What is ISO 27001?
ISO 27001 is the international standard for information security. The standard describes how to set up an information security management system (ISMS), using 93 security controls from Annex A as your toolkit. The certificate is valid for three years, with an annual surveillance audit. ISO 27001 was developed by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC), which is why its full name is ISO/IEC 27001.
Where ISO 9001 is about quality management, ISO 27001 is about protecting information against threats. Think of hackers, employees who accidentally share sensitive data, or systems that fail. The standard provides a framework to identify and control those risks. The current version is ISO/IEC 27001:2022 , available in the Netherlands from NEN (Nederlands Normalisatie-instituut, the Dutch standards institute).
| Feature | Detail |
|---|---|
| Full name | ISO/IEC 27001:2022 |
| Publisher | ISO/IEC, in the Netherlands via NEN |
| Number of controls | 93 (in 4 categories, Annex A) |
| Certificate validity | 3 years, with an annual surveillance audit |
| Mandatory? | Not by law. Often contractual, or required under NIS2 |
Why ISO 27001 is becoming more important
Data breaches make the news every day, and cyberattacks keep growing more sophisticated. Organisations store more information than ever, spread across systems, cloud platforms and devices. That information is valuable, including to people with bad intentions.
According to the Dutch Cyber Security Assessment (Cybersecuritybeeld Nederland) from the NCSC (Dutch National Cyber Security Centre), cyber threats are increasing in frequency and impact. Ransomware attacks regularly hit Dutch businesses. According to IBM’s Cost of a Data Breach Report , the average cost of a data breach runs into the millions of euros worldwide.
Information security is not only about cyberattacks. It also covers human error, such as an email with client details sent to the wrong recipient. Or physical threats, such as a fire in a server room. ISO 27001 requires you to look at all these scenarios and take measures.
The core of ISO 27001: the ISMS
At the centre of ISO 27001 is the Information Security Management System, or ISMS. This is not a software package you install, but a systematic way to organise information security. The ISMS describes how you identify risks, which controls you apply, how you check that those controls work, and how you improve continually.
A good ISMS is not a static document that disappears into a drawer. It is a living system that moves with your organisation. When you launch a new service, complete an acquisition or switch to a new cloud provider, your ISMS must reflect those changes.
The British Standards Institution (BSI) , one of the largest certification bodies in the world, describes the ISMS as “the heart of ISO 27001”. Every other element of the standard, from risk assessment to internal audits, revolves around this central system.
The three pillars of ISO 27001
ISO 27001 protects information along three dimensions, known as the CIA triad: Confidentiality, Integrity and Availability. In Dutch: vertrouwelijkheid, integriteit en beschikbaarheid.
- Confidentiality: information is only accessible to those who are authorised. Only HR and the employee themselves can see salary data.
- Integrity: information remains correct and complete. An invoice altered by a hacker damages integrity.
- Availability: information is there when you need it. An email system that is down for days is an availability problem.
An effective ISMS takes all three into account. Sometimes they conflict: extreme security can limit availability. Finding the right balance is the core of the task.
Is ISO 27001 mandatory?
No Dutch law makes ISO 27001 certification mandatory. Even so, pressure to have it is growing, and in many situations it is effectively required. The General Data Protection Regulation (AVG, Algemene Verordening Gegevensbescherming) requires “appropriate technical and organisational measures”. The Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) regards ISO 27001 as evidence that you take information security seriously.
Specific sectors have additional requirements or standards. The table shows where ISO 27001 often comes into play.
| Sector or situation | What applies |
|---|---|
| Healthcare | NEN 7510, based on ISO 27001 with extra healthcare requirements |
| Financial | Supervision of information security by DNB (De Nederlandsche Bank, the Dutch central bank) |
| Essential and digital sectors | NIS2 / Cybersecurity Act (Cyberbeveiligingswet, Cbw) |
| Tenders and enterprise clients | ISO 27001 often a contract condition |
In healthcare, the NEN 7510 plays a similar role: a Dutch standard, based on ISO 27001, with additional healthcare requirements. For essential and digital sectors, the NIS2 Directive has been decisive since 2024. In the Netherlands, it is implemented in the Cybersecurity Act.
What does ISO 27001 certification cost?
Costs vary widely with size and complexity. A small IT company pays much less than a multinational. The largest items are preparation (often with a consultant) and the certification audit by an accredited body such as Kiwa , BSI or DNV .
| Company size | Indicative total cost in year one |
|---|---|
| Small (1 to 25 employees) | €11,000 to €30,000 |
| Medium (25 to 100 employees) | €32,000 to €85,000 |
| Large (100+ employees) | €85,000 to €275,000+ |
After certification, expect annual costs for surveillance audits and maintenance. Read the full breakdown on costs and timeline. If you run an SME, see ISO 27001 for a small business.
How long does it take to get certified?
A realistic process takes six to twelve months, depending on size and starting point. You begin with a baseline measurement and gap analysis, build your ISMS, and run the system for a while before the auditor visits. A common mistake is underestimating the time needed: you cannot do ISO 27001 on the side. The whole process is covered in the step-by-step plan.
The difference between ISO 27001 and ISO 27002
You can be certified against ISO 27001. The standard sets out the requirements for an ISMS and contains the security controls in Annex A. ISO 27002 is a supporting guideline that explains how to implement those controls in practice. You cannot be certified against ISO 27002. Read the full comparison.
How it relates to other standards
ISO 27001 follows the High Level Structure (HLS) , as do ISO 9001 (quality) and ISO 14001 (environment). This makes it easy to combine standards into one integrated management system. If you already hold ISO 9001 certification, you can reuse the management review, internal audit and document control.
Do you work for the US market or supply a SaaS service? Then you will often come across SOC 2 as an alternative. For business continuity, ISO 22301 is a natural fit, and for AI systems, ISO 42001. A broader overview is on comparison with other standards.
Who is ISO 27001 relevant for?
ISO 27001 is mainly relevant for organisations that work with sensitive information or need to demonstrate it to clients.
- IT service providers and software companies that manage client data or systems
- Organisations with sensitive data, such as financial institutions, healthcare providers, lawyers and accountants
- Suppliers in chains where large clients set security requirements
- Start-ups and scale-ups that want to win enterprise clients or tenders
The benefits are concrete: fewer incident risks, more client trust, structure in your security, and a solid foundation for compliance with the AVG and NIS2. ISO 27001 also supports the AVG accountability obligation. Read more on the page GDPR and ISO 27001.
Next steps
Sources
- ISO/IEC 27001:2022 - Information security management systems : International Organization for Standardization
- NEN-EN-ISO/IEC 27001 : Dutch standards institute (Nederlands Normalisatie-instituut)
- NCSC - Dutch National Cyber Security Centre : Dutch government
- Autoriteit Persoonsgegevens : Dutch Data Protection Authority