Automate your path to ISO 27001 certification.
Your M365 tenant already has the evidence. CertAria shows you the gap and guides you there — without a consultant.
- Read-only scan permissions
- No data leaves your tenant
- Built on Microsoft Power Platform
What you already have
You're not starting from zero.
Your Microsoft 365 tenant is already doing security work that counts toward ISO 27001.
Device management
Intune policies controlling which devices access company data — that's evidence for asset management controls.
Access control
Conditional Access policies deciding who signs in and from where — that's evidence for access controls.
Data protection
Sensitivity labels on documents and emails — that's evidence for information classification controls.
Most SMEs already have usable ISO 27001 evidence.
CertAria maps read-only Microsoft 365 configuration signals to Annex A control areas.
You start with a prioritised gap list, not a blank template.
Our story
Built by a team that used it to certify themselves.
Orion Data Analytics built CertAria to solve our own ISO 27001 challenge. Same constraints — small team, no compliance budget, client deadline.
We're using CertAria to pursue our own ISO 27001 certification. Not as a demo. As our actual ISMS.
The scars are in the product.
Cyber Essentials Certified
UK Government-backed baseline cyber security
Microsoft Certified
AZ-900, AI-900, DP-900, PL-200, Power BI, Fabric
ISO 27001
Pursuing certification using CertAria. Target: November 2026.
Pricing
Not £15,000-40,000.
Typical consultant
Year 1, then £5–10k ongoing
How it works
Three steps to certification.
You stay in control. No consultant needed.
Scan
See which ISO 27001 controls your M365 tenant already evidences. Five minutes, read-only.
4 read-only API scopes. No data leaves your tenant.
Implement
Close the gaps with AI-guided tasks. CertAria tells you what to do, in what order, using what you already have.
20–40 hours of your time, not 100–200.
Certify
Pass your Stage 1 and Stage 2 audits. CertAria stays as your ongoing ISMS — you're certified, not just compliant.
Ongoing surveillance readiness built in.
See where you stand.
Run the free readiness scan and find out how much of ISO 27001 your Microsoft 365 tenant already covers. It takes five minutes, reads only configuration data, and nothing leaves your environment. Your gap report shows exactly where you are and where to start.