How much does ISO 27001 certification cost?

For an SME: €30-80k in the first year (consulting + tools + audit). For a mid-sized company: €80-200k. With an outsourced CISO, the cost is both lower and more predictable.

What is the difference between ISO 27001 and ISO 27002?

ISO 27001 defines the **requirements** (certifiable). ISO 27002 is a **guide to good practice** detailing each control (not certifiable, but complementary).

ISO 27001 and GDPR: are they compatible?

Highly complementary. ISO 27001 covers security (the means), while the GDPR covers personal data protection (the purposes). An ISMS greatly facilitates GDPR compliance.

Regulation ISO 27001 Feature coming soon

Everything you need to know about the standard ISO 27001

ISO/IEC 27001 is the leading international standard for information security management. It provides a framework for establishing, implementing, maintaining and improving an Information Security Management System (ISMS).

Book a call

2022

Last revision

93 controls

security controls (Annex A)

3 years

certification validity

+70 000

certification bodies worldwide

What is ISO 27001?

ISO/IEC 27001 is an international standard published by ISO that specifies the requirements for establishing, implementing, maintaining and continually improving an Information Security Management System (ISMS). The current version is the 2022 revision, which modernised the security controls (93 controls in Annex A).

The Information Security Management System

An ISMS is a structured approach that covers every dimension of security.

Governance: security policy, roles and responsibilities

Risk analysis: identification, assessment, treatment

Security controls (93 Annex A controls)

Training and awareness for employees

Regular internal audits

Management review and continual improvement (PDCA cycle)

Annex A: the 93 security controls (2022)

The 2022 revision restructured the controls into 4 themes instead of 14 domains, for improved readability.

37 organisational controls: policy, roles, asset management, access control

8 people controls: awareness, training, acceptable use rules

14 physical controls: security of premises and equipment

34 technological controls: cryptography, logging, secure development

ISO 27001 certification process

Certification is issued by an accredited body and is valid for 3 years, with annual surveillance audits.

Phase 1 (6-12 months): scoping, risk analysis, ISMS deployment

Initial audit (stage 1): documentation review

Initial audit (stage 2): in-depth on-site audit

Certification issued for 3 years

Annual surveillance audits

Renewal every 3 years

Simplifiez votre conformité ISO 27001 avec Data Comply One

FAQ ISO 27001

No, certification is voluntary. However, it is increasingly a de facto requirement for large accounts and in sensitive sectors (healthcare, finance, critical industry).