500+ ISO 27001 Certifications Across Europe. Yours Is Next.

ISO/IEC 27001 is the international standard for information security management. It provides a framework for establishing and maintaining an Information Security Management System (ISMS) — a structured system of policies, processes, and controls that helps organisations protect sensitive information. It applies to businesses of any size and in any industry.

An ISMS (Information Security Management System) is the documented system at the heart of ISO 27001. It covers how your organisation identifies information security risks, decides how to address them, implements the necessary controls, and monitors whether those controls are working. Think of it as the operating manual for how your business handles security — not just the technology, but the people and processes too.

ISO 27001:2022 is the current, in-force version of the standard released in October 2022, replacing the 2013 version. It introduced 11 new controls covering areas like cloud security, threat intelligence, data masking, and secure coding, and restructured Annex A from 114 controls to 93, organised into four categories. The transition deadline from the 2013 version passed in October 2025; all ISO 27001 certificates issued today are against the 2022 standard.

ISO 27001 compliance means your organisation meets all the applicable requirements defined in the standard covering your ISMS documentation, risk management processes, security controls, internal audits, and management reviews. The standard identifies mandatory requirements with the word "shall": if a clause says something shall be done, it must be done. Compliance is the foundation for certification, but without an independent audit, it remains self-declared. Certification from an accredited body provides the third-party verification that clients and regulators typically require.

It depends on your starting point. An organisation with some existing security policies and practices in place can typically reach certification in 3 to 6 months. Larger or more complex organisations, or those starting from scratch, may need 6 to 12 months. The timeline is most influenced by how quickly your team can implement changes and how much internal resource you can dedicate.

The total cost has three components: consulting fees, certification body audit fees, and internal staff time. Consulting fees vary with the size and complexity of your organisation and the scope of your ISMS. Certification body fees depend on the auditor and the scale of the engagement. For most small and medium-sized businesses, the total investment is substantially less than the cost of a single data breach, and for organisations where certification enables new contracts or satisfies a regulatory requirement, the return is typically measurable within the first year. Contact us for a cost estimate based on your situation.

Technically, no. The standard doesn't require you to use a consultant. In practice, most organisations — particularly those going through certification for the first time — find that expert guidance saves significant time and prevents costly mistakes. A consultant who has been through the process many times knows what auditors expect, where organisations typically struggle, and how to avoid the common pitfalls.

ISO 27001 is the standard you certify against. It defines the requirements for your ISMS. ISO 27002 is a companion guide that provides detailed implementation advice for the security controls listed in ISO 27001's Annex A. You cannot get certified against ISO 27002 — it's a reference document, not a certification standard.

Yes. Common reasons include incomplete risk assessments, missing documentation, controls that haven't been properly implemented, and teams that can't demonstrate how the ISMS works in practice. If the auditor identifies major nonconformities, you'll typically have 90 days to address them before a follow-up visit. This is precisely why we conduct a thorough internal audit before the certification body arrives — so that any issues are found and resolved in advance.

Three years. During that period, you'll undergo annual surveillance audits (shorter reviews to confirm the ISMS is being maintained). At the end of the three years, a full recertification audit is required to renew the certificate.

Yes. The standard is designed to scale. It doesn't prescribe a fixed set of controls that every organisation must implement regardless of size. Instead, you select the controls that are relevant to your specific risks and operations. A 15-person startup will end up with a leaner, simpler ISMS than a multinational bank, and that's exactly how it's meant to work. In practice, smaller organisations often find certification easier to achieve because there are fewer processes to document and fewer people to train. Many of our clients are small and medium-sized businesses that pursued certification to unlock enterprise contracts or meet regulatory requirements.

In most countries and sectors, ISO 27001 is not a legal requirement. However, it can become a practical requirement through client contracts, public procurement frameworks, or sector-specific regulations. Some European regulatory frameworks, including NIS 2 and DORA, require robust information security practices that ISO 27001 is well-positioned to satisfy. The most common driver we see is commercial: a client requires it as a condition of doing business.