ISO 27001 is an international standard for information security. The standard describes requirements for an Information Security Management System (ISMS): a structured approach to protect the confidentiality, integrity and availability of information.
IT companies, software developers, MSPs, but also organisations that handle a lot of personal data or confidential customer data.
Small (up to 10 FTE)
Rule of thumb for SMEs: Count on €5,000 - €15,000 in the first year, then €2,000 - €5,000 per year.
Prices indicative, excl. VAT, excl. consultant and internal hours.
Full cost breakdown- Which parts of your organisation, systems and locations are covered by the ISMS? Start small if necessary and expand later.
- Identify information security risks and determine what measures are needed. This is the heart of ISO 27001.
- Implement controls, establish policies, train employees, and document processes.
- Work under your ISMS for a minimum of three months. Auditors want proof that the system works in practice.
- Check yourself whether everything is working and have management formally assess the ISMS.
- The certification body carries out the audit in two phases. If successful you will receive the certificate.
Your certificate remains valid during and after the switch. The new certification body takes over the certification for the same standard and within your existing certification cycle. There is no interruption in your certificate status.
SwitchingA surveillance audit every year. A full recertification every three years. Your certificate is valid for three years, provided you pass the annual audits.
Recertification
“Thanks to CertificeerWijzer we switched to a certification body that fits our organisation much better. We save €1,500 a year and the audits are at least as good.”
No, ISO 27001 is voluntary. But more and more clients do require it, especially in IT, finance and healthcare. It also helps you comply with the GDPR and the new NIS2 directive.
ISO 27001:2022 has a revised Annex A with 93 controls in four categories (previously 114 in fourteen categories). Eleven new controls have been added, including for cloud security and threat intelligence. The transition deadline was 31 October 2025.
Yes, especially if you already have experience with management systems. For smaller organisations with a manageable IT environment it is feasible. A consultant can speed up the process, but is not required.
Accreditation means that a certification body is checked by a national accreditation body, such as the Dutch accreditation body, UKAS (UK) or DAkkS (Germany). Through the IAF agreement these certificates are recognised internationally. Always choose an accredited certification body.
After your initial certification, a surveillance audit follows every year. After three years you need a full recertification. This cycle then repeats.
Yes, you can switch at any time. Your new certification body takes over your file and plans a transfer audit. Your certificate remains valid during the switch.
Completed in 5 minutes. Then tailored quotations from certification bodies that suit you.
