ISO 27001 guides: cost, timeline, controls and audits.
What certification costs an SME and how long it takes, how to set the scope and the Statement of Applicability, how to work through the 93 Annex A controls, and what happens at the Stage 1, Stage 2 and surveillance audits.
ISO 27001 certification in Luxembourg: the process, accredited bodies, cost and local rules
ISO 27001 certification in Luxembourg works as it does everywhere: an ISMS, about three months of evidence and a two-stage audit by an accredited body. What is local: OLAS accreditation, the NIS2 law's reference to standards, and PSDC archiving status.
ISO 27001 surveillance audit: what happens in years two and three, how long it takes and what the auditor samples
An ISO 27001 surveillance audit happens at least once a calendar year, the first within 12 months of certification, and takes about a third of the initial audit time. What it must cover, what the auditor samples, and what happens when it goes wrong.
ISO 27001 and ISO 9001: what you can reuse, what is new, and how to run one integrated system
ISO 9001 and ISO 27001 share the Harmonized Structure, so a quality system already runs most of what ISO 27001 needs. What transfers, what is new (risk treatment, the SoA, 93 controls), how integrated audits and audit time work, and what ISO 9001:2026 changes.
ISO 27001 risk register: what it must contain, a template, and what auditors check
ISO 27001 requires every risk to have an owner, a level scored against your own criteria, a treatment, and the owner's acceptance of what remains. What the register must contain, a copyable template, and what auditors check first.
EASA Part-IS explained: who it applies to, the deadlines, and what it means for aviation suppliers
EASA Part-IS requires aviation organisations to run an ISMS for information security risks to aviation safety. It has applied since 16 October 2025 or 22 February 2026, depending on the organisation. Who is in scope, what it requires, the NIS2 overlap and what suppliers must do.
Does ISO 27001 make you secure? What a certificate proves, what it leaves open, and how to check one is real
Not on its own. An ISO 27001 certificate proves a certification body audited your management system for a stated scope. It does not prove the controls work well. What it proves, where it stops, and how to check a certificate is genuine.
ISO 27001 vs NIS2: how the two map, and how to do both once
An ISO 27001 ISMS covers roughly 70 to 80 per cent of NIS2 Article 21: five of the ten measures fully, five partly. The mapping table, where partial bites, the five NIS2 obligations no ISMS contains, and how to run both as one programme.
ISO 27001 audit evidence: what auditors ask for, and how to collect it without the pre-audit scramble
ISO 27001 auditors sample dated records from across the audited period, not a snapshot taken the month before. What the standard requires as documented information, typical evidence per control area, how fast it goes stale, and how to collect it as the work happens.
ISO 27001 Stage 1 vs Stage 2 audit: what the auditor checks and what they accept
Stage 1 reads your ISMS documents to check the system is designed. Stage 2 tests whether it actually ran, after around three months of operation. What the auditor checks at each stage, what they accept, and what a major or minor nonconformity costs you.
ISO 27001 certification cost for SMEs (2026): audit fees, consultants and the costs nobody quotes
For a company of 26 to 125 people, ISO 27001 costs roughly €50,000 to €150,000 in year one, all in. The certification audit is the smallest line. Every cost, the three-year view, and where the money is wasted.
ISO 27001 internal audit and management review: what clauses 9.2 and 9.3 require, how often, and what auditors check
ISO 27001 requires internal audits (9.2) and management reviews (9.3) at planned intervals. No frequency is set, but every certification visit checks both, so in practice they run at least yearly. What each clause requires, the seven review inputs and what auditors raise.
ISO 27001 Annex A controls: the 93 controls in 4 themes, grouped the way you will actually implement them
ISO 27001:2022 Annex A lists 93 controls in four themes: organisational (37), people (8), physical (14) and technological (34), 11 of them new. The full list, what changed from 2013, and a grouping by the kind of work each control needs.
How long does ISO 27001 certification take? The timeline by phase, and what slows it down
Plan for nine to twelve months if you are starting from scratch. Where every month of an ISO 27001 project goes, the three-month evidence period that cannot be compressed, why Stage 2 audits get moved, and what genuinely shortens it.
ISO 27001 scope and Statement of Applicability: how to write them
The ISO 27001 scope is the boundary of your management system and appears on the certificate. The Statement of Applicability lists all 93 Annex A controls and is what you are audited against. How to draw the scope, justify exclusions and keep both current.
ISO 27001 without a security team: what a small company has to decide, build and run
A small company with no security team can pass ISO 27001, because it certifies a management system, not a security score. Who does what, the decisions only you can make, the documents and 93 controls, a nine-to-twelve-month timeline, and what the certificate leaves open.
NIS2 certification: is there a NIS2 certificate, and what counts as proof?
There is no NIS2 certificate for companies. NIS2 lets authorities require certified ICT products (Article 24), encourages standards such as ISO 27001 (Article 25) and audits entities (Articles 32 and 33). What exists, what is proposed, and what an auditor asks for.
Is ISO 27001 worth it? When the certificate pays for itself, and when it does not
ISO 27001 is worth it when a tender or a customer already asks for it, or when NIS2 applies to you: the certificate is then a cost of revenue. What it buys, how to weigh the €50,000 to €150,000 first year, when it is not worth it yet, and how to get the same result for less.