ISO 27001 Certification for businesses that need the certificate without grinding their operations to a halt.

For an SME with 10 to 100 employees, the full process typically takes 4 to 8 months. The initial diagnosis takes 2 to 4 weeks. The actual duration depends on the complexity of your operations and how many controls you already have in place.

Implementation is the process of designing and building the ISMS (Information Security Management System) in your company. Certification is the external audit by an accredited body that validates your ISMS meets the ISO 27001 standard. You can implement without certifying, though most companies seek the certificate to demonstrate it to clients.

NIS2 is a European compliance directive, not a certification. It does not directly require ISO 27001, but many of its technical requirements are covered by a well-implemented ISMS. In practice, having ISO 27001 is the most efficient way to demonstrate NIS2 compliance to clients and auditors.

The cost has two parts: consultancy fees for the implementation (which vary by company size and complexity) and the certification body's fees for the phase 1 and phase 2 audits. We do a free diagnosis before giving you any figures, to tailor them exactly to your situation.

Not necessarily. We design the ISMS to be maintainable with the resources you already have. Many companies we work with have no dedicated security officer — the system is designed to be managed by whoever already handles other responsibilities, without extra burden.