ISO 27001
The standard your customers keep asking about.
Example data
No law makes a software company certify to ISO 27001; a customer's renewal, a tender or a bank under DORA does, and the first number to know is what the audit takes for a company of your size.
For 25 people the certification audit is 7 auditor days under ISO/IEC 27006-1:2024 Annex C: €8,400 to €14,000 for the initial audit and €14,000 to €23,300 for the three-year cycle, at the day rates accredited bodies in Europe charge, audit fees only.
Open the cost calculator with this headcountAt a glance
The three-year certificate cycle
- Stage 1 audit
- Stage 2 audit7 auditor days, stages 1 and 2
- Certificate
- Surveillance, year 1about 2.3 auditor days
- Surveillance, year 2about 2.3 auditor days
- Recertification, year 3
Auditor days for 25 people in scope, ISO/IEC 27006-1:2024 Annex C; surveillance is about a third of the initial audit.
- CalculatorWhat certification actually costsCertification bodies do not publish prices, but the audit days are fixed by ISO/IEC 27006, so you can work out your own number.
- GuideISO 27001 for a 10-person companyIt is done at this size. The standard asks the same of 10 people as of a larger company; the audit is shorter.
- GuideWhat ISO 27001 software includes, and what you pay the auditor separatelyThe software price buys the management system. The certificate comes from an accredited certification body, which you contract and pay yourself.
- GuideISO 27001 software without an annual contractStandardOS is billed month to month. There is no minimum term and no notice period, and you cancel in the app.
- GuideCompliance software without a sales callThe price is on the page, the trial needs no card, and you buy and cancel in the app. Nobody has to call you.
- Document writerWrite the scope statementClause 4.3 from twelve answers: the sentence the certificate will carry, the boundaries, the interfaces and dependencies, the exclusions with their justification, and the issues considered.
- Document writerWrite the information security policyClause 5.2 from ten answers: the purpose, why security matters to this company, the commitments, the objectives, who is responsible, the topic policies under it, and how it is communicated and reviewed.
- Document writerWrite the risk register and treatment planFive answers pick the starter risks, each scored and treated with the Annex A controls; the register and the plan written as the auditor reads them, and the Statement of Applicability follows.
- Document writerWrite the internal audit programmeClause 9.2 from five answers: the criteria, how many audits a year and what each covers, who audits and how they stay independent, the methods, the year's schedule over the clause sections and the Annex A themes, and how results are reported.
- Document writerWrite the management review minutesClause 9.3 as an agenda: the seven inputs in the clause's order with what was said about each, the four performance trends with their counts, the decisions, the actions with owner and date, and the minutes an auditor reads.
- Document writerWrite a corrective action recordClause 10.2 for one finding: the nonconformity, the correction and its consequences, the cause, whether it exists elsewhere, the action with owner and date, the effectiveness check, and the change to the system, as the record an auditor reads.
- Document writerWrite the incident response planThe Annex A incident controls from a few answers: who leads, how an event is reported, the three severity levels, the response steps, the GDPR, NIS2 and CRA clocks that apply, the evidence to keep, the review afterwards, the exercises.
- Document writerWrite the acceptable use policyThe rules every person signs, from a few answers: accounts and passwords, devices and personal devices, remote work, data handling, approved services and AI tools, communication, personal use, monitoring, reporting, leaving, breaches, acknowledgement.
- Document writerWrite the access control policyWho gets access to what and how it is granted, protected, reviewed and removed, from a few answers: one identity per person, multi-factor authentication, roles, privileged accounts, third parties, the access review, leavers, logging, exceptions.
- Document writerWrite the supplier security policyHow the company chooses, contracts, watches and leaves its suppliers and cloud services, from a few answers: the critical suppliers, what is checked before signing, the six contract clauses, where data may live, the review, the exit.
- Document writerWrite the business continuity planWhat the company does when the product, the data, the office or a supplier is gone, from a few answers: the services covered, the hours to restore, the data loss tolerated, who declares a disruption, how security holds during it, the recovery, the exercise.
- Document writerWrite the Statement of ApplicabilityThe 93 Annex A controls with a status each, a justification for every exclusion, and the Statement written as the auditor reads it, to copy or download.
- GuideAll 93 Annex A controlsOne plain-English line per control, grouped by the four themes of the 2022 edition.
- GuideWhat we cover, clause by clauseEvery clause from 4 to 10, where its records live in the product, and where the limits of any software sit.
- ArticleHow many auditor days, by headcountThe ISO/IEC 27006-1:2024 Annex C arithmetic that fixes the audit fee before anyone quotes you.
- ArticleISO 27001 or SOC 2 in Europe3,405 EU tender notices name ISO 27001 against 104 for SOC 2. The query is public; run it yourself.
- ArticleWhere public buyers name ISO 27001, by countryPublic buyers in the EU and EEA named ISO 27001 in 3,405 tender notices over the last year, 0.38% of everything they published. Seven in ten came from Germany and Poland; France, Spain and Italy name their national schemes instead.
- ArticleThe scope statement, the line a buyer reads firstWhy a certificate that names the head office does not cover a SaaS product, what clause 4.3 requires, the eight conditions a financial customer applies under DORA, and three scope statements for a software company that pass.
- ArticleThe Statement of Applicability, read for a software companyThe four columns of Clause 6.1.3(d), the exclusions an auditor accepts and the ones they never do, and how the Statement follows the risk treatment plan.
- ArticleThe risk assessment, read for a software companyWhat Clause 6.1.2 asks for, a five-point method with an acceptance threshold, the starter risks a software company carries, and why the treatment plan comes before the Statement.
- ArticleThe information security policy, read for a software companyWhat Clause 5.2 asks for and does not, the nine sections a two-page policy carries, objectives an auditor can measure, and the mistakes the first audit flags.
- ArticleThe management review, read as an agendaThe seven inputs of Clause 9.3 in order, the four trends with figures, the two outputs, what the minutes have to show, and the mistakes that turn a meeting into a finding.
- ArticleThe corrective action record, read as a sequenceWhat Clause 10.2 asks for after a nonconformity, the seven sections of a record an auditor accepts, why correction is not corrective action, and the mistakes that reopen a closed finding.
- ArticleISO/IEC 27701:2025, the privacy standard on top of 27001The standalone edition read row by row: the 70 requirements a running ISO 27001 system half covers, the 33 privacy-only ones, and the GDPR articles each control evidences.
- Free checkDORA for a software vendor: the contract clauses your bank customer will sendNine clauses in every ICT service contract and six more for a critical or important function, read from Article 30; the register of information you appear in; and which clauses an ISO 27001 system already produces the evidence for.
Every free template on one page
What it costs, and how to get there
- ArticleISO 27001 certification cost for a company, by headcountAuditor days come from the ISO/IEC 27006-1:2024 Annex C chart, so certification cost tracks headcount more than industry.
- ArticleISO 27001 cost of implementation: the three-year number, not the first invoiceCertification runs on a three-year cycle with surveillance audits each year.
- ArticleCheapest ISO 27001 certification: how to compare quotes without buying a worthless certificateCertification body quotes vary, but the auditor days behind them are set by ISO/IEC 27006-1:2024 Annex C.
- ArticleThe cheapest way to get ISO 27001, and the part you cannot make cheaperMost of an ISO 27001 budget is auditor days, and those are set by a published chart rather than by negotiation.
- ArticleISO 27001 compliance checklist, by clauseA checklist that follows the standard's own structure: clauses 4 to 10 and what each one asks you to be able to show, plus what Annex A adds.
- ArticleBest ISO 27001 compliance software: what to ask before you compare featuresIntegration counts are easy to compare and rarely decide an audit.
- ArticleISO 27001 without a consultant: what you take on, in the order you take it onCompanies certify without a consultant every year.
- ArticleHow to get ISO 27001 certification for a company, in the order it actually happensThe path from nothing to a certificate, what happens at Stage 1 and Stage 2, and the records an auditor asks for at each point.
- ArticleHow to answer a security questionnaire from your ISO 27001 ISMS: 30 question topics mapped to the Annex A controls that answer themNearly every security questionnaire a European company receives asks about the same 30 topics.
The ISO 27001 system and its evidence, in one place
Annex A as a Statement of Applicability, with the policies, risks and audits that evidence it, in one workspace.
Or have it done with you: ISO 27001 gap assessment, €1,200, 10 working days
What it asks of you
93 controls in 4 themes
Organizational
37- A.5.1 Written security policies, approved and kept current
- A.5.2 Who is accountable for what in security
- A.5.3 Splitting sensitive tasks between different people
and 34 more
People
8- A.6.1 Background checks before hiring
- A.6.2 Security duties written into employment terms
- A.6.3 Training people to work securely
and 5 more
Physical
14- A.7.1 Defining the physical boundary you protect
- A.7.2 Controlling who gets through the door
- A.7.3 Securing the rooms themselves
and 11 more
Technological
34- A.8.1 Securing laptops, phones and desktops
- A.8.2 Restricting administrator access
- A.8.3 Limiting what each person can open
and 31 more
Related:How to find an accredited certification bodyWhat compliance software costsFor consultants: every client in one accountArticlesFree tools