Full-service compliance

Full-Service ISO 27001

Your compliance. Our route.
One fair price.

Classic consulting ~100 person-days in total
75 PDon your side 25 PDexternal consultant
With iso-easy full-service ~75 person-days in total  ·  28 on your side
28 PDon your side 47 PDwe take on
–63 % less internal effort for your team

We do the heavy lifting for you. Personal guidance plus the ISMS platform cut your internal effort by ~63% and your total cost by ~55% compared with classic consulting. Up to 80% of the routine work is handled by our ISMS automatically. Fixed price. 4–14 months depending on the standard. 11 standards. And we stay on after certification.

Free first consultation
Implement several standards together Several standards share documents, risks and evidence — that saves effort, not just money.
See the standards

Three packages — by company size

The effort depends less on the standard than on your organisation. So we size the engagement by company size — and name the price up front.

up to 5 employees

Start-up

For young companies that need a certificate early — usually because a customer asks for it.

  • 7 consulting days to suit your needs
  • Guidance through initial certification
  • Gap analysis and action plan
  • One fixed point of contact
from 6,000 €one-off · plus the certification audit
Request a quote →
Most chosen
6–50 employees

Full-Service M

The common case in mid-sized companies: we build the management system, you keep running the business.

  • Building the complete management system
  • Documents, risks and evidence
  • Internal audit and management review
  • Guidance all the way to the certificate
from 12,000 €per standard · plus the certification audit
Request a quote →
51–100 employees

Full-Service L

For grown organisations with several divisions and a more complex scope.

  • Everything in Full-Service M
  • A larger scope and more people involved
  • Coordination across departmental lines
  • We are there on audit day
from 19,900 €per standard · plus the certification audit
Request a quote →

Every package includes guidance up to the certification audit. The ISMS platform we work in together is booked separately, from 249 € a month. The fixed price is set after a free scoping workshop — including for organisations above 100 employees.

Which standard does your company need right now?

Click through — every standard with its scope of work and a direct route to the cost calculator. The prices shown are for Full-Service M (6–50 employees); for Start-up and Full-Service L the entry price shifts accordingly. GDPR and Whistleblowing sit below that — they are self-contained, smaller mandates without building a full management system.

ISO 27001 — information security

A certifiable ISMS to ISO/IEC 27001:2022 · Annex A with 93 controls

Full-Service6.000 – 19.900 €

What is included

  • Gap analysis & scoping — current state, scope
  • A complete document set (SoA, policies, procedures)
  • Risk analysis, control selection (93 Annex A controls)
  • Staff training & awareness campaign
  • Internal audit (the dress rehearsal) including an action plan
  • Support through the Stage 1 and Stage 2 certification audit (DQS/TÜV)
  • Setting up your ISMS platform (25+ modules) — subscription separate
Market price
25.000 – 80.000 €
Start-up · up to 5
from 6,000 €
Full-Service M · 6–50
from 12,000 €
Full-Service L · 51–100
from 19,900 €
Timeframe
18–24 weeks
Certificate
ISO 27001:2022 (valid for 3 years)
ISO 27001 cost calculator About this standard

NIS-2 — the EU cybersecurity directive

Meeting the NIS-2 duties · no certificate, but mandatory

Full-Service4.900 – 16.300 €

What is included

  • Scope assessment (essential / important / out of scope)
  • Risk management concept under NIS-2 Art. 21
  • 10 packages of technical & organisational measures
  • Setting up the reporting processes (24h / 72h / 1 month)
  • Management training (personal liability)
  • Supplier management to NIS-2 requirements
  • Setting up your ISMS platform to carry the evidence — subscription separate
Market price
15.000 – 40.000 €
Start-up · up to 5
from 4,900 €
Full-Service M · 6–50
from 9,800 €
Full-Service L · 51–100
from 16,300 €
Timeframe
12–16 weeks
Evidence
Implementation documentation for the regulator
NIS-2 cost calculator About this standard

DORA — Digital Operational Resilience Act

The EU regulation for the financial sector · ICT risk management, incident reporting, third parties

Full-Service9.000 – 29.900 €

What is included

  • ICT risk management framework (Art. 5–14)
  • ICT incident classification & reporting duties (Art. 17–23)
  • Resilience testing & threat-led penetration testing (TLPT)
  • The ICT third-party register (Art. 28–30) — complete
  • Information sharing with other financial institutions
  • Support in communicating with the supervisory authority (BaFin)
  • Setting up your ISMS platform with the DORA workflows — subscription separate
Market price
on request
Start-up · up to 5
from 9,000 €
Full-Service M · 6–50
from 18,000 €
Full-Service L · 51–100
from 29,900 €
Timeframe
20–28 weeks
Who it applies to
Financial services (banks, insurers, payment providers)
DORA cost calculator About this standard

TISAX — automotive information security

The VDA ISA catalogue (assessment level AL 2/AL 3) · effectively mandatory for OEM suppliers

Full-Service7.000 – 23.200 €

What is included

  • Scope definition (prototype protection, personal data)
  • The VDA ISA catalogue — every relevant control (AL 2 or AL 3)
  • Documentation to VDA requirements (policies, processes)
  • Preparing the self-assessment in the ENX portal
  • Support through the external audit (audit provider)
  • Corrective actions after audit findings
  • Setting up your ISMS platform with the VDA-ISA mapping — subscription separate
Market price
20.000 – 60.000 €
Start-up · up to 5
from 7,000 €
Full-Service M · 6–50
from 14,000 €
Full-Service L · 51–100
from 23,200 €
Timeframe
16–22 weeks
Label
A TISAX label in the ENX portal (valid for 3 years)
TISAX cost calculator About this standard

GDPR — General Data Protection Regulation

Full GDPR implementation + an external data protection officer (DPO)

Full-Service3.500 – 11.500 €+ DPO from 300 €/mo.

What is included

  • The record of processing activities, complete
  • Data protection impact assessments for high-risk processing
  • Data processing agreements with every provider
  • A process for data-subject rights (access, erasure, objection)
  • A breach notification process (the 72-hour duty)
  • Staff training & ongoing awareness
  • An external DPO — appointment, support, annual audits
Market price
8,000–25,000 € + DPO
Scope
A self-contained mandate — no management system to build, so it sits below Full-Service M
Start-up · up to 5
from 3,500 €
Full-Service M · 6–50
from 6,900 € + 300 €/mo. DPO
Full-Service L · 51–100
from 11,500 €
Timeframe
8–12 weeks to build
Evidence
A GDPR compliance pack (Art. 5 accountability)
GDPR cost calculator About this standard

Whistleblowing — EU Whistleblower Directive

A reporting-channel system for companies with 50+ staff · mandatory since July 2023

Full-Service750 – 2.500 €+ operation 99 €/mo.

What is included

  • An internal reporting channel — compliant with the German implementation (HinSchG §§ 13–22)
  • A digital platform (anonymous, EU-hosted, multilingual)
  • Documentation of the reporting process & the policy
  • Running the reporting channel for you (case handling, deadlines)
  • Staff communication & training
  • An annual report & statistics for the authorities
  • Escalation to the federal reporting office where needed
Market price
2,000–8,000 € + operation
Scope
A self-contained mandate — a reporting-channel system, not a management system
Start-up · up to 5
from 750 €
Full-Service M · 6–50
from 1,490 € + 99 €/mo.
Full-Service L · 51–100
from 2,500 €
Timeframe
2–4 weeks
Required for
Companies with 50 or more employees
Whistleblowing cost calculator About this standard

EU AI Act — the AI regulation

Risk classification & compliance for AI systems · mandatory from 2026

Full-Service5.900 – 19.600 €

What is included

  • An AI system inventory & risk classification (prohibited / high / limited / minimal)
  • Conformity assessment for high-risk AI systems
  • Technical documentation under Annex IV
  • A quality management system for AI (Art. 17)
  • Data governance & training-data quality (Art. 10)
  • Transparency obligations & user information
  • Setting up your ISMS platform with the AI workflows — subscription separate
Market price
20.000 – 70.000 €
Start-up · up to 5
from 5,900 €
Full-Service M · 6–50
from 11,800 €
Full-Service L · 51–100
from 19,600 €
Timeframe
14–20 weeks
Combination
Often done together with ISO 42001
EU AI Act cost calculator About this standard

ISO 42001 — AI management system NEW

The first certifiable management system for artificial intelligence

Full-Service9.000 – 29.900 €

What is included

  • Building the AI management system to ISO 42001:2023
  • A complete document set (policies, procedures, records)
  • AI risk assessment & ethical review
  • Data management & AI lifecycle processes
  • Combines with ISO 27001 — one integrated management system
  • Internal audit and management review
  • Support through the Stage 1 and Stage 2 certification audit
Market price
25.000 – 75.000 €
Start-up · up to 5
from 9,000 €
Full-Service M · 6–50
from 18,000 €
Full-Service L · 51–100
from 29,900 €
Timeframe
18–24 weeks
Synergy
ISO 27001 and 42001 share the Annex A mapping
ISO 42001 cost calculator About this standard

CRA — Cyber Resilience Act NEW

The EU regulation for products with digital elements · a precondition for CE marking

Full-Service7.500 – 24.900 €

What is included

  • Product classification & scope (default, important, critical)
  • Anchoring security by design in the development process
  • Building an SBOM and maintaining it across the lifecycle
  • Vulnerability management and an update policy
  • Technical documentation under Annex VII
  • The reporting process to ENISA (24 h / 72 h / 14 days)
  • Conformity assessment and the EU declaration of conformity
  • Setting up your ISMS platform with the CRA workflows — subscription separate
Start-up · up to 5
from 7,500 €
Full-Service M · 6–50
from 15,000 €
Full-Service L · 51–100
from 24,900 €
Timeframe
16–22 weeks
Deadlines
Reporting duties from 11 Sept 2026 · full application from 11 Dec 2027
Combination
Often done together with ISO 27001 and NIS-2
CRA cost calculator About this standard

BSI IT-Grundschutz — the German BSI standards NEW

Germany’s own route to information security · recognised by federal, state and local government

Full-Service12.000 – 39.900 €

What is included

  • Structure analysis and protection-requirement assessment (BSI standard 200-2)
  • Modelling with the IT-Grundschutz compendium (107 modules)
  • The IT-Grundschutz check across every relevant requirement
  • Risk analysis to BSI standard 200-3 where protection needs are high
  • Continuity management to BSI standard 200-4
  • Reference documents A.0 to A.6 for the auditor
  • Support through the certification audit
  • Setting up your ISMS platform with the full compendium — subscription separate
Start-up · up to 5
from 12,000 €
Full-Service M · 6–50
from 24,000 €
Full-Service L · 51–100
from 39,900 €
Timeframe
8–14 months to certification readiness
Certificate
ISO 27001 on the basis of IT-Grundschutz (valid for 3 years)
Recognised by
Federal, state and local government and critical-infrastructure operators
IT-Grundschutz cost calculator About this standard

EN 9100 — aerospace NEW

Quality management to the IAQG rules · built on ISO 9001:2015

Full-Service8.000 – 26.600 €

What is included

  • A quality management system and process map to EN 9100:2018
  • Building the delta out of an existing ISO 9001
  • Configuration management across the product lifecycle
  • First article inspection (FAI) to EN 9102
  • Supplier assessment and counterfeit-part prevention
  • Internal audit and management review
  • Support through the certification audit, including the OASIS listing
Start-up · up to 5
from 8,000 €
Full-Service M · 6–50
from 16,000 €
Full-Service L · 51–100
from 26,600 €
Timeframe
6–10 months to certification readiness
Certificate
EN 9100:2018 (listed in OASIS)
Market access
Airbus, Boeing and their supply chains
EN 9100 cost calculator About this standard
A note on the market prices: The comparison prices shown are based on typical consulting mandates (our own survey, the BSI market analysis 2025, the secjur ISO 27001 market report 2026, DORA studies by metafinanz/PwC). Actual quotes vary with company size, scope, sector and how prepared you already are.
A free first assessment

Your compliance package, talked through in 30 minutes

Pick the standard or standards you want to implement above — we come back with a fixed-price quote within 24 hours.

Lead Consultant
Lead Consultant
Your contact
  • A quick reply — usually the same working day
  • Realistic timelines and costs
  • No sales pressure, no obligation
  • By notivia GmbH, Stuttgart — since 2019
think why NETFORMIC Animus Intelligence Crest Digital Veoma VERDURE
Book directly — the fastest way
Pick your own 30-minute slot
or write to us

    No spam·No obligation·Quick reply·GDPR compliant
    Prefer to call? +49 711 35 15 705

    Your route to compliance — in 4 phases

    Whatever the standard, we follow the same proven route. You always know where you stand.

    1

    Gap analysis & scope

    We analyse your current state, identify the gaps and define the scope.

    2

    Build & documentation

    Risk management, controls, policies — we build it all with your teams and 100+ templates.

    3

    Internal audit

    The dress rehearsal before certification. We find the weak spots before the external auditor does.

    4

    Certification

    Support through Stage 1 and Stage 2 at the audit provider (DQS, TÜV, BSI-accredited).

    Why full-service with iso-easy.de?

    Personal guidance

    Murat himself. No junior, no hand-off between teams. Workshops, reviews, audit preparation — all from one person.

    ISMS automation

    An AI copilot, 230 systems through one-click inference, the SoA mapped automatically. Up to 80% fewer internal hours.

    And after certification too

    The certificate is only the beginning. An external security officer from 500 €/mo. optional, maintained automatically, with an audit trail. You do not have to touch it all again.

    The work happens in the ISMS platform

    Documents, risks and evidence are created right there — you and we always see the same state. The subscription is booked separately: 249 € for one standard, up to 999 € for all eleven, per month.

    See the platform
    FAQ

    Frequently asked questions

    Who does the work — Murat himself or a junior consultant?

    There is no pyramid of junior consultants at iso-easy. Murat Aygan takes you through all four phases himself — gap analysis, build, internal audit and certification. On larger mandates, specialists from the notivia network join in (for DORA threat-led penetration testing, say, or ISO 42001 AI risk assessment).

    Our promise: your main point of contact stays the same for the whole project.

    What happens if the scope changes during the project?

    Small adjustments (an extra site, a few more applications) are covered by the fixed price — we deliberately build in headroom.

    For substantial changes of scope (new subsidiaries, say, or a whole new business unit) we put a clear change quote in front of you first. You decide whether it goes ahead — no autopilot, no hidden surcharges.

    What does the certificate guarantee actually mean?

    If, after our programme, you do not pass the external Stage 2 certification audit at an accredited provider (DQS, TÜV, BSI and so on), we stay with you at no cost until you do — including rework on documents, a fresh internal audit preparation and support at the repeat audit.

    On one condition: you followed our recommendations and kept to the dates. Details in our terms, § 6.

    Do I have to take the ISMS platform to book full-service?

    Yes — the ISMS platform is the tool we use to build your compliance content together, document it and prepare it for the audit. The subscription is not included in the full-service price; it runs separately.

    The price follows the number of standards: Starter 249 € (1), Business 399 € (3), Professional 599 € (6), Enterprise 999 € (all 11) per month, plus 199 € for each additional tenant. We handle the setup as part of the mandate — you keep all data, templates, risk analyses and audit trails. No vendor lock-in: export to PDF or XLSX whenever you want.

    Can we stop after phase 1, the gap analysis?

    Yes. Phase 1 runs as its own short contract (typically 1,500–3,500 €, depending on the standard) and gives you an independent gap report with an effort estimate. If you decide against iso-easy afterwards, the report is yours — take it to another consultant or carry on in-house.

    Fair play: we want mandates that suit us.

    How quickly can we realistically get the certificate?

    Initial certifications on our programme typically take 4–8 months to a passed Stage 2 audit. For EN 9100 reckon on 6–10 months, for IT-Grundschutz 8–14. Three things decide the exact duration:

    How prepared you are: with a documented ISMS already in place you are 6–8 weeks faster. Your team’s availability: plan for roughly 2–4 hours a week per department involved. Auditor capacity: DQS and TÜV need 6–12 weeks’ lead time for Stage 2 — we book the date early.