Skip to Content
ISO 27001Frequently asked questions

Frequently asked questions about ISO 27001

When you explore ISO 27001  certification, the same questions keep coming up. The standard is available from NEN (Dutch standards institute) , and certification runs through an accredited body . Below you will find detailed answers to the most frequently asked questions.

Is ISO 27001 mandatory?

In the Netherlands, ISO 27001 certification is not legally required for most organisations. It is a voluntary standard that you can use to show that you take information security seriously. There are, however, situations in which certification becomes de facto mandatory.

More and more organisations, especially in the public sector and at large enterprises, require ISO 27001 from their suppliers. The Dutch central government (Rijksoverheid)  requires ISO 27001 for certain tenders, or treats it as a strong preference. If you supply services to governments or large companies, not having a certificate can mean you are not eligible for contracts.

In some sectors, sector-specific regulation also encourages certification. The financial sector, for example, has the DNB Good Practice Information Security (De Nederlandsche Bank) , which aligns closely with ISO 27001. Healthcare organisations that handle patient data are encouraged to get their information security in order through the NEN 7510  standard, which is derived from ISO 27001.

The NIS2 Directive  of the European Union, which is being implemented in 2024 and 2025, places additional requirements on essential and important entities. Although NIS2 does not require ISO 27001 certification, its requirements align closely with what the standard asks for. Certification can be an effective way to demonstrate NIS2 compliance.

How much does ISO 27001 certification cost?

The cost of ISO 27001 certification varies widely, depending on the size of your organisation, the complexity of your IT environment, and how much you have already arranged in the area of information security.

For a small company with 1-25 employees, the total cost in the first year is usually between €11,000 and €30,000. This covers guidance and advice, purchasing the standard, any tooling and adjustments, the certification audit, and an external internal audit.

Medium-sized organisations with 25-100 employees should expect €32,000 to €85,000 in the first year. The higher costs come from more audit days, more extensive advisory days, and often greater investment in tooling and technical controls.

For large organisations with more than 100 employees, costs can rise to €85,000 to €275,000 or more, depending on complexity and the number of sites.

After the first year, there are annual maintenance costs for surveillance audits, ongoing maintenance of the ISMS, and any adjustments. These typically amount to 30-40% of the initial implementation costs.

Read more about costs and timeline for a detailed breakdown by company size.

How long does ISO 27001 certification take?

For most organisations, ISO 27001 certification takes four to eighteen months. A small organisation with a straightforward IT environment and enough focus can be certified in four to six months. A medium-sized organisation usually needs six to nine months. Large organisations with complex infrastructure and several sites often take nine to eighteen months.

These timelines assume a reasonable level of effort. If the project has to be done alongside other work and there is little capacity available, it takes considerably longer. Experience shows that organisations that appoint a dedicated project manager and receive enough management attention move through the process faster.

The certification audit itself takes a few days to a week, depending on the size of your organisation. The International Accreditation Forum (IAF)  has guidelines for the minimum number of audit days, based on the number of employees.

The step-by-step guide gives a detailed overview of the phases and what you can expect in each one.

What is the difference between ISO 27001 and ISO 27002?

ISO 27001 and ISO 27002 are closely related standards that together form the ISO 27000 framework, but they serve different purposes.

ISO 27001  is the certifiable standard. It describes the requirements for an Information Security Management System (ISMS): what you must do to be certified. The standard contains management requirements in clauses 4 to 10 and a list of 93 controls in Annex A.

ISO 27002  is an implementation guide. This standard gives detailed guidance on how to implement the controls in Annex A. Where ISO 27001 says what you must do, ISO 27002 explains how you can approach it.

You can only be certified against ISO 27001, not ISO 27002. But ISO 27002 is a valuable resource when implementing the controls. Most organisations buy both standards through NEN .

There are more standards in the ISO 27000 family. ISO 27005  provides guidance on risk management, ISO 27017  focuses on cloud security, and ISO 27701  adds privacy requirements to the ISMS. Depending on your situation, these additional standards may be relevant.

Read the full explanation on the ISO 27001 vs ISO 27002 page.

What is the difference between ISO 27001 and NEN 7510?

NEN 7510  is the Dutch standard for information security in healthcare. The standard is based on ISO 27001, but is specifically tailored to the healthcare sector and the protection of patient data.

The main difference is the scope. Where ISO 27001 is a general standard that applies to every sector, NEN 7510 focuses specifically on the context of healthcare organisations. The standard takes account of the specific risks in healthcare, such as the sensitivity of medical data, the need for availability in emergencies, and the complex chain of care providers.

In terms of content, there is a lot of overlap. Organisations that are ISO 27001 certified have a good foundation for NEN 7510. The reverse also applies: NEN 7510 follows the structure of ISO 27001, so the step to ISO 27001 is relatively small.

For healthcare organisations, NEN 7510 is often more relevant than ISO 27001, because the standard is explicitly referenced in the Dutch Supplementary Provisions Act on Processing Personal Data in Healthcare (Wet aanvullende bepalingen verwerking persoonsgegevens in de zorg) . Some healthcare organisations choose to obtain both certifications, for example because they also provide services outside healthcare.

How does ISO 27001 relate to the GDPR?

The General Data Protection Regulation (GDPR, known in Dutch as the Algemene Verordening Gegevensbescherming or AVG)  and ISO 27001 have different but complementary goals. The GDPR is legislation that regulates the protection of personal data. ISO 27001 is a standard for information security in the broad sense, covering all types of information.

There is significant overlap. Article 32 of the GDPR requires organisations to implement “appropriate technical and organisational measures” to protect personal data. ISO 27001 provides a structured approach to doing exactly that. An ISMS that meets ISO 27001 helps you comply with the security requirements of the GDPR.

However, ISO 27001 does not cover all GDPR requirements. The GDPR also sets requirements for lawfulness of processing, transparency, the rights of data subjects, and international transfers of data. These topics fall outside the scope of ISO 27001. So you need more than ISO 27001 to be fully GDPR compliant.

ISO 27701  is an extension of ISO 27001 that focuses specifically on privacy. This standard adds privacy-specific requirements to the ISMS and helps demonstrate GDPR compliance. Organisations that process large amounts of personal data may consider implementing ISO 27701 alongside ISO 27001.

The Dutch Data Protection Authority (Autoriteit Persoonsgegevens)  sees ISO 27001 certification as a positive signal, but certification alone is not proof of GDPR compliance. You must be able to demonstrate that you comply with all aspects of the GDPR, not only the security aspects.

Can we combine ISO 27001 with ISO 9001?

ISO 27001 and ISO 9001 can be combined very well. Both standards follow the High Level Structure (HLS) , which means they share the same basic structure. This makes integration relatively straightforward.

The common elements are substantial. Both standards require the context of the organisation, leadership and commitment, planning, support, operation, performance evaluation, and improvement. The management review, internal audit, document control, and the corrective action process can all be shared.

In practice, this means you can set up one integrated management system. You do not have to maintain two separate manuals. You can hold one management review that covers both standards. You can combine your internal audits.

Combined audits are also more efficient. If you choose the same certification body for both standards, the auditor can assess both systems at the same time. This saves time and costs compared with two separate audits.

Combining works best when you implement both standards at the same time, or when you already hold one certificate and add the other. If you are already ISO 9001 certified, you have a head start: much of the structure and processes are already in place. You can then focus on the information security specific elements.

What if we already have SOC 2?

SOC 2  is an attestation standard developed by the AICPA (American Institute of Certified Public Accountants), mainly aimed at the American market. ISO 27001 is an international standard that is recognised worldwide.

There is considerable overlap between the two frameworks. Both focus on information security and include similar controls: access management, change management, incident response, and continuity. If you have SOC 2, you probably already have many of the technical controls that ISO 27001 requires.

The main differences lie in the approach and the outcome. SOC 2 is attestation-based: an auditor assesses whether your controls work and issues a report. ISO 27001 is certification-based: you receive a certificate that shows your ISMS meets the standard.

ISO 27001 also more explicitly requires a management system with risk-based thinking, continual improvement, and management involvement. SOC 2 focuses more on the operational effectiveness of controls.

For international organisations, or organisations that work with European clients, ISO 27001 is often more valuable than SOC 2 alone. Many European clients recognise ISO 27001 but are less familiar with SOC 2. Some organisations choose to have both: SOC 2 for the American market and ISO 27001 for the rest of the world.

Do we have to buy the ISO 27001 standard?

Yes, you must buy the official standard documents  to be able to use them. The ISO 27001 standard is protected by copyright and is sold in the Netherlands through NEN  for around €250.

You cannot legally download the standard for free. Illegal copies circulate online, but using them is not only unethical but also risky: you cannot be sure you have the current version, and you may face legal problems.

In addition to ISO 27001, ISO 27002  is recommended as a supporting resource. This implementation guide helps you put the controls into practice. The cost is similar to that of ISO 27001.

The investment in the standard documents is relatively small compared with the total cost of certification, but it is a necessary foundation. You cannot set up an ISMS without knowing exactly what the standard requires.

Do we need a consultant for ISO 27001?

An external consultant is not mandatory, but for most organisations seeking certification for the first time, it is advisable. The standard is complex, and the risk of pitfalls is high if you have no experience.

A good consultant knows the standard inside out, knows what auditors look for, and can guide you through the whole process. This shortens the timeline, reduces frustration, and increases the chance of success at the first audit attempt.

Consultancy costs range from €5,000 to €15,000 for small organisations to €40,000 to €100,000 or more for large organisations. Rates are typically between €100 and €200 per hour, depending on experience and specialisation.

You can also opt for limited support: a consultant who only carries out the gap analysis and gets you started, after which you continue on your own. This lowers the costs but requires more of your own input.

If you already have experience with other ISO management systems, such as ISO 9001, the step to ISO 27001 is smaller. The structure and approach are similar, only the content differs. In that case, you may be able to manage with less external help.

Choose a consultant with experience in your sector. A consultant who is used to manufacturing companies will understand the context of a software company less well. Ask for references from comparable organisations.

How do I choose a certification body for ISO 27001?

Always choose a body that is accredited by the Dutch Accreditation Council (Raad voor Accreditatie, RvA)  or a comparable national accreditation body that is part of the International Accreditation Forum (IAF) . Accreditation means that the body itself has been checked for quality and independence.

A certificate from a non-accredited body is not recognised by many clients and partners. If a client asks whether you are ISO 27001 certified, they usually mean a certificate from an accredited body.

Well-known certification bodies in the Netherlands include Kiwa , BSI , TÜV , DNV , Bureau Veritas , and LRQA .

Compare quotes from several bodies. Prices can differ significantly, as can their approach. Some bodies have specialisations: experience in specific sectors, a particular approach to the audit, or additional services such as pre-assessments.

Do not focus on price alone. A constructive auditor who thinks along with you and helps you improve your ISMS is worth more than a cheap auditor who only ticks boxes. Ask about the experience of the auditor you are assigned, not only about the experience of the body as a whole.

What if we fail the ISO 27001 audit?

Failing the certification audit is frustrating but not a disaster. It means there is work to do, but the route to certification is still open.

The outcome of the audit depends on the severity of the findings. For minor deviations, you usually still receive the certificate, but you must resolve the deviations within a set period, often 90 days, and provide evidence to the certification body.

For major deviations, the certificate is not issued until the deviations have been resolved and verified. This may require a follow-up visit from the auditor, which means additional costs.

Most organisations that do not succeed on the first attempt obtain the certificate at a re-audit. It takes extra time and money, but it is not a final judgement on your organisation. Use the auditor’s feedback to strengthen your ISMS.

You can reduce the chance of failing by preparing well. A thorough internal audit beforehand, applying the same critical eye as the external auditor, helps you find and resolve problems before they become issues at the certification audit.

Read more about the audit process and how to prepare for it.

How long is an ISO 27001 certificate valid?

An ISO 27001 certificate is valid for three years. After three years, a recertification audit follows, similar to the initial certification audit, in which the whole ISMS is reassessed.

During the three-year cycle, the certification body visits every year for a surveillance audit. These annual audits are shorter than the initial audit and the recertification audit, but they are mandatory to keep the certificate valid.

If you do not have the surveillance audit carried out, or if serious shortcomings are found that are not resolved, the certificate may be suspended or withdrawn.

The certificate is also not automatically valid if your organisation changes significantly. For major changes, such as an acquisition, a fundamental change in scope, or a move, you must inform the certification body. In some cases, an interim audit is needed to verify that the ISMS still works.

What if we have several sites for ISO 27001?

Organisations with multiple sites can approach certification in different ways. The choice depends on how uniform the processes are across sites and what you want the certificate to achieve.

If all sites fall under the same ISMS and follow the same processes, you can have one certificate that covers all sites. The auditor then visits a selection of sites at each audit, rather than all of them at once. The IAF  has guidelines on how the sample of sites is determined.

You can also choose to start with a limited scope, for example only the head office, and later extend to other sites. This lowers the initial complexity and costs, but it means your certificate does not initially cover all sites.

With very different sites, for example because of acquisitions or different business units, it may sometimes be more practical to have separate certificates. This depends on how far the processes are integrated.

Discuss the options with your certification body. They can advise on the most efficient approach for your situation.

Is ISO 27001:2022 different from the previous version?

ISO 27001:2022 is the current version of the standard, published in October 2022. The previous version was ISO 27001:2013. Organisations had until October 2025 to transition to the new version.

The main change is in Annex A, the list of controls. It has been thoroughly revised and reorganised. The old version had 114 controls in 14 categories; the new version has 93 controls in 4 categories. Eleven new controls were added that address current themes, such as threat intelligence, cloud security, and secure coding.

The management requirements in clauses 4 to 10 have changed less drastically. There are clarifications and minor adjustments, but the fundamental approach remains the same. Organisations that were already certified against the 2013 version did not have to rebuild their ISMS completely.

If you start implementation now, you are working with the 2022 version. Make sure you have the current standard documents, and that any consultants or tools you use are also up to date with the 2022 version.

More information

GlossaryWhat is ISO 20000-1?