ISO 27001 implementation
ISO 27001 implementation with a pass rate of 100%
We practically implement your ISMS, together with your team, and remain involved until the certification is in place. So far, every organization we have guided has passed the external audit.
- On average, ready in 4 to 5 months, with 3 to 6 hours per week from your team
- Fixed price upfront, including internal audit by a certified lead auditor
- Pass Guarantee for the external audit, with no additional costs in the event of a re-audit
Trusted by 500+ companiesISO/IEC 27001:2022Also NEN 7510, BIO and NIS2
The lines of communication with Nestor Security were short. The organization is pragmatic and a down-to-earth party to do business with.
Pascal KamphuisCorpoflow
Schedule a no-obligation consultation
One of our ISO 27001 experts will contact you within one business day. We’ll discuss your situation, the timeline, and the costs.
How can we help you?
Response from an ISO 27001 consultant within one working day. Free of charge and without sales talk.
Find out why 500+ Companies trust Nestor Security for IT security and compliance
In this way, Nestor Security compares itself to other options
If you are considering multiple quotes, how does an ISO 27001 implementation compare to other consulting firms and compliance platforms?.
| Nestor Security | Other advisory firms | Compliance platforms | |
|---|---|---|---|
| Approach | Policies and procedures that suit your organization, so that your employees actually use them | Often based on standard templates | Templates and checklists, the filling in is up to you |
| Lead time | On average 4 to 5 months until the external audit | Often 6 months or longer | Depending on your own pace |
| Commitment to own team | On average 3 to 6 hours per week | Varies greatly by agency | Most of the work lies with your team |
| Risk analysis | Workshop with your key stakeholders, translated into a treatment plan | Usually included; the depth of coverage varies by agency | Risk register in the software, without guidance |
| Implementation | From policy to technical measures, together with your IT | Often advice is given on paper; the implementation is up to you. | Automatic checks, the execution is up to you |
| Internal audit | By a certified lead auditor, included as standard | Sometimes purchased separately from a third-party source | Not included, often through a partner |
| External audit | We prepare you and sit down with you | Support varies by agency | Exporting evidence to the auditor |
| Result | 100% of our customers have passed the external audit | Success rate rarely known | Depending on your own commitment |
| Costs | Fixed price upfront, no extra work without your approval | Often on an hourly basis, with the possibility of overtime | Annual license, guidance and audits separately |
| After certification | Assistance with surveillance audits, management reviews, and recertification | Often a new path per audit | Continuous monitoring; the follow-up is up to you |
This is how your ISO 27001 implementation works
A clear, four-phase approach, with a dedicated consultant serving as your point of contact. You’ll know each week what’s happening and what’s expected of your team.
Fundament and risk analysis
- Kick-off meeting with the management and your dedicated contact person
- Defining the scope and context of the ISMS
- Zero compliance with all the requirements of the standard
- Risk analysis workshop with your key stakeholders
Design and implementation
- Tailored policies and procedures, in the language of your organization
- Risk management plan and Declaration of Applicability
- Implement technical and organizational measures with your IT
- Supplier management, incident process and awareness training
Internal audit and management evaluation
- Internal audit by a certified lead auditor
- Solving findings together, well before the external audit
- Prepare and document management evaluation
- Final check of all mandatory documents
External audit and certification
- Help in choosing an accredited certification body
- Document review by the external auditor in Phase 1
- Stage 2 Certification Audit, with Us by Your Side
- Handle any findings immediately
Certificate obtained
Your ISO 27001 certificate is valid for three years, with surveillance audits in year 1 and 2 and a recertification in year 3. We will also remain involved after that if you wish.
The exact planning depends on the size of your organization and the measures that already exist. In the initial meeting, we will make that concrete for you.
Already a good foundation? Then it can be achieved in 10 to 12 weeks
If you have already taken a lot of steps, we will speed up the process. The same approach and the same internal audit, but with shorter phases and a tighter schedule. Do you recognize most of the points in this overview? Then you probably qualify.
Not that far yet?
No problem. Our regular course is designed specifically for organizations that are starting from scratch.
Your IT environment is in order
You work with modern cloud services and office software; access rights are properly managed; backups are performed; and changes don't go live without approval.
There is already a security policy
There are already agreements in place regarding, for example, passwords, laptops, working from home, and incidents, even if these have not yet been recorded in accordance with the standard.
You have experience with certification
You are already certified for, for example, ISO 9001 or NEN 7510, or you have previously completed a SOC 2 report or an extensive customer audit.
The management is behind it
There is a board member who follows the process, makes quick decisions and frees up time for the board review.
There is someone who can make time
An internal coordinator, such as an IT manager or security officer, can set aside about 6 to 8 hours per week over the next few weeks.
Success story of Effectory
Feedback analytics developers with a team of more than 250 people
Months before a project with ISO 27001 and ISO 27701
New security measures implemented
Success during the external audit
The challenge
Effectory processes sensitive employee data for over 1,200 organizations. The challenge was to continuously strengthen the information security system and have it grow with the high demands of customers, without disrupting daily services.
The approach
In close collaboration, we have refined the management system for both ISO 27001 and ISO 27701. With a dedicated point of contact, responsibilities have been clearly defined, processes secured, and the organization prepared for the external audit to achieve certification.
The outcome
Within 6 months, Effectory achieved ISO 27001 certification without any bottlenecks. Security is now demonstrably in order for customers, security questionnaires are answered more quickly, and a solid, future-proof foundation is in place.
Nestor Security conducted the internal audits for both ISO 27001 and ISO 27701 for us. They really strike the right chord for us with a great combination of quality and feasibility. They are pragmatic, think along well with our needs, and the audits are well-organized.
Wouter BuzingCISO, Effectory
Figure it out yourself, or have it taken care of right away
Implementing ISO 27001 itself seems cheaper, but it takes most organizations months of research and hundreds of internal hours. With Nestor Security, you know from the first week what needs to be done, who is doing what, and what the costs are.
Implementing it yourself
Slow, unpredictable and uncertain
Met Nestor Security
Guided, predictable and carefree
Only an internal audit needed?
Our certified lead auditors assess your ISMS in the same way the certifying body will do in the future, and tell you exactly what still needs to be done. Always at a fixed price.
The foundation you lay with ISO 27001 strengthens future compliance
ISO 27001 certification provides a significant head start on implementing additional standards, thanks to shared controls and processes.
More than 90% overlap with NEN 7510
More than 90% overlap with BIO
More than 70% overlap with NIS2
Approximately 50% overlap with ISO 42001
ISO 27001 Implementation Guide
- Realistic Costs and Lead Times by Organization Size
- Understanding what certification requires from your organization
- Overview of the steps toward the external audit
- Free and without obligations
Don't just take it from us
You are in good company with Nestor.
The communication lines with Nestor Security were short. The organization has a pragmatic mindset and is a down-to-earth party to do business with. As a result, the process went smoothly and fairly quickly.
We prefer to work together as much as possible regionally and like to hold meetings face-to-face. When you look at partners in the North, there are still a few left, and Nestor Security stands out above the rest.
Nestor Security has provided the internal audits of ISO 27001 and ISO 27701 for us. They really hit the mark for us with a good combination of quality and practicality. They are pragmatic, think well with our needs, and the audits are well-managed.
Your questions answered
FAQs
Who issues the certificate?
An independent certification body accredited by the Dutch Accreditation Council. We may set up your ISMS and conduct your internal audit, but we may never conduct your certification audit.
We can help you compare quotes and choose an institution that suits your sector.
What happens after the certification?
The certificate is valid for three years. In years 1 and 2, a surveillance audit follows, in year 3 a re-certification. Each year, an internal audit and a management review are mandatory.
You can do that yourself, but we can also take over the ISMS management for you. This way, the system remains up to date without costing your team a lot of time.
What if the auditor still finds deviations?
Minor deviations are very common during the first certification and do not mean that you are failing. You will receive a recovery period, and we will help you prepare the corrective measures.
If the auditor finds a significant discrepancy, we will conduct a second audit at no additional cost. That is our guarantee of success.
What determines the cost of an implementation?
Mainly the size of your organization, the scope of the project, and what has already been arranged. After the initial consultation, you’ll receive a fixed-price quote so you’ll know exactly what to expect in advance.
You can find guidelines based on organizational size in the ISO 27001 Implementation Guide.
How long does an ISO 27001 implementation take?
On average, 4 to 5 months from the kick-off until the external audit. If you already have a good foundation, it can be done in 10 to 12 weeks.
The planning of the external audit depends partly on the certifying institution, which often has a waiting period of several weeks. Therefore, we request the quotes already in the first phase.
What does the implementation of our own team require?
An average of 3 to 6 hours per week, divided among the employees involved. We don’t just work for you—we work with you. Your team provides the knowledge of your own processes and systems, and we take care of the structure, the documentation, and ensuring compliance with the standard.
Most of the time is spent in the risk analysis workshop and in implementing technical measures by your IT department.
Can we combine ISO 27001 with NEN 7510, BIO or NIS2?
Yes. ISO 27001 overlaps by more than 90% with NEN 7510 and the BIO, and by more than 70% with NIS2, which is established in the Netherlands under the Cybersecurity Act. We design the ISMS so that you can comply with those standards with minimal additional effort. The external audit can often be combined as well.
Ready for your ISO 27001 certificate?
Schedule a no-obligation consultation with one of our ISO 27001 experts. You’ll receive a response within one business day and a fixed-price quote after the consultation.
Schedule a no-obligation consultationRequest Implementation Guide
100% Pass Rate500+ customersGuaranteed success