ISO 27001:2022 · fixed price · 12+ successfully certified

ISO 27001 certification for SMEs — with consulting, platform setup and a fixed price.

We guide you from gap analysis, risk analysis and the SoA through to the certification audit — personally, in a structured way and with far less internal effort.

  • Full service 6,000 – 19,900 € depending on company size
  • 4–8 months to the certificate
  • Setup of your ISMS platform — subscription separate
  • Audit support at DQS, TÜV NORD
Book a free ISO 27001 assessment Calculate cost & timeline
Specialist holding an ISO 27001 certificate
DQS · TÜV NORD · notivia since 2003 · +50 ISMS clients* · +20 Full-service clients* · 100% Audit success* · ★★★★★ 5.0

* Audit success relates to completed full-service certification projects since 2019. Client numbers include ISMS platform licence holders and full-service projects. The degree of automation (~80 %) depends on the systems connected and on maturity — example calculations are typically for SMEs with 5–25 staff, first ISO 27001 certification.

Quick check

This page is for you if …

  • … a client or a corporate group requires ISO 27001.
  • … you need ISO 27001 for tenders .
  • … you want to prepare for NIS-2, DORA or TISAX .
  • … you want to prepare for do not want to build an internal ISMS team .
  • … you want to know what certification, the audit and consulting cost.
Our services for ISO 27001

Four building blocks. One route to certification.

Four clear building blocks — from the gap analysis through certification to running the ISMS day to day.

Maximum support

Full-service support

From the gap analysis to the certificate — all from one source.

  • Gap analysis & scoping workshop
  • 100+ audit-proven document templates
  • 15 consulting days + internal audit
  • Audit support at DQS / TÜV
from €6,000 one-off · M from 12,000 € · L from 19,900 € Start-up up to 5 staff · plus the certification audit by an external certification body
See details
Ongoing

External security officer

An information security officer for your company — on a fee basis.

  • ISMS upkeep & regular reviews
  • Reporting to the management board
  • Annual audit preparation
  • Staff training included
from €500 / month
See details
12-month minimum term · 3 months' notice
One-off / yearly

Internal audit

An internal audit to ISO 27001 — as the mandatory element or as a maturity check.

  • Maturity score against the clauses + Annex A
  • Prioritised action plan
  • Report for the management board
  • Re-audit after 6 months optional
from €2,900 one-off (1 audit day)
Audit details
Self-service

Build it yourself

Build ISO 27001 yourself — the ISMS platform takes you through the requirements step by step.

  • The guide shows the next step
  • AI produces your documents
  • 800+ templates to build on
  • Support can be added at any time
from€249/ month · cancellable monthly
See the self-service option

Additionally for ISO 27001

Standard-specific extras — bookable individually

Certification audit support

Support on the day of the certification audit (DQS, TÜV, DEKRA).

from €1,490/day

ISMS training

A one- or two-day on-site course for your ISMS team.

from €1,990

Risk workshop

A facilitated workshop to capture and assess risks.

from €2,490
Retainer services (external security officer): 12-month minimum term · 3 months' notice
Free initial assessment

Clarity on ISO 27001 certification in 30 minutes

A realistic read on effort, duration and cost — an honest estimate instead of blanket promises, and no sales pressure.

Lead consultant
Lead consultant
Your contact
  • The fastest answer we can give
  • Realistic figures for time and cost
  • No sales pressure, no obligation
  • From notivia GmbH, Stuttgart — since 2019
think why NETFORMIC Animus Intelligence Crest Digital Veoma VERDURE
Book directly — the quickest way
Pick a 30-minute slot yourself
or send us a message

    No spam·No obligation·The fastest answer we can give·GDPR-compliant
    Prefer to call? +49 711 35 15 705
    Start on your own

    Two tools — ready to use right now

    Before you get in touch: work out the cost and explore the platform — free and without obligation.

    Free ISO 27001 check · 3 min

    Where does your ISMS stand?

    Readiness check: 10 questions on governance, risk management and controls. Your certification readiness in 3 minutes.

    Start the check

    Or do it yourself

    The ISMS platform for ISO 27001 — and 10 further standards

    Digitalise your entire ISO 27001 management system in a multi-standard ISMS. With an AI copilot, templates and the audit guide — without external consulting costs.

    • Multi-standard ISMS
    • AI copilot & templates
    • Audit guide
    • Cancellable monthly

    from €249

    / month · Starter with 1 standard

    Explore the platform
    Guide · PDF, 18 pages

    ISO 27001 guide for mid-sized companies

    Building information security step by step — explained plainly. 7 phases, cost table, readiness check, glossary.

    Download the guide
    Does this apply to you?

    Who needs ISO 27001?

    ISO 27001 matters to any company that works with sensitive data — above all when your clients or regulators require it.

    IT & software companies

    SaaS providers, system integrators, managed service providers — clients increasingly ask for proof.

    Health­care

    Hospitals, medtech, pharma — sensitive patient data calls for the highest security standards.

    Financial­ services

    Banks, insurers, funds — ISO 27001 is the basis for DORA compliance.

    Manufacturing & suppliers

    Automotive, mechanical engineering — OEMs and corporates require ISO 27001 of their suppliers.

    Public-sector buyers

    Tenders increasingly ask for proof of a certified ISMS.

    Growing companies

    Going international, enterprise clients — ISO 27001 opens doors and builds trust.

    The standard in brief

    What has to be in place for ISO 27001?

    Eight building blocks — the mandatory set for certification.

    1. Scope and context
    2. Risk analysis
    3. Statement of Applicability
    4. Policies and processes
    5. Annex A controls
    6. Internal audit
    7. Management review
    8. Certification audit

    In the initial call we show you which points you already meet.

    Book a free initial assessment
    The standard at a glance

    Clauses 4–10 — requirements for your ISMS

    ISO 27001:2022 sets out in 7 clauses how an information security management system is built, operated and improved.

    Show clauses 4–10 Collapse clauses
    Clause 4
    Context of the organisation
    Understand your environment and the expectations of interested parties, and define the scope of your ISMS.
    Clause 5
    Leadership
    Top management commitment, the information security policy, and the assignment of roles and responsibilities.
    Clause 6
    Planning
    Risk assessment, risk treatment and information security objectives with the matching action plan.
    Clause 7
    Support
    Resources, competence, awareness, communication and documented information.
    Clause 8
    Operation
    Operational planning, carrying out the risk assessment and implementing the risk treatment plan.
    Clause 9
    Performance evaluation
    Monitoring, measurement, analysis, internal audit and management review.
    Clause 10
    Improvement
    Nonconformities, corrective action and continual improvement of the ISMS.

    PDCA cycle

    Clauses 6–10 form the Plan-Do-Check-Act cycle — the heart of every ISMS.

    Annex A

    93 controls in 4 categories

    Annex A defines 93 security controls that you assess and implement in your Statement of Applicability (SoA).

    Show the 93 controls Collapse controls
    37
    Organisational
    A.5 — policies, roles, inventory, classification
    8
    People
    A.6 — screening, training, disciplinary process
    14
    Physical
    A.7 — access control, equipment, media
    34
    Technological
    A.8 — access, cryptography, logging, networks
    The route to the certificate

    Clarity on ISO 27001 certification in 6 steps to certification

    This is how a typical ISO 27001 project with us runs.

    1

    Gap analysis & scoping

    We analyse where you stand, identify the gaps and define the scope of your ISMS.

    Week 1–2
    2

    Risk analysis & controls

    Systematic risk assessment, selection of the relevant Annex A controls and preparation of the SoA.

    Week 3–6
    3

    Documentation

    Producing every policy, procedure and piece of evidence — with our 100+ audit-proven templates.

    Week 5–12
    4

    Implementation & training

    Putting measures in place, training staff, setting up the ISMS platform and embedding the processes.

    Week 8–16
    5

    Internal audit

    The dress rehearsal: we check your ISMS for conformity and draw up an action plan for anything open.

    Week 14–18
    6

    Certification audit (DQS / TÜV)

    Stage 1 (document review) + stage 2 (on-site audit). We are with you through both.

    Week 18–24
    More than just ISO 27001

    ISO 27001 as the foundation for further standards

    ISO 27001 shares 40–80% of its requirements with other standards. Build it once and every further compliance project benefits.

    Overlap with ISO 27001

    This share of the requirements is already covered by ISO 27001:

    ~80%
    TISAX
    ~70%
    ISO 42001
    ~65%
    GDPR
    ~60%
    NIS-2
    ~60%
    DORA
    ~50%
    EU AI Act
    Frequently asked questions

    What you probably want to know

    What exactly is ISO 27001, and why do I need it?
    ISO 27001 is the international standard for information security management systems (ISMS). Certification shows that your company handles information security systematically. More and more clients, partners and tenders take it as a given.
    How long does certification take?
    With our full-service support, typically 4–6 months. Doing it yourself, reckon on 6–12 months. The exact duration depends on company size, sector and internal resources.
    What does ISO 27001 certification cost?
    The total is made up of consulting and the external certification audit. For small companies consulting starts at 6,000 € (start-up), plus the certification body's audit. Use our detailed cost calculator for a precise estimate based on your company size.
    What is the difference between ISO 27001:2013 and :2022?
    ISO 27001:2022 is the current version. The main clauses (4–10) were adjusted slightly, Annex A was consolidated from 114 to 93 controls and extended by 11 new ones (among them cloud security, threat intelligence and data masking). All new certifications already follow :2022.
    Do I need an information security officer?
    Yes, ISO 27001 requires a responsible person. The role can be filled internally or outsourced to us as your external security officer (from €399/month).
    Does ISO 27001 also help with NIS-2, DORA or TISAX?
    Considerably. ISO 27001 covers 50–80% of the requirements of other standards. TISAX builds ~80% on ISO 27001, NIS-2 ~60% and DORA likewise ~60%. With ISO 27001 as the foundation you save a great deal of time and money on every further standard.
    How much internal work does this really mean for us?
    A conventional ISO 27001 project typically adds up to 60–80 person-days (workshops, writing documents, collecting evidence, reviews). With our approach plus the ISMS platform we bring that down to 25–30 person-days — because we do the bulk of it: preparing documents, proposing risks, pulling evidence automatically from your systems. Your team reviews, decides and signs off.
    What happens after certification? How often do I have to be audited?
    ISO certificates are valid for 3 years, but every year there is a surveillance audit. In year four the recertification audit is due. With our ISMS platform all evidence, documents and audit trails stay current. On request we take over day-to-day operation entirely (External security officer from €399/month).
    When is full service worth it, and when is self-service enough?
    Full service (from €6,000) is the right choice if you have little internal capacity, want a first certification without risk and need fixed dates. Self-service (from €249/month) suits you if your team has compliance experience, you want to implement it yourselves and add consulting as needed. You can switch to full service at any time — the work you have done stays in the platform. In the initial call we work out together which fits.
    What happens if we do not pass the audit?
    For minor nonconformities you typically get 30–90 days to put things right — the certificate is issued once they are closed. For major nonconformities a repeat audit is needed. In our full-service projects the first-audit pass rate has been 100% so far, because we run an internal audit and a dress rehearsal with you before the external audit.
    Is a spreadsheet enough, or do we really need ISMS software?
    A spreadsheet works — until an auditor's first spot check. Version history, provability, the audit trail, links in the risk matrix, permissions and preparing for recertification quickly become the bottleneck. Our ISMS platform covers all 93 Annex A controls, has templates for every clause and connects to tools such as Microsoft 365, Jira and Slack.