ISO 27001 Certification for SMEs: Steps, Costs and Timeline

ISO 27001 is turning up more and more often in tenders, supplier assessments and customer contracts. For SMEs, that raises a fair question: what exactly is ISO 27001, what does certification cost, how long does it take, and is it worth the investment? In this guide we set out the journey for an SME honestly, including what has changed since the standard was thoroughly revised in 2022.

What is ISO 27001?

ISO/IEC 27001 is the international standard for information security. Its core idea is that you don't just take a handful of standalone technical measures, but set up an Information Security Management System (ISMS): an ongoing system for identifying, treating and monitoring risks, which makes information security part of how your organisation works.

ISO 27001 requires both policies and processes (who is responsible, how you handle incidents, how you measure that it works) and concrete security controls, known as the Annex A controls. The standard doesn't prescribe exactly what every organisation must do, but it does describe how to determine, on a risk basis, what you need. That makes a certificate more than a box ticked: it is proof that you have organised your information security seriously and structurally.

ISO 27001:2022 versus 2013

The standard was substantially revised in October 2022. Certificates issued against the old (2013) version automatically expired on 1 November 2025. An SME starting now will therefore always certify against ISO 27001:2022.

The most visible change is in Annex A. The old version had 114 controls across 14 domains; the new version has 93 across 4 themes: organisational, people, physical and technological. That reduction isn't a weakening: 56 old controls were merged into 24 new ones, and 11 entirely new controls were added covering topics such as threat intelligence, ICT readiness for business continuity, data leakage prevention, secure coding and information deletion. As a result, the standard is better aligned with modern risks.

Why ISO 27001 for SMEs?

For SMEs that don't supply government or aren't publicly listed suppliers, ISO 27001 can sometimes feel like overkill. Yet we see the standard appearing in ever wider circles, for four reasons:

1. Customer requests and tenders. Larger customers expect demonstrable information security from their suppliers, and an ISO 27001 certificate is the most widely recognised form of it.
2. NIS2 and sector regulation. A well-designed ISMS covers much of what NIS2 requires in terms of risk management and governance. Our guide to NIS2 compliance in the Netherlands explains how this works in practice.
3. Cyber insurers. A certificate often helps secure more favourable premiums and faster claims handling.
4. Internal discipline. An ISMS brings order to an area that is handled in a fragmented way in many SMEs.

The process step by step

ISO 27001 is built on the Plan-Do-Check-Act (PDCA) cycle. For an SME, a typical journey looks roughly like this:

1. Preparation and scope

Decide what you are certifying (the whole organisation, or a specific business unit or service), which information falls within scope, and who owns the project. Don't underestimate this step: too broad a scope makes the process unnecessarily heavy, too narrow a scope makes the certificate less valuable.

2. Risk assessment

Identify your information assets, threats and vulnerabilities, and weigh each risk as likelihood times impact. Based on that, you draw up a risk treatment plan: for each risk you decide whether to accept, reduce, share or avoid it.

3. Statement of Applicability (SoA)

This is where you choose which of the 93 Annex A controls you will implement, and justify why you exclude any. The SoA is one of the central documents of the ISMS and is always reviewed during the audit.

4. Implementation

Putting the chosen controls in place: from access management, encryption and patch management to incident procedures, supplier management and awareness training. On the technical side, it helps if you have implemented MFA properly, have a solid backup strategy and pay regular attention to security awareness.

5. Internal audit and management review

Before the external certification body arrives, you audit your own ISMS. You record what is going well, what isn't, and which improvement actions are under way. Senior management formally evaluates how the ISMS is performing in a management review.

6. Stage 1 audit

An accredited certification body (CB) carries out a documentation audit: is the ISMS properly designed, does it cover the scope, and is it ready for the operational audit?

7. Stage 2 audit

The CB visits for the operational audit. Does the ISMS work in practice as described? Expect questions, sampling and interviews with employees. If the outcome is positive, the certificate follows.

8. Surveillance and recertification

The certificate is valid for 3 years. In years 1 and 2 there are annual surveillance audits, and in year 3 a recertification. So the ISMS keeps running, well beyond the first audit.

How long does ISO 27001 take?

An honest rule of thumb for an SME: 6 to 12 months from decision to certificate. Organisations that already have high maturity and arrange good support sometimes manage it in 4 to 6 months. More complex organisations, or projects where a lot has to happen in parallel, can easily take 12 to 18 months.

The timeline is mainly determined by three things: how mature your security already is, how many hours the project team frees up, and how large the scope is. Businesses that treat the project as something to do "on the side" of operations often fall behind. A steady pace of a few hours a week per person involved works better than short sprints.

What does ISO 27001 cost an SME?

Honesty has to come first here: there is no fixed price. There are, however, three typical approaches, each with its own cost range.

• Fully in-house with templates. The cheapest in direct costs (roughly €10,000 to €30,000), but it takes a heavy toll on internal time and often takes 12 to 24 months. Suitable for organisations with an experienced security or compliance employee.
• With an external consultancy. Higher direct costs (roughly €40,000 to €120,000 for an SME, depending on size and complexity), but a much shorter timeline and less pressure on your own people.
• With a compliance automation platform. A middle option using a software platform that automates much of the documentation and evidence collection; often around €25,000 to €80,000 in the first year.

On top of that comes the external audit by the certification body: for an SME scope, Stage 1 and Stage 2 together often add up to around €8,000 to €15,000, followed by annual surveillance audits of around €3,000 to €5,000.

What many people underestimate: the biggest cost item is internal time. Consultants' estimates often put 50 to 70 percent of the total cost down to the "hidden" time your own employees spend. If you try to get through the process without the relief a partner provides, you pay it back in hours and in project delays.

Which pitfalls do we see most often?

With SMEs that take on the process themselves, we keep coming across the same patterns:

• Too broad a scope. "Let's do the whole organisation straight away" sounds logical, but makes the process much heavier and doesn't always produce a more suitable certificate.
• Documents that don't work in practice. The ISMS exists only on paper; in reality nobody follows the policy. An auditor will notice within half an hour.
• No risk-based approach. Trying rigidly to implement all 93 controls rather than choosing, on a risk basis, what fits. That is expensive and gets in the way of operations.
• A one-off project instead of a system. After the audit, maintenance grinds to a halt, resulting in a difficult surveillance audit a year later.
• No buy-in from senior management. ISO 27001 explicitly requires direction from management. Without it, it remains an IT-only affair.

An experienced external partner can spot these pitfalls early and save you a great deal of time.

How an IT partner makes the difference

ISO 27001 isn't purely an IT matter: it touches HR, legal, supplier management and senior management. But the technical controls make up half of the work, and that is where a specialist IT partner makes a big difference.

A managed IT partner that is itself ISO 27001 certified brings two things: standardised processes that already address the Annex A controls (logging, patching, backup, access management), and experience of what an auditor will and won't accept as evidence. That saves months of frustration over small documentation questions.

For your broader security set-up, such as email security, endpoint management, monitoring and awareness, our cybersecurity service fits well with an ISMS under construction. And if you want to see how ISO 27001 connects with other compliance requirements in your sector, read our guide to DORA compliance for the financial sector for context on how structured risk management works today.

Is ISO 27001 worth the investment?

Honest answer: not for every SME. If you have no customers asking for it, feel no regulatory pressure and have no ambition to professionalise your security structurally, an ISO 27001 certificate is an expensive way to achieve something that can be done more lightly.

But as soon as one of those drivers does apply, the picture changes. A well-run ISMS prevents incidents, speeds up customer audits, makes it easier to comply with NIS2 and gives your staff clear frameworks. For growing SMEs with customers in finance, healthcare, manufacturing or government, ISO 27001 is often more of an entry ticket than a luxury.

Frequently asked questions about ISO 27001 for SMEs

What is ISO 27001 in a nutshell?

ISO 27001 is the international standard for information security. It requires an Information Security Management System: an ongoing system for identifying, treating and controlling risks, with the governance and technical measures that go with it. A certificate from an accredited body is proof that this system is demonstrably in operation.

What is the difference between ISO 27001:2022 and 2013?

The main body of the standard has changed only slightly; the biggest change is in Annex A. The 114 controls across 14 domains have been replaced by 93 controls across 4 themes: organisational, people, physical and technological. Eleven new controls have been added to address modern risks. Since 1 November 2025, certification is only possible against the 2022 version.

How long does an ISO 27001 project take for an SME?

For most SMEs it takes 6 to 12 months from decision to certificate. With high maturity at the outset and good guidance it can sometimes be done in 4 to 6 months; with a larger or more complex scope, 12 to 18 months is more likely. The timeline depends mainly on your starting point, your project capacity and the scope.

What does ISO 27001 certification cost?

The range: roughly €10,000 to €30,000 for a fully in-house implementation with templates, €25,000 to €80,000 with a compliance platform, and €40,000 to €120,000 with a consultancy. The external audit by a certification body often costs €8,000 to €15,000 for an SME scope, followed by surveillance audits of €3,000 to €5,000 a year. Expect internal time to be the largest cost item.

How long is the certificate valid?

An ISO 27001 certificate is valid for 3 years. Years 1 and 2 each include an annual surveillance audit, and year 3 a recertification. The ISMS therefore runs continuously, and information security becomes an ongoing process rather than a one-off project.

Does an ISO 27001 certificate help with NIS2 compliance?

A well-designed ISMS covers much of what NIS2 requires in terms of risk management, governance, incident handling and supplier management. An ISO 27001 certificate doesn't automatically release you from NIS2 obligations, but it makes demonstrating compliance considerably easier and gives you a structured framework for closing the gaps.

Conclusion

ISO 27001 isn't a quick win, but it is a well-considered investment for SMEs that want to professionalise their security seriously and for the long term. With a realistic scope, a risk-based approach and an experienced partner on board, certification within 6 to 12 months is very achievable, at a cost that matches what it delivers in customer trust, compliance and business resilience.

Want to know whether ISO 27001 is right for your business, or looking for a partner to guide you through the process? Call TRON Group on +31 85 303 5869 or take a look at our cybersecurity service. We are ISO 27001 certified ourselves, know the process from the inside, and help you set up an ISMS that doesn't just pass the audit but genuinely works in practice.