preparation work more than any tool or template.
Sinope's preparation process starts from that same point. The guided interviews begin with your context, not a standard checklist. The evidence review reflects your environment, not a hypothetical one.
If you want to understand what preparation would cost for your specific situation, you can request a cost breakdown at sino.pe. We review every request before we reply, because the right answer depends on your scope, not a fixed price list.
If you have a customer requirement in front of you and want to talk through what preparation would involve, you can book a 30-minute conversation with Jaimie directly. Bring the requirement and a short description of your current practices. That is enough to start a useful conversation.
Preparation for ISO 27001 is not a compliance exercise in the abstract. It is a concrete description of what your team does and what supports it. Sinope helps small teams build that description, close the gaps, and arrive at a certification audit with organised, auditable evidence rather than a folder of policies that no one has tested.