ISO 27001 internal audit
Achieve and maintain ISO 27001 compliance with a comprehensive internal audit conducted by our experienced auditors, who boast a 100% success rate.
ISO 27001 internal audit
Internal ISO 27001 audit by accredited lead auditors
Our experienced ISO 27001 auditors will assess your ISMS and control measures, identify bottlenecks, and tell you exactly what still needs to be done so that you pass the external audit without surprises.
Accredited lead auditors·On-site / remote·100% Success Rate Among Our Customers
Find out why 500+ Companies trust Nestor Security for IT security and compliance
The approach
How we make internal audit thorough, predictable and worry-free
Conducting the audit yourself
Colleagues review each other's work
✕Insufficient distance and knowledge of standards
✕Findings remain vague or incomplete
✕Uncertainty regarding the external audit
Recommended
Met Nestor Security
Independent, planned and demonstrable
✓Accredited lead auditors with experience in your sector
✓A concrete report with bottlenecks and next steps
✓Our customers' 100% passes the external final audit
The step-by-step plan
This is how an ISO 27001 audit by Nestor Security goes
From scoping to next steps: a clear process in which you know at all times what is happening, who we need, and what it yields.
STEP 1
Scoping and planning
- Together we determine the scope of the audit: which processes, locations and control measures
- We are drawing up a comprehensive audit plan and will submit it to you for approval.
- The plan includes a detailed audit schedule with interviews and document review
- Everything tailored to your schedule, so daily work can simply continue
STEP 2
Execution: on-site or remote
- Our auditor will come to your location or work remotely, whichever suits best
- Interviews with process owners and review of your documentation
- Assessment of your ISMS and the Annex A control measures from your Statement of Applicability
- Gathering evidence to demonstrate that you meet the requirements
STEP 3
Report
- A targeted audit report, readable for both management and technical staff
- Bottlenecks and deviations ranked by risk
- Opportunities for improvement and recommendations per control measure
- Discussion of the findings with your team, so everyone knows what is on the table
STEP 4
Areas for improvement and next steps
- Advice on concrete action points regarding compliance
- Support in resolving discrepancies, if you wish
- Preparation for the management review and the external audit
- If desired, an annual repetition as a permanent part of your ISMS
Ready for the external audit
Following the internal audit, you know exactly where you stand. The findings have been resolved or scheduled, the evidence is ready, and your team knows what the external auditor will ask.
Free download
ISO 27001 Certification Guide
✓Understanding what your organization's internal and external audits require
✓Overview of the steps toward certification and how to maintain it
✓Free to download, no obligations
Success story: Effectory
Feedback analytics developers with a team of over 250 people
2
Standards internally audited: ISO 27001 and ISO 27701
1.200+
Organizations of which Effectory processes sensitive employee data
100%
Success during the external audits
The challenge
Effectory processes sensitive employee data for over 1,200 organizations and is certified for both ISO 27001 and ISO 27701. The annual internal audits needed to be independent and thorough, without disrupting daily operations.
The approach
Nestor Security handles the internal audits for both standards. With a dedicated contact person, a clear audit plan, and interviews with the right people, we test the management system precisely on the points that the external auditor focuses on.
The outcome
Effectory passes the external audits without any bottlenecks. The findings from the internal audits are concrete and actionable, making the ISMS stronger every year and enabling faster completion of customer security questionnaires.
Nestor Security conducted the internal audits for both ISO 27001 and ISO 27701 for us. They really strike the right chord for us with a great combination of quality and feasibility. They are pragmatic, think along well with our needs, and the audits are well-organized.
Wouter BuzingCISO, Effectory
Norm overlap
An integrated management system audit
Do you also work with NEN 7510, BIO, NIS2, or ISO 42001? Thanks to the significant overlap in control measures and processes, our auditors combine the internal audit wherever possible. That saves time for your employees and prevents duplicate interviews.
More than 90% overlap with NEN 7510
More than 90% overlap with BIO
More than 70% overlap with NIS2
A 50% overlap with ISO 42001
Our approach
How Nestor Security makes internal audit valuable
An internal audit is not a check-the-box exercise. We look for what can genuinely be improved and translate that into steps your organization can implement immediately.
Critical, but practical
We test rigorously, exactly as the certifying body does. At the same time, we keep the recommendations workable, so your team can get to work on them the next day instead of dreading them.
ISMS and Annex A fully in focus
From policy and risk assessment to the 93 controls: we assess the entire management system through interviews and documentation, and ask for the evidence that the external auditor will want to see later.
On-site or remote
Our auditors will come to you or work remotely. You choose what fits your organization and schedule, with minimal disruption to your daily work.
More knowledge within your own team
We explain why a finding is a finding. This helps your employees better understand the standard and puts your organization in a much stronger position for the next audit, internal or external.
Success stories
Don't just take it from us
You are in good company with Nestor.
ISO 27001
“Communication with Nestor Security was direct. The organization has a pragmatic approach and is a down-to-earth partner to do business with. As a result, the process went smoothly and quite quickly.â€
★★★★★
Pascal Kamphuis
Corpoflow
NEN 7510Privacy Officer
“We prefer to collaborate regionally as much as possible and like to hold meetings face-to-face. When you look at partners in the North, a few remain, and Nestor Security stood head and shoulders above the rest.â€
★★★★★
Irene Bernsen
Joyce-House
ISO 27001ISO 27701
“Nestor Security conducted the internal audits for ISO 27001 and ISO 27701 for us. They truly hit the right chord for us with a great combination of quality and feasibility. They are pragmatic, think along with our needs, and the audits are well executed.â€
★★★★★
Wouter Buzing
Effectory
For every moment in the cycle
An internal audit that fits
the phase in which your certification zit
First certification
You are facing your first external audit and want to be sure your ISMS is correct. Our internal audit shows what still needs to be done, so you can invite the certifying body with confidence.
Surveillance audits
Your certificate is valid for three years, with annual surveillance audits. We conduct the mandatory internal audit and keep your ISMS sharp between external milestones, ensuring it does not become a paper tiger.
Recertification
After three years, your entire management system is reassessed. A thorough internal audit beforehand prevents old non-conformities from suddenly reappearing and ensures you start the new cycle with a clean slate.
Contact
Get started with ISO 27001 right away?
Your questions answered
ISO 27001 audit FAQs
What is an ISO 27001 audit?
An ISO 27001 audit is a systematic assessment of your Information Security Management System (ISMS). The auditor evaluates whether your policies, processes, and controls meet the standard's requirements and whether they actually work in practice. This is done through interviews with employees, reviewing documentation, and requesting evidence.
There are two types: the internal audit, which you organize yourself or have performed by an independent party such as Nestor Security, and the external audit by a certifying body. The internal audit is mandatory and forms the best preparation for the external one.
How long does an internal audit take?
That depends on the size of your organization, the scope of the ISMS, and the number of locations. For an SME organization, the audit itself is often completed in one to several days, followed by the reporting. During the scoping phase, we will provide you with a concrete schedule in advance, so you know how much time you need to free up for your employees.
What does the internal audit cover?
The internal audit covers the entire ISMS: the context of the organization, leadership and policy, risk assessment and risk treatment, support, operation, evaluation, and improvement. In addition, we test the security controls from Annex A that are included in your Statement of Applicability.
You can choose to have everything audited at once, or spread it over multiple audits during the year. Both methods are permitted, as long as the entire system is covered within the cycle.
Who should be involved in an internal audit?
In any case, the owner of the ISMS, usually the CISO or security officer, and someone from the executive board. Furthermore, we speak with the process owners of the departments we assess, such as HR, IT, facilities, and procurement. During the closing meeting, we share the findings with management.
We coordinate in advance who we need and when, so that interviews remain brief and focused and no one has to take a whole day off.
What is the difference between an internal and an external ISO audit?
You organize the internal audit yourself, or have it performed by an independent party such as Nestor Security. The goal is to discover where the ISMS does not yet comply and to improve that before anyone else sees it. The external audit is conducted by a certification body and determines whether you obtain or retain the certificate.
As an external party, we are allowed to conduct your internal audit, but not your certification audit. Those two roles always remain separate, and that is precisely what makes the internal audit so valuable: you get the perspective of an auditor, with nothing at stake.