ISO 27001 certification in Luxembourg works as it does everywhere: you build an information security management system (ISMS), run it for about three months, and pass a two-stage audit by an accredited certification body, which issues a three-year certificate. What is local is who accredits the auditors (OLAS), how the NIS2 law refers to standards, and PSDC status for archiving providers, which is tied to ISO/IEC 27001.
This guide covers who can certify you, the process, the cost, whether Luxembourg law requires ISO 27001, what PSDC status adds, and a checklist.
| ISO 27001 certification in Luxembourg | |
|---|---|
| Standard | ISO/IEC 27001:2022; 2013 certificates expired when the transition ended on 31 October 2025 |
| Who certifies | A certification body accredited under ISO/IEC 17021-1 and ISO/IEC 27006, by OLAS or another EA accreditation body |
| Audits | Stage 1 (is the system designed?) and Stage 2 (did it run?), four to six weeks apart |
| Evidence period | About three months of operation before Stage 2 |
| Certificate | Three years; surveillance audits in years two and three, recertification in year four |
| Timeline | Nine to twelve months from scratch for 20 to 250 people |
| Cost | Audit about EUR 7,000 to EUR 26,000 by headcount; EUR 50,000 to EUR 150,000 all in, year one, for 26 to 125 people |
Who can certify ISO 27001 in Luxembourg?
A certification body accredited for ISO/IEC 27001. Accreditation means an accreditation body has checked the certification body against ISO/IEC 17021-1, the general rules for management system certification, and ISO/IEC 27006, the additional rules for information security.
In Luxembourg that accreditation body is OLAS (Office luxembourgeois d’accréditation et de surveillance), part of ILNAS, the national institute for standardisation, accreditation and product safety. OLAS accredits ISMS certification bodies and publishes the list of bodies it has accredited on the Portail Qualité. ISO/IEC 27006 was revised as ISO/IEC 27006-1:2024; for PSDC certification, ILNAS accepted accreditation under the 2015 edition only until 31 March 2026.
You do not have to use a Luxembourg body. A certification body accredited by any accreditation body in the European co-operation for Accreditation (EA) agreements, such as BELAC in Belgium or DAkkS in Germany, issues an equally valid certificate. Luxembourg’s own rules for PSDC status say exactly that: certification by a body accredited by OLAS or by any other EA signatory.
Before you compare quotes, check three things:
- The body’s accreditation covers ISO/IEC 27001, not only ISO 9001 or ISO 14001.
- The accreditation is current, and names ISO/IEC 27006.
- The auditors can audit in the language your staff work in, French, German or English.
How does ISO 27001 certification work?
The process has six steps:
- Scope and Statement of Applicability. Decide which parts of the company the certificate covers, then which of the 93 Annex A controls apply and why. See ISO 27001 scope and Statement of Applicability.
- Risk assessment and gap analysis. Find what is missing, and rank it.
- Close the gaps and run the system. Put the controls in place and let the management system run for about three months, so there are records to audit.
- Internal audit and management review. Check yourself before the auditor does, and have management formally review the results.
- Stage 1 and Stage 2 audits. Stage 1 reviews the documents; Stage 2, four to six weeks later, tests whether the system actually ran. See Stage 1 vs Stage 2.
- Certificate and surveillance. The certification body decides and issues the certificate. Surveillance audits follow in years two and three.
From scratch, a company of 20 to 250 people should plan for nine to twelve months. Where the time goes is in how long ISO 27001 takes. If you have no security team, start with ISO 27001 without a security team.
How much does ISO 27001 cost in Luxembourg?
The audit fee is set by the number of people in scope, under the same accreditation rules everywhere:
| Employees in scope | Certification audit days | Typical fee at Western European day rates |
|---|---|---|
| 1 to 10 | 5 | EUR 7,000 to EUR 9,000 |
| 16 to 25 | 7 | EUR 10,000 to EUR 13,000 |
| 26 to 45 | 8.5 | EUR 12,000 to EUR 16,000 |
| 46 to 65 | 10 | EUR 14,500 to EUR 19,000 |
| 86 to 125 | 12 | EUR 17,500 to EUR 22,500 |
Surveillance audits cost about a third of the initial audit each year, and recertification about two thirds. The audit is the smallest line. All in, including consultant support, your own staff time and fixing the gaps, a company of 26 to 125 people should budget roughly EUR 50,000 to EUR 150,000 in the first year. The full breakdown is in ISO 27001 certification cost.
Is ISO 27001 mandatory in Luxembourg?
No. No Luxembourg law requires ISO 27001 certification in general. It comes up in three ways:
- NIS2. The Law of 5 May 2026 requires essential and important entities to take the risk-management measures of Article 12. Article 12(1) says those measures take into account the state of the art and, where relevant, applicable European and international standards. ISO 27001 is the most common way to put them in place and show it. Article 15 lets the competent authority require products, services or processes certified under European cybersecurity schemes, which is a different thing from ISO 27001 certification. How the two frameworks map is in ISO 27001 vs NIS2.
- Customers. Regulated customers must manage the security of their suppliers, and a certificate answers a large share of their security questionnaires.
- PSDC status. For archiving and digitisation providers, the national certification is tied to ISO/IEC 27001, as below.
What is PSDC status, and how does it relate to ISO 27001?
PSDC (prestataire de services de dématérialisation ou de conservation) is a Luxembourg status for organisations that digitise paper documents or preserve digital archives. It comes from the Law of 25 July 2015 on electronic archiving.
- ILNAS grants the status to an organisation certified against the national standard ILNAS 106. Since 8 September 2025, certification must follow ILNAS 106:2024.
- ILNAS 106 is tied to ISO/IEC 27001: ILNAS expects the migration to ILNAS 106:2024 to be completed at the latest six months after the organisation obtains ISO/IEC 27001:2022 certification.
- Only a certification body accredited by OLAS, or by another EA signatory, under ISO/IEC 17021-1 and ISO/IEC 27006 can issue the certification.
- The OLCN (Organisme luxembourgeois de la confiance numérique) supervises PSDCs. Losing the certification means losing the status.
If you digitise or archive documents for clients, or want your own archives to have legal value, plan ISO 27001 and ILNAS 106 as one programme. The details are on the Portail Qualité.
ISO 27001 certification checklist for Luxembourg companies
- Decide what the certificate must cover, based on what your customers are buying.
- Shortlist certification bodies accredited for ISO/IEC 27001, by OLAS or another EA member, and check the audit language.
- Budget three years: certification, two surveillance audits, then recertification.
- Start recording evidence in week one; Stage 2 needs about three months of it.
- If you are under NIS2, map your ISO 27001 controls to the Article 12 measures and run one programme.
- If you archive or digitise documents, plan ILNAS 106 alongside ISO 27001.
- Book the certification body early; Stage 1 and Stage 2 are four to six weeks apart.
How CloudSoul runs the programme, from gap analysis to certificate, is on the ISO 27001 page.
Sources
- ILNAS, Portail Qualité, Prestataires de services de dématérialisation ou de conservation, updated 14 July 2025.
- ILNAS, Portail Qualité, OLAS transition policy for ISO/IEC 27006, 5 October 2020.
- Law of 5 May 2026 on measures to ensure a high level of cybersecurity, Legilux.
- IAF MD 5, audit time for surveillance and recertification audits.
Frequently asked questions
Who issues ISO 27001 certificates in Luxembourg?
Certification bodies accredited for ISO/IEC 27001 under ISO/IEC 17021-1 and ISO/IEC 27006. In Luxembourg the accreditation body is OLAS, part of ILNAS, which publishes the list of bodies it has accredited. A body accredited by another European accreditation body in the EA agreements is equally valid.
Is ISO 27001 mandatory in Luxembourg?
No. No Luxembourg law requires ISO 27001 certification in general. The NIS2 Law of 5 May 2026 requires risk-management measures that take into account applicable European and international standards, and ISO 27001 is the most common way to put those measures in place and demonstrate them.
How long does ISO 27001 certification take in Luxembourg?
Nine to twelve months is realistic for a company of 20 to 250 people starting from scratch. The management system has to run for about three months before the Stage 2 audit, and Stage 2 usually comes four to six weeks after Stage 1.
How much does ISO 27001 certification cost in Luxembourg?
The certification audit is priced by the number of people in scope: about 5 audit days for 1 to 10 people and 12 for 86 to 125, or roughly EUR 7,000 to EUR 22,500 at Western European day rates. All in, a company of 26 to 125 people should budget roughly EUR 50,000 to EUR 150,000 in the first year.
Is a certificate from a foreign certification body valid in Luxembourg?
Yes, if the body is accredited for ISO/IEC 27001 by an accreditation body that signed the European co-operation for Accreditation (EA) agreements. Luxembourg's own rules for PSDC archiving status accept exactly that: OLAS or any other EA signatory.
