Should my one person company get a ISO 27001?

I was in the same situation and had to get SOC 2 and ISO27001 to keep a juicy account. My suggestion would be "absolutely not until you absolutely must".

It's a bottomless pit of time and money. All those "automation tools" (e.g., Drata/Vanta) help with 10-20% of the overall workload, and for me, took as many hours to set up as they saved. For ISO27001, your final annual cost will be $20-40k and will eat up 2-4 weeks per year. Implementing and maintaining a compliance program will do nothing to help you discover/solve customer problems or improve your security posture. Doing this work is the equivalent of "I want to do a startup, so I'm learning how to do business registration, taxation, comply with employment laws, and design business cards".

Compliance will waste your already constrained resources, energy, and focus. It will slow you down and has such a negative ROI that you must have significant deals at risk to consider imposing this ongoing tax on your operations. In other words, wait until you're forced to by your customers/prospects.

Unless you are having customers ask you for it, I would hold off. It's expensive, even done cheaply, most of the automation tools are just automated testing platforms with integrations to third-party systems that may or may not suit your environment. The templates are nice but as a 1 party shop you will end up rewriting large portions to suit your needs.

I've done SOC2 and ISO implementation for a small business.

In my experience, even when you have all these certificates, corporate IT will still want you to fill out there security questionnaire.

I would do Cyber Essentials, and then once you’ve done the work for that Cuber Essentials plus should be straightforward.

Most large businesses corporate IT departments realise that ISO certification is not something that small suppliers can do.

I do know of companies that have stopped at Cyber Essentials plus and had no problems.

One thing I have done previously is to create an IT security policy that is “aligned” with 27001. That can go a long way towards letting people know you take things seriously.

The standard is pretty readable and all the things it says to do are completely reasonable and things that you should be doing anyway (or at least gave a policy around).

My email is in my profile and I’m happy to share my boilerplate security policy with you.

You should not get SOC2, ISO27k, etc certified unless a customer demands it. Even then, as a 1 person company, you can probably push back and stress the simplicity of your operation to avoid it.