ISO 27001 Consulting

ISO 27001 is an internationally recognized standard for information security management. It provides a framework for organizations to establish, implement, maintain, and continually improve an information security management system (ISMS). This helps businesses protect their sensitive information and manage risks effectively.

An ISMS, or Information Security Management System, is a set of policies, procedures, and controls designed to manage an organization’s information security risks. It encompasses the people, processes, and technology involved in protecting and securing sensitive information from unauthorized access, use, disclosure, disruption, modification, or destruction.

• Better be prepared than reactive – no matter if you are waiting for your customers or VCs to request you to prove your security status or you want to be prepared against cyber-attacks.

• A proper implementation protects you from GDPR fines (which can be up to 4% of your annual turnover).

• Data losses not only lead to contractual penalties but also implicate loss of reputation, loss of sales, or complete discontinuation of business operations.

• Easy integration – for startups an ISMS can be easily integrated into these young companies as they are more flexible in their growing phase.

• Transparency and improvement – within the ISO implementation project organizations understand that they have not been protected in the right way in the past.

• Follow a comprehensive security framework – ISO provides clear guidance and improves the maturity of security-relevant processes right from the beginning.

• Better sales – young companies have a competitive advantage compared to non-certification holders.

• Show what you got – the standard provides a simplified assurance and is used as international proof for information security.

• Clean up and enable – young companies are often less regulated, e.g. employees use different private notebooks, cloud tools of choice, and other shadow IT for business-relevant activities. The standard helps you to identify, evaluate and reduce risks without restricting the dynamics of the company.

• Get your investment – Investors take a look at the Due Diligence (and the information security strategy) of startups. ISO proactively enables and helps to fulfill these high requirements.

• Learn from the best – feedback from industry experts (e.g., auditors) allows you to discuss best practices and your current challenges.

• Save money – cost savings are measurable, e.g. for incident cases.

All contracts run for 12 months. You can pay monthly or upfront for one year. Additional consultation can be requested and offered. The regular consultation hour is charged 185€/h. The monthly packages are price optimized and calculated based on the complexity and size of your company. 

The initial audit consists of stage 1 (document and readiness check) and stage 2 (main assessment) audit which is split up into two phases. After the audit a report is created and you pay a fee for the certificate license. After the initial audit and certification, a surveillance audit is conducted annually which is shorter in duration and cheaper. After a three-year period, you start with the so-called recertification audit.

The costs of certification mainly depend on the number of people (FTE) working in the scope of the ISMS, the complexity of the organizations’ processes, as well as their IT landscape, and the industry. Note that these pricing ranges are approximate and can vary based. To provide you with an accurate quote, it is needed to gather more details about your requirements.