ISO 27001 Certification: Requirements, Costs & Implementation
The international standard for information security — from ISMS setup to certification audit
What is ISO 27001?
ISO/IEC 27001 is the international standard for information security. The standard provides a systematic framework for establishing, implementing, maintaining, and continuously improving an Information Security Management System (ISMS). ISO 27001 is developed by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC).
With ISO 27001 certification, your organization demonstrates that information security risks are managed in a structured way. This is important not only for your own organization but also for customers, partners, and regulators who want assurance about the security of their data.
The standard is applicable to any organization, regardless of size or sector. Whether you are an IT company, healthcare institution, government organization, or manufacturing company — ISO 27001 provides the framework for professional information security management.
Who is ISO 27001 for?
ISO 27001 is not mandatory, but is increasingly requested by customers, clients, and in tenders. The standard is relevant for any organization that handles sensitive information.
IT & SaaS companies
Customers and partners expect demonstrable information security. ISO 27001 is often a hard requirement in contracts.
Healthcare institutions
Combined with NEN 7510, ISO 27001 forms the foundation for protecting patient data.
Government & public sector
BIO compliance is based on ISO 27001. The standard is required for many government contracts.
Financial services
Regulators expect security in accordance with ISO 27001 or equivalent standards.
Industry & manufacturing
More supply chain partners require demonstrable information security for supply chain security.
What is an ISMS (Information Security Management System)?
The ISMS is the heart of ISO 27001. It is a management system that describes how your organization structurally addresses information security. The ISMS encompasses policies, procedures, risk assessments, and controls.
An effective ISMS follows the Plan-Do-Check-Act (PDCA) cycle: you plan your approach, implement measures, check effectiveness, and continuously improve. This ensures that information security is not a one-time project, but an ongoing process.
Organizational context
Understand internal and external factors that affect information security
Leadership & commitment
Management demonstrates involvement and establishes information security policy
Risk management
Systematically identify, analyze, and treat information security risks
Evaluation & improvement
Monitor performance, conduct audits, and continuously improve the ISMS
Benefits of ISO 27001 Certification
Why are more organizations choosing ISO 27001?
Increased Customer Trust
Demonstrate that you take the security of customer data seriously
Competitive Advantage
Certification is increasingly required for tenders and partnerships
Reduced Risk
Systematic approach to security risks reduces the chance of incidents
Legal Compliance
Meet GDPR and other privacy and security legislation requirements
Continuous Improvement
The ISMS ensures structural and ongoing improvement of security
Fewer Incidents
Organizations with ISO 27001 experience significantly fewer security incidents
ISO 27001 requirements: clauses 4 to 10
The requirements of ISO 27001 are set out in clauses 4 to 10 of the standard. This structure follows the Harmonized Structure, the same layout used by ISO 9001 and ISO/IEC 42001. Together, the clauses describe what your ISMS must cover. Annex A adds the controls you choose from.
Context of the organization
Determine internal and external factors, the requirements of interested parties and the scope of the ISMS
Leadership
Management demonstrates commitment, sets the information security policy and assigns roles and responsibilities
Planning
Assess and treat information security risks and set information security objectives
Support
Provide resources, competence, awareness, communication and documented information
Operation
Carry out risk treatment and control the processes needed for information security
Performance evaluation
Measure and monitor performance, conduct internal audits and hold a management review
Improvement
Address nonconformities with corrective actions and continually improve the ISMS
Annex A is not a list you have to tick off in full. In a Statement of Applicability (SoA) you record which of the 93 controls apply to your organization and why.
Annex A: The 4 Control Categories
ISO 27001:2022 contains 93 controls divided into 4 themes
Organizational Controls
Policies, roles, responsibilities, and organizational processes for information security
37 controls
People Controls
Screening, awareness, training, and employee responsibilities
8 controls
Physical Controls
Physical security of buildings, facilities, and equipment
14 controls
Technological Controls
Technical security of systems, networks, and data
34 controls
Not all controls are mandatory - you choose which are relevant to your organization via a Statement of Applicability (SoA)
8 Steps to ISO 27001 Certification
A structured approach for successful implementation
Gap Analysis
Determine where your organization stands against ISO 27001 requirements
Define Scope
Define which processes, locations, and systems are covered by the ISMS
Risk Assessment
Identify and evaluate information security risks
Implement Controls
Implement appropriate controls from Annex A
Documentation
Create required procedures and policy documents
Training & Awareness
Train employees on their role within the ISMS
Internal Audit
Conduct an internal audit to test the ISMS
Certification Audit
External audit by an accredited certification body
How uComply Helps with ISO 27001
From quick start to certification: we support your entire ISO 27001 journey
ISO 27001 Content Pack
Start immediately with pre-configured templates, controls, and implementation instructions
AI Guidance
Our AI Consultant answers all your ISO 27001 questions and guides you through implementation
Audit Support
Certified auditors help you with internal audits and certification preparation
ISO 27001:2022 - The Current Standard
Since October 2025, ISO 27001:2022 is the only valid version. The key changes compared to the 2013 version:
- 11 new controls added, including Threat Intelligence and Cloud Security
- Annex A restructured from 14 to 4 categories
- New attributes for controls (preventive, detective, corrective, etc.)
- Greater focus on cloud security and modern threats
ISO 27001 and related standards
ISO 27001 does not stand alone. It forms the basis for a family of standards and can be integrated with other management systems:
NEN 7510
The Dutch standard for information security in healthcare. NEN 7510 builds on ISO 27001 with healthcare-specific additions.
NEN 7510 →NIS2
The European cybersecurity directive. ISO 27001 certification helps demonstrate NIS2 compliance.
NIS2 →ISO 9001
Quality management. The High Level Structure makes integration with ISO 27001 straightforward.
ISO 9001 →ISO 27701
Privacy extension to ISO 27001 for a Privacy Information Management System (PIMS), relevant for GDPR compliance.
SOC 2
American standard for service organizations. ISO 27001 and SOC 2 partially overlap and can be implemented in parallel.
SOC 2 →Frequently Asked Questions about ISO 27001
How long does it take to become ISO 27001 certified?
On average 6-12 months, depending on the size and complexity of the organization. With uComply Content Packs, you can significantly shorten this timeline.
What does ISO 27001 certification cost?
Costs vary based on organization size, but include implementation costs, audit fees, and possibly consultancy. uComply offers a cost-effective approach.
How long is an ISO 27001 certificate valid?
An ISO 27001 certificate is valid for 3 years, with annual surveillance audits to verify that the ISMS is still effective.
What is the difference between ISO 27001 and ISO 27002?
ISO 27001 is the certifiable standard with requirements for the ISMS. ISO 27002 is a guideline with detailed explanation of control implementation.
What are the requirements of ISO 27001?
ISO 27001 sets requirements for the ISMS in clauses 4 to 10: context of the organization, leadership, planning, support, operation, performance evaluation and improvement. In addition, Annex A contains 93 controls, and a Statement of Applicability determines which of them apply.
How many controls does ISO 27001 have, and are they all mandatory?
ISO 27001:2022 contains 93 controls in Annex A, divided into four themes: 37 organizational, 8 people, 14 physical and 34 technological controls. They are not all mandatory. Based on your risk assessment you choose which controls apply, and you record that choice in a Statement of Applicability (SoA).
What is an ISMS?
An ISMS (Information Security Management System) is a management system for information security. It encompasses policies, procedures, risk assessments, and controls that together provide structural protection of information.
Is ISO 27001 mandatory?
ISO 27001 is not legally mandatory, but is increasingly demanded by customers and clients, especially in tenders. It also helps with compliance with regulations such as GDPR, NIS2, and BIO.
What is the difference between ISO 27001 and NEN 7510?
NEN 7510 is the Dutch standard specifically for information security in healthcare. NEN 7510 is based on ISO 27001 but contains additional healthcare-specific requirements. Healthcare institutions typically implement both standards in an integrated manner.
Start Your ISO 27001 Journey Today
Discover how uComply can help you efficiently achieve ISO 27001 certification. Schedule a demo or download our implementation checklist.