You want to know what to expect before you start. We therefore look together at what is already working and what you want to do yourself. You can then choose guidance that suits you, with a clear start and finish. The ISO 27001 roadmap helps you identify that work.
How much guidance do you need during implementation?
You do not need to start by budgeting for a year of consultancy. In our experience, an ISO 27001 implementation usually takes around three months. We often provide four hours of guidance per week, while your team works on the agreed tasks between those sessions.
We can help with the risk assessment, suitable documents, configuration in the Compliance Tool and audit preparation. You and your colleagues provide information, carry out actions and make decisions. Your own contribution matters: four hours of guidance only works when you also have time to do the work.
Would you like us to take on more? That requires more DCA hours. We agree who does what before starting. The number of systems, sites and suppliers, your existing arrangements and available time all affect the schedule. Three months is therefore a typical implementation period, not a promise that you will also have your certificate by then.
That averages €2,080 per month during this implementation. Our pricing page uses 52 weeks ÷ 12 to convert weekly hours into a monthly average. This does not mean you need to purchase twelve months of guidance. See how we approach implementation together.
What do you pay after implementation?
Once the system is in place and your team manages it, we generally see monthly consultancy hours fall to almost zero. You can then ask us for help with an occasional question, a change in your organisation or an audit finding. We agree that additional work separately.
Information security still needs attention. You keep risks and evidence up to date, check whether controls work and organise internal audits and management review. Your software subscription and any audits by the certification body also continue. Less guidance does not mean there is no further work or cost.
Would you prefer us to keep carrying out recurring tasks? You can choose ongoing support. That is a separate arrangement from temporary implementation guidance.
Try out how much guidance suits you
Open the calculator and adjust the hours. How much time can your team make available? Do you mainly want an expert to guide you, or someone to do more of the work? You can see how your choice changes the monthly estimate.
The calculator adds guidance to your chosen software licence. Your own hours are shown as available capacity, not as a cost in euros. Internal audits, external certification and improvements are also excluded. The result is an indication; the calculator does not predict a completion date or the likelihood of certification.
What other costs should you include?
Guidance is one part of your budget. Also allow for:
- Your own time. This includes meetings, gathering information, completing actions and making decisions. Use your own internal hourly cost if you want to budget this in euros.
- The Compliance Tool. From €295 per month with an annual subscription (€3,540 per year), or from €320 per month with a subscription you can cancel monthly. These prices exclude VAT.
- Necessary improvements. For example, better access control, recovery arrangements or new agreements with suppliers. Your risk assessment and starting position determine what is needed.
- Audits. Keep the internal audit and external certification as separate budget items.
Combining the example of €6,240 for guidance with one year of software at €3,540 gives €9,780 excluding VAT. This example includes guidance and software only: your own time, improvements and internal and external audits are additional. It includes three months of guidance and twelve months of software, not twelve months of consultancy.
What do the internal audit and certification cost?
We charge €1,000 per day for an internal audit for software customers and €1,500 per day for other organisations, including preparation, travel time and reporting. These rates exclude VAT; we agree the number of days in advance. See the internal audit rates.
Budget for certification separately from implementation. If you choose accredited certification, request a quote from a certification body accredited for that activity. Ask it to specify the initial assessment, any additional assessment, surveillance audits and recertification. That body determines the audit scope and makes the certification decision.
You can also discuss a separate route to non-accredited certification with DCA. First check whether your customer accepts this and request a proposal covering scope, assessment and follow-up checks. Neither certification route is included in the example above. Guidance or an internal audit does not itself provide a certificate.
NEN 7510 and NIS2 Supply Chain: what can you reuse?
A well-established ISO 27001 system gives you more than preparation for one certificate. You already have a way of managing risks, responsibilities, controls and evidence. If you also want to work towards NEN 7510 or NIS2 Supply Chain, we first look at what you can reuse. You do not need to repeat the same work for every standard.
For NEN 7510 , the overlap is clear: the standard builds on ISO 27001 and ISO 27002, with additions for healthcare and personal health information. Your existing foundation can help, but the healthcare-specific requirements, application and evidence still need attention. NEN explains this relationship.
For NIS2 Supply Chain , we look at which existing evidence fits the chosen level and your customer’s requirements. This is a separate certification scheme: an ISO 27001 certificate does not automatically provide a NIS2 Supply Chain certificate. The scheme owner describes the separate assessment. Any legal NIS2 obligations, such as management responsibilities and incident reporting, also need a separate assessment.
The saving comes from reusing work. We include additional requirements in the scope and budget for what is still needed. This helps avoid three separate projects with duplicated work. Additional guidance, assessment or certification is not automatically free or included.
Frequently asked questions
Do I have to purchase twelve months of guidance?+
No. Implementation guidance is temporary. The calculator converts weekly hours into a monthly average; it does not set a twelve-month term. We agree the duration and hours for your project. An annual software subscription is a separate choice.
Is three months realistic for my organisation?+
That depends on what is already in place, the scope and your team’s available time. Around three months with four hours of guidance per week is our usual approach when you carry out the agreed work yourself. Outsourcing more requires more DCA hours. The external certification schedule and outcome are separate.
Can I start on my own with just the Compliance Tool?+
Yes. Guidance is optional. You can use the Compliance Tool to organise tasks, risks, documents and evidence yourself. You also arrange implementation and the necessary audits. If you need help later, we can discuss suitable support.
Sources for this article
- ISO: implementing and continually improving information securityAccessed on 7 October 2026
- ISO: external certificationAccessed on 7 October 2026
- NEN: the relationship between NEN 7510 and ISO 27001Accessed on 7 October 2026
- NIS2 Supply Chain: the separate certification stepsAccessed on 7 October 2026
- European Union: NIS2, Articles 20, 21 and 23Accessed on 7 October 2026
- DCA: prices, calculator and audit ratesAccessed on 7 October 2026
Explore this topic further
This is general guidance and does not replace an assessment of your situation or the official standard.