ISO/IEC 27001:2022 certification
The leading international standard for information security management. Show your customers that you protect their data with an Information Security Management System (ISMS) audited by an independent body.
What is ISO/IEC 27001
ISO/IEC 27001 is the international standard specifying the requirements for establishing, implementing, maintaining and continually improving an Information Security Management System (ISMS). An ISMS is a systematic, risk-management-based approach covering people, processes and technology to preserve the confidentiality, integrity and availability of information.
The current edition, ISO/IEC 27001:2022, organises the Annex A reference controls into four themes (organisational, people, physical and technological) supported by the ISO/IEC 27002 control catalogue. Certification attests that your organisation has identified its risks, applied the appropriate controls —documented in the Statement of Applicability (SoA)— and operates the system effectively.
Benefits of certification
- Commercial trust: the certificate is the most direct answer to corporate security questionnaires and tenders requiring ISO/IEC 27001.
- Systematic risk management: identify and treat threats before they become incidents.
- Regulatory compliance: the ISMS facilitates demonstrating due diligence under GDPR, NIS2, DORA and contractual security clauses.
- Competitive advantage: differentiate your offering in B2B sales processes and shorten sales cycles.
- Continual improvement: the audit cycle (certification, surveillance, recertification) keeps the system alive and up to date.
Who needs it?
The standard applies to any organisation, but it is especially relevant for:
- Software and SaaS companies handling customer data.
- IT service providers, cloud providers, technology consultancies and MSPs.
- Fintech, insurtech and financial services subject to third-party and regulator requirements.
- Healthcare organisations, professional firms and any business processing sensitive information.
- Companies whose customers or tenders require the certificate as a condition of contract.
How the certification process works
BorealCert performs the full certification cycle remotely, in line with ISO 19011 auditing techniques and IAF guidance on remote auditing:
| Stage | Content | Typical duration |
|---|---|---|
| Application & quote | Definition of ISMS scope, organisation size and fixed price. | 1 business day |
| Stage 1 — documentation | Remote review of scope, policies, risk assessment, SoA and readiness. | 1–2 audit days |
| Stage 2 — implementation | Video-call audit: interviews, control evidence and ISMS operation. | 2–5 days by size |
| Decision & issuance | Independent review by the certification committee and certificate issuance. | Up to 10 business days |
| Surveillance | Annual follow-up audits to maintain certification. | Yearly |
| Recertification | Full audit before expiry to renew the cycle. | Every 3 years |
Validity: the ISO/IEC 27001 certificate is valid for 3 years, conditional on passing annual surveillance audits.
Frequently asked questions about ISO/IEC 27001
How long does it take an SME to get certified?
If the ISMS is already implemented, the certification process is usually completed in 4–8 weeks. Starting from scratch, the timeline depends on implementation; the Stage 1 audit can take place once the core documentation is ready.
Is a remote audit as valid as an on-site audit?
Yes. Remote auditing techniques are recognised by international auditing guidelines (IAF MD 4 and ISO 19011) and the resulting certificate is identical. We assess each organisation's eligibility to ensure the remote modality can achieve all audit objectives.
What is the difference between ISO/IEC 27001:2013 and the 2022 edition?
The 2022 edition updates Annex A (93 controls grouped into 4 themes, versus 114 controls in 14 domains in 2013) and introduces new controls such as threat intelligence, cloud security and data leakage prevention. 2013 certificates had to transition to 2022 by October 2025; BorealCert issues exclusively ISO/IEC 27001:2022 certificates.
What minimum documentation do I need?
Security policy and objectives, ISMS scope, risk assessment and treatment methodology and results, Statement of Applicability, and evidence of control operation (records, reviews, internal audits and management review).
How much does certification cost?
The price depends on the number of people within the scope, technological complexity and the number of logical sites. SMEs typically receive fixed quotations; request yours with no obligation via the contact form.
How can my customers verify the certificate?
All certificates issued by BorealCert are listed in our public register at verify.borealcert.com, searchable by certificate number at any time.
Ready to start? Request a fixed quotation for ISO/IEC 27001, or combine the audit with ISO 9001, ISO/IEC 27701 or ISO/IEC 20000-1 in an integrated audit.