The proof your customers demand before the contract

Annex A was restructured from 114 to 93 controls, organised into four themes instead of fourteen, and supplemented with eleven new controls — including threat intelligence, cloud security, data leakage prevention and secure coding. Those who built on the old version need a mapping, not a fresh start.

The central document of the standard: a list of all Annex A controls together with your decision on whether it is applicable, how it is implemented, and why it may be excluded. Auditors almost always start here.

NIS2 is law, ISO 27001 is a standard. A certified ISMS does not automatically fulfil NIS2, but it covers a substantial part of the required risk management measures and provides the evidence structure that supervisory authorities expect.

Usually it shortens it drastically. Many procurement processes accept a certificate plus Statement of Applicability instead of a questionnaire with a three-digit number of questions.

From €179 per month, including preparation, audit, certificate and surveillance audits. Classically, the total costs for an SME in the first cycle are usually significantly higher, because consulting, certification body and internal effort are incurred separately. The cost calculator shows the difference for your size.

For a new build, realistically six to eight weeks; with an existing ISMS significantly less, in a switch case down to as little as 48 hours, if risk assessment and measures are actively practiced. The bottleneck is almost always the risk assessment, not the audit.

No. You must decide for each control, with justification, whether it is applicable. The exclusion must be traceable — that is the purpose of the statement of applicability.

A mapping to the 2022 structure, assessment of the eleven new controls and adjustment of the statement of applicability. No new build required. Simply upload your existing documents to our platform and revise the AI suggestions.

No. NIS2 is law and in parts goes beyond it, among other things regarding reporting obligations and the personal responsibility of management. However, an ISMS covers a large part of the required measures and provides the documentation structure.

Yes. What matters is that you manage your providers and that the division of responsibility is documented.

We also certify organizations with fewer than ten employees. The effort scales with complexity, not just headcount.

This is not an exclusion criterion. What is checked is whether you recognized it, addressed it, and learned from it. That is exactly what the system is there for. The point here is to make continuous improvement visible.

Your certificate is issued by the country organization responsible for your market; you can see its status before signing the contract. For ISO/IEC 27001, accreditation is only mandatory in certain legally regulated sectors — if this applies to you, we'll let you know in the initial consultation. As a general rule: the same standard is assessed by the same benchmark, and public sector clients must accept equivalent evidence. Everything on this at .

Only if your ISMS is already running: risk assessment, statement of applicability, and the selected Annex A measures must be in place and actively practiced. This is often the case when switching from another certification body, but almost never when building from scratch. We'll tell you in the Express Checkbefore you book.

This is the actual point. Your ISMS lives in the platform: statement of applicability, risks, measures, and incidents are maintained there, our AI shows deviations and reminds you of review cycles. An ISMS that falls asleep between two audits won't survive a customer audit.

Platform and AI cover the standard case. Where you need more — such as for risk methodology or an independent internal audit — we refer independent consulting from our partner network. Whoever advised you does not audit you with us.