What does ISO 27001 certification cost, and why does it vary?
If a customer or contract requires ISO 27001, the cost you pay is mostly the fee charged by an accredited certification body across a three-year cycle, and that fee scales with the number of people in scope. ISO itself does not certify anyone and does not set certification fees. The standard is sold separately: ISO lists ISO/IEC 27001:2022 at CHF 155 as an English PDF or ePub (October 2026 price on iso.org), which is the price of the document, not of certification. Your budget therefore has three separate lines: the certification body's audit fees, your internal effort, and any implementation partner. ISO publishes no price list for certification, and this page gives no fee range, so you should expect a quote built from your own written scope.
Be clear about roles before you compare quotes. Your organization owns its controls, policies and risk decisions. A partner such as DeployOpen can prepare systems, configurations and evidence, but it does not issue reports or certificates. Only an independent, accredited certification body can do that. Ask each certification body to state its audit days, how it counted people in scope under ISO/IEC 27006-1:2024, whether it charges for stage 1 and stage 2 separately, and what the annual surveillance audits cost. Ask each implementation partner to state in writing which deliverables are included, which tasks stay with your staff, and what happens if the scope grows. Compare quotes on the same scope, or the lowest number will hide missing work.
Which costs are one-time and which recur every year?
This table lists each cost component of ISO 27001 certification, who is paid for it, whether it is one-time or recurring, and what moves it up or down. Read the recurring rows as the cost of keeping the certificate valid across the three-year cycle, and the one-time rows as the cost of getting certified the first time.
| Cost component | Who is paid or who bears it | One-time or recurring | What drives it up or down |
|---|---|---|---|
| The standard itself | ISO sells the document, through its store | One-time per purchase | ISO lists the English PDF and ePub at CHF 155 (iso.org, as of October 2026). Staff copies and translations can change this, so confirm current pricing before budgeting. |
| Stage 1 and stage 2 initial audits | The accredited certification body | One-time, at initial certification | Audit days scale with the number of people in scope, the number of sites and the complexity of the scope. Stage 1 documentation review and the gap before stage 2 can add time if the ISMS is immature. Ask the body how it calculated audit days under ISO/IEC 27006-1:2024. |
| Surveillance audits | The accredited certification body | Recurring, at least one audit each calendar year | ISO/IEC 17021-1 requires at least one audit in every calendar year of the three-year cycle (European Accreditation FAQ 37.12). Scope changes, new sites and nonconformities raised in earlier audits influence the time needed. |
| Recertification audit | The accredited certification body | Recurring, once per three-year cycle | Covers the full ISMS again before the cycle ends. Costs tend to be lower when the ISMS is stable and internal audits and management reviews run on schedule, but expect a full-scope review. |
| Internal team time | Your own staff, paid through existing salaries | Mostly one-time build, then recurring upkeep | Building policies, risk assessments, the Statement of Applicability and evidence collection takes the most time at the start. Ongoing work includes risk reviews, internal audits under clause 9.2, management review and corrective actions. Team size and existing documentation reduce the load. |
| Implementation partner | External consultant or implementation firm, under a written scope | Usually one-time for the build, sometimes a recurring retainer | Depends on how much preparation, evidence and tooling work is outsourced versus done in-house. Fixed-scope engagements are agreed in writing before work starts. Ask what is excluded, such as the Statement of Applicability sign-off or management decisions, which must stay with the organization. |
| Tooling and hosting | Cloud providers, software vendors, or your own infrastructure team | Recurring licenses and hosting, with some one-time setup | Self-hosted open-source platforms avoid license fees but still need hosting, identity, logging, backup and maintenance. Cost rises with the number of systems that generate evidence and with retention periods for logs. Confirm the platforms you need before comparing options. |
| Internal audit and management review | Your own staff or an external internal auditor | Recurring, at least annually | Required under clauses 9.2 and 9.3 of ISO/IEC 27001:2022. An independent internal auditor is still needed even if a consultant helped build the ISMS, because the certification body will check the separation. |
How do certification bodies set the audit time you pay for?
Most of what you pay a certification body is audit days, and the number of days is not set by the body alone. Accredited bodies determine audit time under ISO/IEC 27006-1:2024, which adds information security rules to ISO/IEC 17021-1 and includes the audit time method in its Annex C. Ask for the body's audit time calculation in writing before you accept a quote, and compare it line by line with the people and sites in your ISMS scope. The scope you set under clause 4.3 is the main input, so a narrower, well-defined scope is usually the first lever to test.
The method counts people, not roles. Under the 2024 rules, a group of people performing identical activities can have its head count reduced according to the risk of their tasks, but not below the square root of that group's head count. European Accreditation FAQ 48.6 explains that the body must justify and document the criteria it uses for the reduction. Illustratively, if a group of 100 staff does identical low-risk work, the reduced count cannot fall below 10. Ask the body which groups it has defined, what risk criteria it applied to each, and where the reasoning is recorded.
For multi-site organizations, European Accreditation FAQ 48.5 notes that on-site audit time is generally calculated from the total number of persons doing work under the organization's control, wherever they are located. Remote staff, contractors and staff at sites you exclude from scope can therefore still affect the calculation, depending on how they are counted. The 2024 rules also added requirements for remote audits and require audit reports to state how far remote auditing was used and how effective it was. Confirm with the body which parts of the audit it plans to run remotely, and treat any remote share as a cost and a quality question to settle before you sign.
Which factors make ISO 27001 certification cost more or less?
Certification body fees track the amount of work an auditor must test, and most of that work follows from how the ISMS scope is drawn. The cards below cover the drivers that move audit time and internal effort, and the decisions an organization can make to keep each one proportionate.
Headcount in scope
Audit time is driven largely by the number of people doing work under the organization's control inside the ISMS scope. Under clause 4.3, the organization decides which parts of the business the ISMS covers, and that boundary must be real: a scope that leaves out people who access the same systems will not be valid. Ask the certification body how it calculates audit time from the headcount you propose and which groups it may reduce. A narrower scope lowers audit time only where the excluded parts truly have no effect on the information security of the in-scope services.
Number of sites and locations
Each physical location in scope can add on-site audit time, and multi-site organizations are assessed under the multi-site rules of ISO/IEC 27006-1:2024. Under those rules, on-site time is generally calculated from the total number of people doing work under the organization's control, wherever they sit. Before you commit to a scope, confirm which offices, data centers and remote working arrangements the certification body will treat as in scope. Consolidating locations into one documented operating model often reduces the number of visits the auditor must make.
Cloud and SaaS systems to evidence
Every cloud account, SaaS application and identity provider that holds in-scope information is something an auditor may sample for access controls, configuration, logging and backups. Each additional system adds evidence to collect and test, so inventory them before the scope is fixed. Ask whether the certification body accepts remote audit of cloud consoles and what it requires in the audit report about remote auditing. Consolidating identity into one provider and documenting infrastructure as code typically shortens the evidence trail for each system.
Third parties inside the ISMS
When a supplier runs a service that falls inside your ISMS, such as a managed hosting provider or a payroll platform, its controls become part of what you must show. Your contracts, supplier reviews and any third-party reports you rely on will be sampled during the audit. Decide early which suppliers are in scope and collect their contractual security commitments and assurance evidence. Suppliers outside the ISMS that you only buy from do not add audit time, but you still need a documented supplier control.
Evidence maturity
Logs, access reviews, vulnerability records, risk registers and incident tickets that already exist and are kept consistently make an audit faster and reduce the chance of nonconformities. Where these records must be created for the first time, the work moves into internal effort before stage 1 begins. Review your current records for each Annex A control you plan to include and check whether they cover the full period the auditor will sample. Organizations that generate evidence routinely from their platforms usually spend less time reconstructing history.
Policies and Statement of Applicability readiness
A complete set of policies, a current risk treatment plan and a Statement of Applicability that justifies every inclusion and exclusion among the 93 Annex A controls give the auditor a clear map to test. Gaps in these documents tend to surface as findings that require a second visit or additional evidence. Ask for a written list of the documents the certification body expects before stage 1 and assign an owner to each. Preparing these documents in-house or with an outside advisor is usually a one-time effort, while keeping them current recurs each year.
What do the audit fees pay for across the three-year cycle?
Certification body fees pay for a fixed sequence of audits: one initial certification in two stages, then an audit in every calendar year until recertification restarts the cycle. Preparation before stage 1 is usually paid to someone else, and only the audits themselves are charged by the certification body.
Prepare the ISMS before stage 1
The organization builds its information security management system to the clauses 4 to 10 requirements, writes the Statement of Applicability, completes its risk assessment and treatment, runs an internal audit and holds a management review. These are the organization's own activities, so most of the cost here is internal staff time, plus any consultant or tooling the organization chooses to buy. Nothing is billed by the certification body yet. The step is complete when the organization can show records of each required activity and the scope is fixed. Ask any consultant to show which of these records they will prepare and which the organization must produce itself.
Complete the stage 1 audit and receive its report
The certification body performs the stage 1 audit, which checks that the documented ISMS is in place and ready for a detailed assessment. This is a one-time audit fee paid to the certification body and is part of the initial certification cost. The output is a stage 1 report listing concerns, gaps and any areas that need attention before stage 2. The step is complete when the organization has received that report and knows which findings it must resolve. Ask the certification body how its stage 1 fee is calculated and whether a stage 1 re-visit is charged separately.
Resolve stage 1 concerns before stage 2
The organization addresses the concerns raised in the stage 1 report, updating policies, records or the Statement of Applicability where needed. European Accreditation FAQ 49.3 confirms that the standard leaves time between the two stages for this work but sets no maximum interval, so the length of this period depends on the organization. Cost here is internal effort and any outside help, and it is one-time for the initial certification. The step is complete when the organization has evidence that each stage 1 concern has been resolved. Ask the certification body what it needs to see before stage 2 can be scheduled.
Complete the stage 2 audit and certification decision
The certification body audits whether the ISMS is implemented and operating in practice, testing evidence against the Annex A controls the organization has declared as applicable. Nonconformities are recorded, and major ones must be closed before a certificate can be issued. The stage 2 audit is a one-time fee on top of stage 1. The certification decision is made by the certification body, separately from the audit team, and the output is the certificate with its scope. Ask whether the decision fee is included in the stage 2 quote.
Pay for the annual surveillance or recertification audit
Under ISO/IEC 17021-1, a management system certification cycle lasts three years, and European Accreditation FAQ 37.12 requires at least one audit in every calendar year, either a surveillance audit or a recertification audit. Each year's audit is a recurring fee paid to the certification body. The surveillance audit samples the ISMS and checks that it continues to operate, and the output is an audit report recording any new nonconformities. The step is complete when the year's audit is closed. Ask the certification body how surveillance audit time is calculated for your headcount and scope.
Complete the recertification audit before the cycle ends
Before the three-year cycle ends, the certification body carries out a recertification audit that reviews the whole ISMS again, as the cycle restarts. This is a recurring cost that falls once every three years and is usually planned alongside the final surveillance audit. The output is a renewed certificate if the audit concludes satisfactorily. The step is complete when the new certificate has been issued. Ask for the expected recertification fee in writing when you receive the initial quote, since it is typically based on the same scope and headcount.
Plan for ongoing internal effort between audits
Between audits the organization keeps the ISMS running: reviewing risks, updating the Statement of Applicability, running internal audits and holding management reviews. These costs recur for as long as the certificate is held and are paid through staff time, tooling and any retained support. The output is a current set of records that the next audit will sample. The step is complete when each annual audit closes without repeated findings. Ask any consultant or implementation partner which of these activities they can take on as a retainer and which must stay with the organization.
Who gets paid for each part of an ISO 27001 project?
Your organization owns the information security management system, its policies, risk decisions and the controls themselves. Internal costs are mostly staff time that does not appear on an invoice: policy owners drafting and approving documents, system owners running the controls day to day, managers attending risk workshops and management review, and an internal auditor who checks the system before the certification body arrives. Some organizations also pay for a dedicated project lead or backfill for staff whose time moves onto the project.
- Policy and risk ownership: Senior staff approve the scope, the risk treatment decisions and the Statement of Applicability. These decisions cannot be delegated to an outside party.
- Control operation: Engineers, HR and facilities staff run the controls, such as access reviews and onboarding checks, and keep their records. This effort recurs every year.
- Internal audit time: Clause 9.2 requires an internal audit programme. Staff or an internal auditor independent of the certification body perform it.
- Management review: Leadership meetings that review the ISMS are recurring costs in time.
- Recurring effort after certification: Surveillance and recertification audits draw on the same people every year.
Ask your team to list the hours each role will need per month during implementation and in steady state, so the budget covers time as well as fees.
An implementation partner such as DeployOpen is paid under a written, fixed-scope agreement to help build the controls and evidence. For self-hosted open-source platforms, this usually covers scoping the systems involved, configuring and hardening them inside your own cloud accounts, data centers or air-gapped networks, wiring them to logging and access controls, preparing evidence, writing operating documentation and handing the systems over to your team. The partner prepares; it does not decide what your policies say, and it does not issue a report or certificate.
- Scoping and configuration: Work on the systems that support controls, such as identity, logging, backup and vulnerability management.
- Evidence preparation: Exports, configuration baselines and records that show a control operates, organized for the auditor.
- Documentation and handover: Runbooks and operating procedures that your staff can maintain after the project ends.
- Optional services: Security testing or retainers for upgrades and support are priced separately from the implementation scope.
- Independence limit: The partner cannot act as your certification body, cannot sign off its own work as the audit, and should not be the same firm that performs your internal audit.
Ask for a written scope that names the systems, deliverables, handover items and who approves each one.
The certification body is the only party that audits your system and issues the certificate. It is paid for the audit: a stage 1 review, a stage 2 audit, certification decision and then annual audits across the three-year cycle. Audit time for information security certification is set by ISO/IEC 27006-1:2024, which ties the time to the number of people working under your control and to the scope. Accredited bodies work to ISO/IEC 17021-1:2015 alongside that standard.
- Stage 1 and stage 2: Stage 1 reviews documentation and readiness, and stage 2 tests whether the controls operate in practice.
- Annual audits: Surveillance audits or a recertification audit must take place in every calendar year of the cycle.
- Certification decision: A decision separate from the audit team, and the only route to a certificate.
- Independence: The certification body must remain impartial. It cannot design the controls it later audits, and a consultant's advice is not a substitute for its audit.
- Quote terms: Ask for the audit days by stage, how the days were calculated, travel and report costs, and the fees for any extra visits.
Verify that any body you engage is accredited before you sign.
Should you build the ISMS in-house or buy outside help?
This table compares three ways to build an ISO 27001 ISMS: fully in-house, in-house with a fixed-scope implementation partner for systems and evidence, and a consultant-led project. Read each row against your team size and infrastructure, because the cost drivers change with scope. In every option, your organization still owns the controls, and the certification body that audits you is still the only party that issues the certificate.
| Option | What you pay for | What stays with your staff | Cost drivers and when it fits |
|---|---|---|---|
| Fully in-house | Staff time for gap analysis, policies, risk work, tooling and evidence collection, plus the certification body's audit fees | Every decision, every control, every record and every internal audit | Driven by internal hours and skills gaps. Fits a small scope where existing infrastructure engineers already run most systems. |
| In-house with a fixed-scope implementation partner | A written fixed-scope fee for named systems, configurations, evidence pipelines and documentation, plus internal time and audit fees | Control ownership, policy approval, risk decisions, staff training and internal audit | Driven by the number of systems to configure and how many must be ready at once. Fits a larger scope where many systems need work in parallel and internal staff are limited. |
| Consultant-led project | Consultant fees for advisory, documentation and project management, plus internal time and audit fees | Control ownership, the decisions consultants recommend and the work of operating the controls after certification | Driven by advisory hours and the amount of document drafting. Fits organizations that need project leadership more than hands-on systems work, and that can run the controls themselves afterward. |
| Who issues the certificate | Certification body fees in every option | The certification body decides, not the partner or consultant | Choosing a partner does not change this. Confirm that your certification body is independent of whichever firm helps you. |
| One-time versus recurring | Build work and first audit are one-time, while surveillance and recertification audits and ongoing operation recur | Operating the ISMS every year, including internal audits and management review | Ask each provider which deliverables end at certification and which continue into the three-year cycle. |
| What to ask for in a quote | Written scope, named deliverables, assumptions about staff and systems, and exclusions | Your team's time to review, approve and run what is delivered | A quote without a scope statement cannot be compared. Ask what happens if the scope grows during the work. |
What inflates ISO 27001 cost and how do you avoid it?
Most of the money in ISO 27001 certification goes to audit days, rework and tools bought for the wrong scope. The cards below cover the six inflators we see most often, each with the step that keeps it in check. Scope, risk assessment and certification body selection set the base, and the rest follows from them.
Scope drawn too broadly
Including systems that do not touch customer data or the service in the ISMS raises the number of people and locations the certification body must sample, which drives audit time. Define the scope from the services, data flows and locations that matter to the customer and the risk assessment, then document why each excluded area sits outside it. Ask the certification body how it calculates audit time from the people in that scope before you sign.
Tools bought before the scope is set
Buying a GRC platform or security tooling before the risk assessment and Statement of Applicability exist usually means paying for licenses, modules and integrations that the ISMS does not need. Write the risk treatment plan and the Statement of Applicability first, then list the tools that run the controls you actually selected. Open-source options can cover many evidence needs, but confirm each one against your control list before you deploy it.
Certification body chosen on price alone
Accepting the first quote, or the lowest one, without comparing several bodies can leave you with an unaccredited certificate that customers will reject. Before you sign, confirm that the body is accredited to issue ISO/IEC 27001 certificates and check that it applies ISO/IEC 27006-1:2024. Search the certificate in IAF CertSearch, which confirms validity, accreditation and the recognized signatory. Ask each body for a quote built from the same written scope so the audit day counts can be compared.
Failed stage 1 and a second visit
Stage 1 checks whether the documented ISMS is ready for a stage 2 audit. If the documentation, risk assessment or Statement of Applicability is incomplete, the body can defer stage 2, which means a second visit, more audit days and a longer wait. Run an independent gap analysis against clauses 4 to 10 and the Annex A controls before booking stage 1, and send the documents to the certification body ahead of the visit so the concerns are known early.
Major nonconformities left open
A major nonconformity must be closed within six months, and an open one can block certification or force a repeat of the audit. Each reopened finding means more audit time and more internal hours spent on the same problem. Track every finding from the audit report in one register with an owner and a date, and agree the closure evidence with the auditor before you submit it.
Evidence gathered late in the cycle
Collecting access reviews, change records, training completions and backup restores in the weeks before an audit forces staff to recreate history that the auditor expects to see over time. The effort is repeated every year because surveillance and recertification audits sample the same kinds of evidence. Schedule recurring evidence collection, store logs and records in a central place from day one, and assign an owner to each recurring control so the evidence exists when the auditor asks for it.
What should a written quote for ISO 27001 cover?
A comparable quote for ISO 27001 certification starts with the certification body's audit days, itemized by stage. Ask for the stage 1 days, the stage 2 days and the days for each annual audit in the three-year cycle, and for the calculation basis behind each figure. Under ISO/IEC 27006-1:2024, audit time depends on the number of people doing work under the organization's control within the scope, and for multi-site organizations it is generally calculated from the total number of persons wherever they are located. A quote that shows only a lump sum gives you no way to check that figure against the people in your scope or to compare it with another bidder. Also ask how travel is priced, which remote audit arrangements are assumed, and whether the quote assumes any on-site time that could be done remotely.
For partner quotes, including implementation help, the written scope should list the deliverables, the systems and sites in scope, the policies and records the partner will prepare, and the work the client must do itself, such as owning risk decisions, approving the Statement of Applicability and running internal audits. Name what is excluded, including the certificate itself, which only the certification body issues, and any re-audit that follows open nonconformities. Ask every bidder to price the same scope statement, the same number of people and the same sites, so the numbers can be compared. Confirm which costs recur each year, such as surveillance audits and tool subscriptions, and which are one-time. DeployOpen quotes follow a written, fixed scope agreed before work starts, so the deliverables and exclusions are stated up front.
Before you sign, confirm three points in writing. First, the cost of a re-audit if a major nonconformity is not closed in time, and who pays for it. Second, whether the certification body's fees change if the headcount in scope grows during the cycle. Third, how the scope on the certificate matches the scope in the quote, because a narrower certificate than the one you were sold will not satisfy the customers who asked for it. Check the certification body's accreditation status in IAF CertSearch before you commit, since an unaccredited certificate may not be accepted by your customers.
What do buyers ask about ISO 27001 cost before hiring help?
What total effort should a small team expect for ISO 27001 certification?
Total effort depends mostly on how many people fall in scope, how much of the ISMS already exists, and how many sites and systems the scope covers. No single figure applies to every organization, so ask a certification body for a written audit time calculation based on your scope. Internal effort usually covers writing policies, running the risk assessment, collecting evidence, training staff, running an internal audit and attending management review. A team with little documented security practice will spend far more internal time than one that already runs change control, access reviews and incident handling. Ask your certification body and any partner to estimate effort separately, so you can see which hours are internal and which are billed.
Can a company get ISO 27001 certified without a consultant or partner?
Yes. ISO does not require outside help, and the organization owns its ISMS, its risk decisions and its Statement of Applicability. A company with a capable internal lead, time to build documentation and staff who will follow the processes can run the work in-house, using ISO/IEC 27002 as control guidance. The trade-off is internal time and the risk of gaps that only surface during the certification audit. Outside help is most useful for a gap analysis, for technical hardening, or for building evidence collection on systems the team has not run before. Whatever you choose, the certification body issues the certificate, not the consultant.
Should we pay the certification body or a partner for the gap analysis?
Pay the partner for the gap analysis and keep the certification body for certification. A certification body that performs the gap analysis and then certifies the same system has a conflict of interest, because it would be auditing a design it helped create. Independence rules for accredited bodies also limit what they can do for a client before certification. A partner can compare your current practice with clauses 4 to 10 and the Annex A controls, then feed the findings into an implementation plan. Ask any partner for a written scope that lists deliverables, and confirm that they will not sign off the audit or issue reports.
How many years do ISO 27001 certification fees recur?
Certification fees recur across a three-year certification cycle, not as a one-time payment. Under ISO/IEC 17021-1, a management system certification cycle lasts three years, and at least one audit must take place in every calendar year, either a surveillance audit or a recertification audit. The initial certification adds a stage 1 and stage 2 audit before the first certificate is issued. Ask the certification body to quote the initial audit, each annual audit and the recertification audit separately, so you can budget the whole cycle. Internal costs such as tooling, staff time for evidence collection and annual internal audits also recur.
Why does the ISO 27001 standard cost CHF 155 but certification costs more?
The standard is a document you buy to read the requirements, and its price covers ISO's publication, not the work of meeting it. ISO lists the English PDF and ePub at CHF 155 as of October 2026. Certification involves a separate accredited certification body that audits your management system, charges for audit days and reviews your evidence, and it must be paid for each audit in the cycle. Your own staff time, tooling and any partner fees add further cost. The standard price is therefore only the entry point, and the larger costs come from audit days and the people who implement the system.
Do remote or multi-site setups lower ISO 27001 audit time?
Remote and multi-site setups can reduce travel and on-site time, but they do not automatically reduce audit time. Audit time under ISO/IEC 27006-1:2024 is driven by the people doing work under the organization's control, and for multi-site organizations on-site audit time is generally calculated from the total number of persons doing work under the organization's control, wherever they are located. Remote auditing is permitted, but audit reports must state how far remote auditing was used and how effective it was. Ask the certification body how it will split on-site and remote time, and what it will need from you to run remote sessions.
What should we provide to keep a partner's work short and cheap?
Provide a complete, current picture of what you run before the partner starts. Useful inputs include an asset list, network and system diagrams, the current scope you propose, a list of suppliers and cloud accounts, existing policies, recent risk registers, access review records, incident logs and any previous audit reports. Name one internal owner who can answer questions and approve decisions within a set time. Confirm what evidence already exists and where it is kept, because gathering missing evidence is often the most expensive work. DeployOpen plans and implements work only under a written, fixed scope, so clear inputs help agree that scope. DeployOpen does not publish a price list, and a quote follows from the written scope.
How DeployOpen scopes and prepares ISO 27001 evidence
DeployOpen plans, implements and documents self-hosted open-source platforms inside your own infrastructure, so the controls and evidence that drive certification effort are ready when an accredited certification body asks for them. We prepare systems and evidence only; the certification body you choose performs the audit and issues any certificate.
How we scope
- We agree the written scope with you before work starts, including which systems, sites and people sit inside the ISMS boundary.
- We document which Annex A controls apply to the scoped platforms, so your internal effort targets the controls that need work.
- Your written scope sets the deliverables and timeline, and it is the basis for a quote from you to compare with certification body fee proposals.
How we build
- We implement and configure self-hosted tools that produce logs, access records, backup reports and change history for the scoped controls.
- We set up evidence collection so each control has a repeatable record, reducing manual work at each annual audit.
- We test the scoped platforms against the controls they support and record the results for your internal audit and management review.
How we hand over
- We deliver the configuration documentation, control evidence and runbooks in your own environment, owned by your team.
- We prepare the evidence pack and walk your staff through where each artifact lives and how to refresh it before an audit.
- Your organization keeps ownership of its controls, Statement of Applicability and risk decisions; the certification body issues any report or certificate.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers after handover, for the years between certification audits.
- A retainer can keep evidence current for the annual surveillance audits that a three-year certification cycle requires.
- Confirm the support scope, response expectations and any change to the written scope with DeployOpen before you sign.
