1. ISO 27001 implementation costs.
How much cost in addition to time you will spend implementing an ISO 27001 depends on several factors. It starts with the current state of information security within your organization:
- Do you already have policies on handling information?
- Do you already have a management system related to information security?
- Have you already mapped out processes?
Factors such as company size and complexity also play a role. This is determined by the number of employees, locations, products and services, and the diversity of your processes. Size is not necessarily an indicator of complexity; a small company with multiple processes can be just as complex.
Every organization is different, which is why we offer two types of implementation processes:
Accompanying implementation process
In this process, we provide coaching and advice on the implementation of the management system and related policy documents.
Workload
Within your organization, we expect approximately the following workload expressed in number of hours per week. Please note that this is an estimate.
Unburdening implementation process
In this process, we take full responsibility for a successful implementation from you. Our consultant relieves your organization and takes you from A to Z during the process.
Workload
Within your organization, we expect approximately the following workload expressed in number of hours per week. Please note that this is an estimate.
(a) Technical Measures
Securing information almost always requires implementing technical measures such as firewalls, antivirus software and access control systems. These measures involve costs such as licenses, hardware and maintenance.
(b) Software
In addition to technical measures, organizations often need to acquire and integrate security software. This involves not only the visible cost of software licenses, but also hidden costs, such as the time and resources required for implementation.
(c) Employees
ISO 27001 also tests whether your employees are aware of the policies and security controls. This requires training, which takes time. Both for the participants and the trainer. Management must also be involved in the implementation process and set aside time for policy development and compliance.
2. Audit Costs ISO 27001
To become ISO 27001 certified, the system must be audited. First through an internal audit, then with an external audit and then with surveillance audits.
This follows a 3-year cycle. In year 1, you have the internal audit, followed by control audits in years 2 and 3. Then, in year 4, comes the recertification audit. Again, the recertification audit works the same way as the audit to obtain the certificate initially.
Internal Audit: Internal audits are necessary to obtain and maintain your ISO 27001 certification. This mandatory part of the standard comes with costs such as your staff's time and finding a suitable independent auditor.
External Audit: If you implement ISO 27001, you won't escape an external audit to achieve certification. Auditors will carefully check your compliance with the standard and take at least several days to do so. The exact cost varies, but can be significant.
Control audit: The control audit is part of the audit cycle for ISO 27001 certification. This audit looks again at compliance with the standard, but unlike the external audit, the control audit focuses on confirming that you are still in compliance with ISO 27001 in the intervening years between recertification. These audits take place in years 2 and 3 of the 3-year cycle. The cost of these surveillance audits is lower than the external audit.
The ISO defines how much time an audit should take, with no exceptions. However, there are mitigating factors such as the age of the management system and the number of FTEs. When there are sufficient mitigating factors, a maximum of 30% reduction in audit time is allowed. We always aim for this 30%. Read more about this in our blog on partnerships with Certifying Bodies.
3. Maintenance of the management system
ISO 27001 is not a one-time effort. The system must be continuously maintained and updated to remain relevant. This means ongoing costs for monitoring, reporting and evaluation. A Security Officer spends a few hours to a day a week on this maintenance. Again, this depends on the size and complexity of your organization.
At Fendix, we find that clients prefer to have us do this. This is why 98% of our clients also purchase a maintenance package after implementation. At Fendix, 98% of our clients have maintenance done by us after implementation. We have several packages for this, see.
Comparison: DIY vs. Consultant
When considering ISO 27001 implementation, evaluate the cost of doing it yourself versus hiring a consultant. While doing it yourself can save direct costs, for most organizations a consultant who has been through the full implementation process dozens of times is well worth the investment.
A consultant can save your organization a lot of time and stress:
- Templates
- Expertise and eravring
- Independent review
- Network of experts
If your organization has ample time and resources, you can take the initiative yourself. In practice, we see that this is often not the case. That's why we offer different implementation paths that fit your organization's needs. When your organization has little time and budget, our unburdening process is the best choice. We take responsibility for implementing the standard. If your organization wants to be more involved and deal with certain aspects itself, our support traject ory is the best choice.
Investment
To determine whether an ISO 27001 is worth the cost, you must also consider what it will benefit your organization in the long run. Our customers cite the following benefits of their ISO.
- Better protection of sensitive data against threats and risks
- Increased trust and reputation with customers, partners and stakeholders
- Legal compliance such as the AVG
- Improved internal processes
Want to know exactly what an ISO 27001 will cost your organization: request a quote or schedule a no-obligation consultation.
