Support for ISO 27001 Certification

ISO 27001 is intended for all organizations, regardless of their size or industry —micro-businesses, small and medium-sized enterprises (SMEs), mid-sized companies, large corporations, and government agencies. It is particularly relevant for technology companies, service providers, healthcare and financial institutions, and any supplier that handles sensitive customer data.

The ISO 27001 certification process can be broken down into several phases (the estimates provided are for a company with about 20 employees and relatively simple products or organizational structure).

The cost of certification itself (certification body) — Over the course of each 3-year period, the cost of the certification body’s various services (initial audit, surveillance audit, and renewal audit) ranges from €10,000 to €15,000. As a reminder, the cycle for any ISO certification is 3 years.

The cost associated with the time spent on implementation — This refers to the hourly cost of staff temporarily assigned to implementing the SMSI. During key phases (two months at the start of the project and two months at the end), the time required for skills development amounts to between 1 and 2 person-days per week. During the project monitoring and coordination phases, the project manager’s workload amounts to 1 person-day per week.

Cost of ISO consulting and training — The cost of ISO 27001 certification varies depending on the size of the company. For an SME with 20 employees, this cost can range from €25,000 to €45,000. On average, it is around €30,000.

The time required to prepare for ISO 27001 certification depends on several key factors.

First of all, it depends on the organization’s level of maturity in terms of information security. If the organization has already implemented security processes or practices similar to the requirements of ISO 27001, the preparation process will be faster.

Second, the complexity of the SMSI plays a significant role. The scope of the SMSI, the size of the company, and the number of sites or entities to be included will directly affect the duration of the preparation process.

Generally speaking, preparing for ISO 27001 certification can take between 6 months and 1 year, but this will depend on each organization’s specific circumstances.

The ISMS (Information Security Management System) is the core framework required by ISO 27001. It encompasses the processes, security policies, governance structures, metrics, and tools needed to manage information-related risks on an ongoing basis. It covers technical, organizational, human, and physical aspects.

No. ISO 27001 certification is valid for three years, with mandatory annual surveillance audits. At the end of the three-year period, a renewal audit is conducted. This cycle ensures continuous improvement and maintains the value of the certification over time. FeelAgile offers support to help you prepare for each deadline with confidence.

An ISMS management tool allows you to centralize documentation,automate risk and action tracking, facilitate internal audits, and monitor performance metrics. Without a dedicated tool, compliance relies on scattered files that are difficult to maintain. Our platform Oversecur is designed specifically to simplify this management and reduce your team’s administrative burden.

Yes, they complement each other very well. ISO 27001 provides the operational framework—risk management, access control, encryption, incident response—that addresses many of the GDPR’s technical requirements. ISO 27001 certification does not replace GDPR compliance, but it significantly accelerates the process and demonstrates to regulators a structured and documented approach to personal data security.

A mock audit helps prepare for the certification body's audit. This audit serves as a practice run conducted under similar conditions, allowing the company to assess, through hands-on experience, its level of preparedness in terms of information security.

During the mock audit, the auditor takes an uncompromising, outside perspective on the key issues at stake. Teams are prepared for potential questions from the certifying body. This simulation, which replicates real-world conditions but carries no penalties, allows us to verify the effective implementation of the ISMS, identify any shortcomings, and ensure that the certification audit proceeds smoothly.

Depending on the scope of the ISO standard and the type of business, it can be completed in 2 to 5 days.

The key is to choose a certification body accredited by COFRAC (the French Accreditation Committee). This accreditation ensures that the certification body is qualified to assess your ISO 27001 implementation.

Other factors are also important: the certifier’s experience with the ISO 27000 series of standards, their reputation within your market (France or internationally), and their ability to handle multiple certifications if you are pursuing ISO 9001 or other standards.

Finally, it is essential to choose a certifying body that listens to your needs and is willing to take your choices into account (scope of application, selected measures, corporate culture). The certifying body must listen, but it cannot be both judge and jury.

It is entirely possible to implement ISO 27001 by strictly adhering to the standard without undergoing an audit to obtain certification. Some organizations choose this approach to establish a structured information security framework without the immediate goal of formal certification.