How long does it take to get ISO 27001 certified?

ISO 27001:2022 has a revised Annex A with 93 controls in four categories (previously 114 in fourteen categories). Eleven new controls have been added, including for cloud security and threat intelligence. The transition deadline was 31 October 2025.

For an SME with 10-50 employees, ISO 27001 certification usually costs €5,000 to €15,000 in the first year. After that you pay €2,000 to €5,000 a year for surveillance audits. The exact price depends on your company size, IT complexity and number of locations.

On average six to twelve months for most organisations. If you already have a well-functioning quality system (such as ISO 9001), it can be done in five to six months. Complex IT environments may need twelve to eighteen months.

Yes, you can switch at any time. Your new certification body takes over your file and plans a transfer audit. Your certificate remains valid during the switch.

No, ISO 27001 is voluntary. But more and more clients do require it, especially in IT, finance and healthcare. It also helps you comply with the GDPR and the new NIS2 directive.

Yes, especially if you already have experience with management systems. For smaller organisations with a manageable IT environment it is feasible. A consultant can speed up the process, but is not required.

After your initial certification, a surveillance audit follows every year. After three years you need a full recertification. This cycle then repeats.