ISO 27001 certification for your organization
ISO 27001 is the international standard for information security. With an ISO 27001
certification, you demonstrate that information security is structurally and demonstrably
implemented within your organization.
Brand Compliance is an independent certification body and guides organizations
from intake to certification with a clear and transparent process.
✔ International recognition
✔ Trust among customers and supply chain partners
✔ Certification by an experienced, independent party
✔ ISO 27001 certification under accreditation by the Dutch Accreditation Council (RvA)
What is ISO 27001 and why is ISO 27001 certification important?
ISO 27001 is the internationally recognized standard for information security. With ISO 27001 certification, you demonstrate that your organization complies with the international requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS).
An ISO 27001 certificate shows clients, partners, and other stakeholders that information security within your organization is demonstrably and structurally embedded. This provides confidence and transparency toward the market and supervisory authorities.
An ISMS encompasses the policies, processes, responsibilities, and measures through which your organization manages information security in a structured manner.
Why choose ISO 27001 certification?
Independent assessment
Demonstrate that your ISMS has been independently assessed against ISO 27001.
Customer confidence
Show clients and customers that information security is systematically managed.
Stronger tender opportunities
Meet the expectations of customers who require ISO 27001 certification.
Trust across the supply chain
Demonstrate your approach to information security to suppliers and supply-chain partners.
Support for compliance
ISO 27001 certification can support demonstrable management of information security risks and help substantiate relevant legal and contractual obligations.
For many organizations, ISO 27001 certification is therefore not only desirable, but strategically valuable.
ISO 27001 certification provides confidence in your information security management system, but does not guarantee that security incidents or risks are completely eliminated.
Which organizations is ISO 27001 certification relevant for?
ISO 27001 certification is relevant for organizations that process confidential or business-critical information and want their information security independently assessed.
IT & software
Cloud & hosting
Professional services
Financial services
Government
Critical supply chains
Healthcare
For organizations that process personal health information, NEN 7510 certification may also be relevant alongside ISO 27001.
ISO 27001 requirements for an ISMS
ISO 27001 specifies the requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS). The standard includes requirements relating to, among others:
Context analysis
The organization must understand its internal and external context in order to determine the scope and objectives of the ISMS.
Risk assessment and risk treatment
Risks affecting information security are identified and treated.
Information security controls
Appropriate controls are implemented, evaluated, and updated.
Management responsibility
Top management provides resources and is actively involved in the ISMS.
Performance evaluation
The effectiveness of the ISMS is periodically evaluated.
Continual improvement
The organization continually improves its information security.
How does ISO 27001 certification work?
To achieve ISO 27001 certification, an organization typically goes through the following steps:
Preparing for ISO 27001 certification
Before a certification audit takes place, your organization must have implemented an ISMS that meets the requirements of ISO/IEC 27001. This includes conducting risk assessments, determining information security controls, performing internal audits and carrying out a management review.
The certification process at Brand Compliance
Application and proposal
We establish the scope, size and complexity of your organization. Based on this information, we determine the required audit time and provide a proposal.
Stage 1 audit
We assess the documentation, scope and readiness of the management system for the stage 2 audit.
Stage 2 audit
We assess whether the management system has been implemented, operates effectively and meets the requirements of ISO/IEC 27001.
Certification decision
Following the audit and the assessment of any nonconformities and necessary corrective actions, an independent certification decision is made.
Surveillance audits and recertification
After certification, periodic surveillance audits take place. An ISO 27001 certificate is valid for three years. Recertification is required to continue certification.
Would you like to know more about preparation and timing? Read our step-by-step guide to the certification process or find out how long ISO certification takes.
ISO 27001 e-learning: learn at your own pace
Would you like to develop the knowledge to work with ISO 27001? BC Academy offers PECB e-learning courses covering the fundamentals of the standard, ISMS implementation and auditing. Choose the course that matches your responsibilities.
At your own pace
PECB exam included
An e-learning course develops your personal knowledge and skills. ISO 27001 certification of your organization requires a separate, independent certification assessment.
Costs of ISO 27001 certification
|
The costs of ISO 27001 certification vary by organization. The required audit time depends on the size, complexity and scope of the information security management system. Brand Compliance prepares a proposal for the independent certification assessment based on relevant information about your organization. |
Which factors determine certification costs?The costs of ISO 27001 certification depend on factors such as: ✓ The number of full-time equivalents (FTE) ✓ The number of locations ✓ The scope of the ISMS ✓ The complexity of processes and the IT environment ✓ The nature of the organization’s business activities ✓ The organization of work, such as shift work |
What is included in certification costs?
Certification costs can include the preparation, execution and reporting of certification audits. Additional costs for certificate issuance, administration and travel may apply.
What is not included in certification costs?
The costs of implementing or improving your information security management system (ISMS) are not included in Brand Compliance’s certification costs.
Discuss ISO 27001 certification?
Do you have questions about the certification process, the required audit time or the costs?
Leave your details and we will contact you to discuss your situation.
No-obligation contact
ISO 27001 certification at Brand Compliance
Brand Compliance is an independent certification body and guides organizations from intake to certification with a clear and transparent process. We assess whether your management system meets the requirements of the standard and do not provide consultancy on ISMS implementation.
We offer:
Certification audits under RvA accreditation (C548)
Experienced information security auditors
A transparent certification process
Independent assessment and certification decision-making
ISO 27001 certification in practice
Linqur achieved ISO 27001 and ISO 9001 certification with Brand Compliance. Discover how the organization experienced the certification process.
Read the Linqur case study
Our experts
Bart Versluijs and Michel Leloup are available to provide you with information about ISO 27001 certification.
Ready for ISO 27001 certification?
Have your information security management system independently assessed. Request a proposal or discuss your situation with our experts.
A certificate is valid for three years. During this period, periodic surveillance audits take place. After three years, recertification is required.
The time needed for ISO 27001 certification varies by organization and depends on its size, complexity and level of preparation. Once the information security management system (ISMS) has been sufficiently implemented, the stage 1 and stage 2 audits can be scheduled.
During an ISO 27001 certification audit, Brand Compliance assesses whether the information security management system (ISMS) meets the requirements of ISO/IEC 27001. The assessment covers the design, implementation and effectiveness of the management system.
ISO 27001 is a management system standard. ISO 27002 provides guidance and examples for implementing information security controls.
NEN 7510 is specifically aimed at organizations processing personal health information. The foundation of both standards is similar.
The costs of ISO 27001 certification depend on the size, scope and complexity of your organization. Based on these factors, Brand Compliance determines the required audit time and prepares a proposal. Read more about certification costs or request a proposal.