Many entrepreneurs only face this question when a customer includes a question about an ISO 27001 certificate in a questionnaire, or asks for equivalent evidence that information security is in order. The question then quickly follows: what will this cost? There is no fixed amount to mention, because the costs consist of multiple parts that differ per company.
The three parts are usually: the internal time to draw up and maintain policies, procedures and records, possible guidance from an external advisor, and the audit itself, carried out by a certification body that checks whether the information security management system meets the standard. Each part is influenced by the size of the company, the number of locations, and how much is already in order before the trajectory begins.
What a certification body does
A certification body is an independent organization that checks whether a company has established the information security management system as prescribed by the ISO 27001 standard, and which then issues the certificate. This body charges time for the audit, usually divided between an initial assessment and an annual inspection to keep the certificate valid. The certification body's invoice is usually the most visible part of the costs, but not the only part.
What determines the amount
The number of employees and locations that fall within the scope of the certificate is relevant: the more processes and systems that need to be examined, the more time the audit takes. It also matters how much is already in order. A company that already has an information security policy, a risk analysis and documented procedures is usually ready for the audit faster than a company that still needs to start. It also matters whether external guidance is hired for the preliminary phase, and how much internal time is available for this without regular work coming to a standstill.
Certification is not the only way
Not every customer literally asks for a full ISO 27001 certificate. In many questionnaires, the question is whether certain measures have been implemented, without a certificate being required. That difference is important: demonstrating taken measures, such as access control, backups and an incident procedure, costs less than a full certification trajectory and can be sufficient for many customers. What form of evidence a customer precisely asks for is usually stated in the questionnaire itself or in the explanation accompanying it.
For companies that want to see which questions often come up in their sector and what lies behind them, there is the knowledge base in which subjects have been researched by situation. It also explains how such a question relates to other topics from a questionnaire.
What supplia.eu does and does not do in this trajectory
Supplia.eu does not certify anything and does not assess whether a company meets the ISO standard; that remains the work of the certification body. What supplia.eu does do is keep track of the answers that have already been given to questions about information security, so that they do not have to be looked up again each time a next customer sends a similar questionnaire. That subscription is separate from the costs of a certification trajectory; the rates are shown on the page with the subscription rates.
First step: see what is precisely being asked
Before a company starts a trajectory, it is wise to first clarify what the customer is precisely asking and why. Sometimes it turns out that a certificate is desired but not required, and that another form of evidence is also accepted. With a few questions that show where you stand now it becomes clear in a few minutes what type of question it probably is and which direction fits with it.
Would you like to know how information security and the associated questionnaires relate to other topics such as NIS2 or KYB? On the FAQ page of other entrepreneurs there is an overview of questions that frequently come up, and the free quick scan shows in a few minutes which topics your company is likely to be asked about.