ISO/IEC 27001
Information Security Management System
ISMS Certification

From kickoff to passing the certification audit, a project typically takes 4 to 9 months. The duration depends on the size of the organization, the scope, and existing security maturity. With THE BARK, many steps can run in parallel.

Costs consist of the consulting/build effort and the audit fees of the external certification body. Key drivers are company size, scope, number of sites, and the existing maturity level. We provide you with a transparent estimate upfront.

The 2022 version restructures the Annex A controls: now 93 controls instead of 114, organized into four themes (organizational, people, physical, technological). New controls address cloud security, threat intelligence, and secure development, among others.

ISO 27001 and NIS2 complement each other. An ISMS based on ISO 27001 provides the structured framework and solid evidence for many NIS2 requirements. Certification can significantly ease NIS2 conformity but does not replace the legal obligations one to one.

The ISO 27001 certificate is valid for three years. In the intervening years, annual surveillance audits take place. After three years, a recertification audit is carried out to renew the certificate.

Certification is usually not legally mandatory. It makes sense when customers, tenders, or supply chains require evidence, when you process sensitive data, or when you want to differentiate yourself in the market through demonstrated information security.