Is ISO 27001 worth it? When the certificate pays for itself, and when it does not

ISO 27001 is worth it when someone already asks for it, in a tender or a customer’s security review, or when NIS2 applies to you. Then the certificate is a cost of revenue, not a security project. Judge its first year, €50,000 to €150,000 for 26 to 125 people, against the contracts it unblocks. If nobody is asking, fix your controls first.

This guide covers what the certificate buys, when it pays for itself, when it is not worth it yet, the case for a small company, how to get the same result for less, what the certificate does not tell you, and a checklist.

Your situation	Worth it now?	Why
A tender or contract you want requires ISO 27001	Yes	The certificate is a condition of the revenue
Security reviews slow or stall your deals	Usually	It pre-answers a large share of the standard questionnaires
You sell ICT services to banks or insurers	Usually	DORA requires them to use providers that meet appropriate information security standards
You are in NIS2 scope	Usually, as the route	NIS2 asks for the measures, and an ISMS delivers most of them
Nobody is asking, and MFA, patching and backups are patchy	Not yet	You would certify a management layer on top of weak controls
The customer wants it within three months	Not on that date	The system typically has to run for three months before Stage 2
Nobody will own it after the audit	Not yet	Surveillance audits come round every year

What does an ISO 27001 certificate actually buy?

Four things, and they justify very different budgets.

Access to contracts that require it

In practice, tenders and supplier onboarding in financial services, health and the public sector often list ISO 27001 as a selection criterion or a contract condition. There it is a procurement gate, not a preference. Model the cost as a cost of sale for that market, not as a security investment.

Financial services have a legal reason to ask. DORA, which has applied since 17 January 2025, says financial entities “may only enter into contractual arrangements with ICT third-party service providers that comply with appropriate information security standards” (Article 28(5)). DORA does not name ISO 27001, but in practice a certificate is a common way for a supplier to show it.

Shorter security reviews

When choosing supply chain measures, customers in NIS2 scope must take into account “the overall quality of products and cybersecurity practices of their suppliers and service providers” (Article 21(3)). That is why questionnaires now reach companies that are not regulated themselves.

In our experience a certificate and Statement of Applicability pre-answer most of a VSA or CAIQ and half or more of a SIG. Reviewers often accept them in place of whole sections. They do not make questionnaires go away, as covered in how to answer a security questionnaire.

Evidence for NIS2

There is no NIS2 certificate for companies. NIS2 requires the risk-management measures in Article 21, which must take into account “where applicable, relevant European and international standards”. An ISMS covers most of the ten measures, as mapped in ISO 27001 vs NIS2.

An authority supervising an essential entity can ask for “evidence of implementation of cybersecurity policies, such as the results of security audits carried out by a qualified auditor and the respective underlying evidence” (Article 32(2)(g)). A management system audited every year already produces much of that material. Belgium builds on it directly: essential entities could meet the 18 April 2026 milestone through an ISO 27001 route, with full certification due by April 2027.

A management system you would not otherwise build

Owners, a risk register, an internal audit and a management review, on a calendar someone outside the company checks every year. Where security is nobody’s job, that external calendar is often the only thing that keeps the work moving.

When does ISO 27001 pay for itself?

When the contracts it unblocks are worth more than the three years it costs. Both sides are easier to estimate than most companies assume.

The cost side. For a company of 26 to 125 people, the first year runs roughly €50,000 to €150,000 all in. The figure people quote each other, €50,000 to €80,000, usually leaves out internal time, which is the largest line. After that, the certification body charges about a third of the initial audit fee in each surveillance year, and the internal audit comes round every year. The breakdown by headcount is in what ISO 27001 costs.

The benefit side. Count three things: the margin on deals lost or stalled at security review in the last year, the tenders you could not bid for, and the days spent on questionnaires. If NIS2 applies, most of the ISMS is work you have to do anyway, so a sensible approach is to count only the certification increment against it.

Do not justify it with headline breach-cost averages. They describe other companies, and a certificate does not by itself change your likelihood of a breach.

A workable rule: if you can name one contract whose margin covers the three-year cost, the decision is made. If you cannot name one, you are buying on speculation.

ISO 27001 DECISION WORKSHEET

A. WHO IS ASKING
   Tender or contract that requires ISO 27001:   yes / no (name it)
   Deals stalled at security review, 12 months:  __ deals, EUR __ margin
   Questionnaires per year x days each:          __ x __ days
   In NIS2 scope (essential / important):        yes / no / unsure
   Financial-sector customers (DORA):            yes / no

B. WHAT IT COSTS (see the cost guide)
   Year one, all in, incl. internal time:        EUR __
   Years two and three, per year:                EUR __
   Named owner and time per month:               ______, __ days

C. STARTING POSITION
   MFA enforced on admin and remote access:      yes / no
   Deadline for patching critical findings:      yes / no
   Backup restored and timed in last 12 months:  yes / no
   Leavers removed from every system:            yes / no

DECISION
   A names a contract or tender   -> certify, scoped to that service
   A is questionnaires only       -> answer library now, certify
                                     when the first gate appears
   Two or more "no" in C          -> fix C first, then certify
   No named owner in B            -> not yet

When is ISO 27001 not worth it yet?

In five situations the money does more good elsewhere first.

Nobody is asking. If no customer, tender or regulator has named it, the certificate has no revenue to set against it. Answer questionnaires from a well-kept library and certify when the first gate appears.

The baseline controls are missing. ISO 27001 is a management layer on top of technical controls, not a replacement for them. If MFA is not enforced, endpoints are unmanaged and patching has no cadence, the ISMS you build is a governance facade on an insecure foundation. Consulting days do not fix a storage bucket that is open to the internet.

Nobody will run it on day 366. Who maintains the ISMS after the consultants leave, with a surveillance audit every year? If the answer is nobody, you have bought a frame without a painting. The owner question is covered in ISO 27001 without a security team.

The deadline is shorter than the evidence period. From scratch, plan nine to twelve months. The system typically has to run for three months before Stage 2, as set out in how long ISO 27001 really takes. A customer who wants a certificate in eight weeks may accept an agreed scope, a dated plan and evidence that the work has started. Ask before you pay for compression.

The scope would not cover what the customer buys. A narrow scope that leaves out the service in question answers nobody.

None of this argues against the standard. It argues for sequence: controls, then the management system, then the certificate. The certificate follows the work, and when it comes, it means something.

Is ISO 27001 worth it for a small company?

Often, but later than the sales pressure suggests.

A smaller company pays a smaller audit fee, but the total shrinks less than people expect. Audit time is set by the number of people in scope, and a company of 1 to 10 people still needs about five audit days, roughly €7,000 to €9,000. The fixed parts do not shrink in proportion. You still need a named owner, a risk register, an objective and impartial internal audit (clause 9.2), a management review and, in practice, about three months of evidence before Stage 2.

A small company can pass, because the standard certifies a management system rather than a security score. The question is timing. In practice, a company of ten selling to other small companies usually gets more from baseline controls and a questionnaire answer library, until the first customer names the certificate. A software company of forty selling to banks, insurers or public bodies will meet the requirement in most large deals, and is better off starting before one stalls.

How can you get the same result for less?

The result most small companies need is a yes from a named customer or a pass in a named tender. Five ways to get it for less:

1. Ask what the customer will accept. A certificate now, a certificate by a date written into the contract, or a Statement of Applicability and a dated plan in the meantime. The answer changes both the budget and the timeline.
2. Scope to the service the customer buys. Audit time is calculated on the people in scope, so scope is the largest lever on the fee. The scope statement is also what the buyer reads.
3. Fix the technical baseline before writing policies. Enforced MFA, patch deadlines, restored backups, managed endpoints and a working leaver process are the gaps that come back in almost every company without a security function. Tooling that closes them also produces the records the auditor samples.
4. Do ISO 27001 and NIS2 once. One control set and one evidence record, mapped to both. Two projects pay twice for the same gap analysis and the same evidence.
5. Budget years two and three before you sign. Surveillance audits, internal audit and management review recur. A programme priced only to the certificate stops at the certificate.

The route we take is on the ISO 27001 page. Put simply: “How do I build security that makes compliance easier?” has a clear return. “How do I buy compliance and hope security follows?” has a renewal invoice.

What does an ISO 27001 certificate not tell you?

Whether your controls are good enough. The standard does require you to “evaluate the information security performance and the effectiveness of the information security management system” (clause 9.1), and the auditor samples records, not only policies. But you choose the controls and what counts as effective. The standard sets no quality bar for any single control.

Think of the usual ways into a small company: a misconfigured cloud service, an unpatched endpoint, a phished password, an over-privileged account. Each has an Annex A control: A.8.9 configuration management, A.8.8 management of technical vulnerabilities, A.6.3 awareness and training, A.8.2 privileged access rights. Each can be satisfied by a documented process while the problem stays open. A monthly scan whose findings stay open for months can still pass A.8.8. That is not a flaw in the audit. It is the scope of the instrument.

Compliance is a snapshot. Security is a posture. The certificate rests on a sample, checked once a year. Your environment changes every week.

Closing that gap means measuring controls with numbers rather than documents: how long critical findings stay open, MFA coverage on administrative accounts today, how long the last full restore took. Collected by hand before an audit, those numbers are out of date on arrival. Collected continuously from your systems, with a person reviewing the exceptions, they serve the auditor, the customer’s follow-up questions and a NIS2 authority at once. That is how the CloudSoul platform works: automated collection with human-in-the-loop expertise. To find out first which of your gaps are documentation and which are technical, start with a security audit.

ISO 27001 decision checklist

• Name the contract, tender or regulator asking, and find out what it will accept.
• Put the three-year cost against the margin it unblocks, not against breach statistics.
• Check the baseline: enforced MFA, patch deadlines, a timed restore, leavers removed.
• Draw the scope around the service the customer buys.
• Name the owner for years two and three, with time in their calendar.
• If NIS2 applies, plan one programme and one evidence record for both.
• Allow nine to twelve months from scratch, and give the customer a date.
• Keep the gap list under review after the certificate arrives.

Sources

• ISO/IEC 27001:2022, Information security management systems, Requirements, clauses 9.1 and 9.2 and Annex A, ISO.
• Directive (EU) 2022/2555 (NIS2), Articles 21 and 32, EUR-Lex.
• Regulation (EU) 2022/2554 (DORA), Articles 28(5) and 64, EUR-Lex.
• Centre for Cybersecurity Belgium, “NIS2: 18 April 2026 deadline, what essential entities must have in place”, updated 16 April 2026, CCB.

Frequently asked questions