ISO 27001

The certification audit itself costs £3,000–15,000 depending on the certification body (TÜV, BSI, Bureau Veritas) and your company size. Our readiness assessment (€539) + remediation services typically run €3k–12k depending on gap size. Total budget for certification: €6k–30k. Our assessment gives you a realistic estimate for your specific situation.

Typically 3–6 months after our readiness assessment for a mid-size company with existing security practices. Companies starting from scratch: 6–12 months. The assessment provides a realistic timeline based on your gap size.

ISO 27001:2022 has 93 controls in 4 categories: organizational (37 controls — policies, roles, threat intelligence, cloud security), people (8 controls — screening, training, disciplinary process), physical (14 controls — physical security), and technological (34 controls — endpoint protection, encryption, logging, vulnerability management, network security). 11 new controls were added in 2022 including threat intelligence, web filtering, data masking, and configuration management.

Stage 1 checks that your ISMS documentation exists and is suitable. You need: ISMS scope document, information security policy, risk assessment methodology, Statement of Applicability (SoA), treatment plan, and internal audit evidence. Our readiness assessment identifies exactly what's missing and our ISMS Policy Pack (€449) provides the key documents.

For UK clients: BSI, LRQA, or Bureau Veritas. For EU clients: TÜV SÜD, TÜV Rheinland, or DNV. For cost-conscious companies: LRQA and Bureau Veritas tend to be more competitively priced. Choose a body accredited by UKAS (UK) or DAkkS (Germany). We're vendor-neutral and can recommend based on your sector and geography.