Knowledge base · ISO 27001
ISO 27001 for an SME: the steps, the lead time and what it takes
ISO 27001 is a certifiable management system for information security, not an IT project. This page sets out the steps from scope to certificate and says who does which work. It is also honest about what nobody can promise you in advance: the lead time. The current edition is ISO/IEC 27001:2022.
Decision aid
ISO 27001 or CyFun: the question is who demands the evidence
Both can serve as evidence for NIS2. Whether NIS2 applies to your company is determined by the CCB's official scope test, not by this table.
| Your situation | Direction |
|---|---|
| Customers or tenders explicitly ask for an ISO 27001 certificate | ISO 27001 |
| Your main need is to demonstrate compliance with the Belgian NIS2 law | CyFun is often sufficient: a validated implementation gives a presumption of conformity |
| You operate internationally and your customers do not know CyFun | ISO 27001 is better known internationally. Check first with your most important customers |
| You are an essential entity and want one system for both purposes | Possible, provided the certification scope covers all relevant systems (see the section on scope) |
| You do not yet know what your customers will ask for | A CyFun step is not a mandatory intermediate step towards ISO 27001. Choose based on who asks for the evidence |
The steps
From scope to certificate in nine steps
The sequence is fixed. What varies is how much of each step you have already done.
| Step | What it delivers | Who does the work |
|---|---|---|
| 1. Decision and mandate | A goal, a budget and a designated internal lead | Management |
| 2. Define the scope | A written scope: locations, processes, systems, parties involved | Management and the internal lead, with the adviser |
| 3. Risk assessment | Risk method, risk register and risk treatment plan | The internal lead and process owners, the adviser safeguards the method |
| 4. Select controls | Statement of applicability: which Annex A controls apply and why | The internal lead, IT partner and adviser |
| 5. Implement controls | Policies, procedures, technical and organisational measures | The IT partner carries out the technical work, your people follow the procedures, the adviser steers the planning |
| 6. Run the system | Evidence: measurements, training, incidents | The internal lead |
| 7. Internal audit | Audit report and list of nonconformities | Someone who did not set up the system themselves |
| 8. Management review | Decisions on results, resources and improvements | Management |
| 9. Certification audit | The certificate, or a list of nonconformities to follow up | Certification body. The adviser prepares you but does not certify |
Documentation
The standard requires less paper than many quotes suggest
The standard itself lists which documented information is mandatory. That list is shorter than many document packages lead you to believe. Use the text of the standard as your final checklist.
Documents to maintain
Scope, information security policy, information on the risk assessment and risk treatment process, statement of applicability, risk treatment plan, objectives, evidence of operational control and an audit programme.
Evidence to retain
Competence, results of risk assessment and risk treatment, measurement results, audit results, results of the management review and the nature of nonconformities with the actions taken.
What is not mandatory
Annex A contains 93 controls in four themes: organisational, people, physical and technological. You only document the controls that you include in your statement of applicability. Extra documentation is allowed, but the standard does not require it.
Lead time
An honest answer on lead time is a list of drivers
Providers like to publish a number of months. Such a figure says little without knowing your starting point, and an independent Belgian average does not exist. What does determine the duration:
Your starting position
Existing policy documents, an inventory of systems and a working quality system shorten the road.
The size of the scope
More locations, systems and people mean more risk assessment, more controls and a longer audit.
The internal lead's time
Without hours freed up in the diary, everything slips. This is the most underestimated driver.
The pace of the IT partner
Technical measures depend on the availability of whoever implements them.
Evidence that the system is running
Internal audit and management review are part of the standard. They can only take place once the system has been running for a while.
The certification body's planning
Audit dates are not always fixed at the moment you would like.
The audit
Two audit stages, a certificate with a term and an accreditation that matters
The certification audit takes place in two stages. In stage 1 the auditor reviews your documentation and whether you are ready. Stage 2 follows with the full audit of how it works in practice. The certificate is valid for three years, with annual surveillance audits and a recertification before it expires. The body does not freely choose how long the audit lasts: ISO/IEC 27006 sets a calculation based on the number of people within the scope. Ask for that calculation with every quote, so that you compare bodies on the same basis. Accreditation is not a detail. An accredited body is itself supervised by an accreditation body, in Belgium BELAC, and its certificates are recognised internationally. If you want to use the certificate for NIS2 in Belgium, the body must also be authorised by the CCB according to the CCB FAQ. Check both before you sign.
ISO 27001 for NIS2
It is not the certificate that counts, but the scopeA certificate with a scope that is too narrow proves nothing for NIS2
If you also want to use ISO 27001 for NIS2, all relevant network and information systems must fall within the certification scope. According to the CCB FAQ, the scope and statement of applicability must cover the entire NIS2 entity, and a parent company's certificate proves nothing for a subsidiary. You test equivalence with CyFun through the correspondence table on the CyFun website, with the columns for Important and Essential. For essential entities, the inspection service gives priority until 18 April 2027 to measures equivalent to CyFun Important. Anyone who on 18 April 2027 has no certification covering measures equivalent to Essential submits a remediation plan: an ISO 27001 certificate covering at least measures equivalent to Important, with a plan towards Essential. By 18 April 2028 the Essential level must be covered (notice NCCA/JK/INS/2026-002 of 11 August 2026). Important entities choose voluntarily. The full explanation is on the pages about NIS2 versus ISO 27001 and about the deadline.
ISO 9001
If you have ISO 9001, you are not starting from zero
ISO 27001 and ISO 9001 share the same harmonised structure, with clauses 4 to 10. You can largely reuse context, leadership, competence, document control, internal audit, management review and corrective actions. New are the information security risk assessment, the statement of applicability and the controls themselves. What your existing system already covers per requirement can be found on the page about reusing ISO 9001.
After the certificate
The certificate is the start of an annual cycle
Internal audit
According to your audit programme, in practice every year. The standard requires audits at planned intervals.
Management review
Management reviews results, incidents and resources and records decisions.
Update risks and statement
New systems, suppliers or threats belong in the register and in the statement of applicability.
Handle nonconformities
Every nonconformity gets a cause, an action and a check of the result.
Surveillance audit
Annual visit by the certification body. A recertification follows in the third year.
Awareness and competence
New staff, new tools and new risks call for training that you can demonstrate.
Frequently asked questions
Short answers
Want to know which route suits you?
In a first, free conversation we look at scope and route together. RGI leads the process, the certification itself is done by an accredited body.