How much does ISO 27001 certification cost in Belgium? There is no list price, because the bill depends on how many people are in scope, how mature your security already is and why you are certifying (a client request, a tender, or NIS2). What you can do is break the budget into its real components and compare them with indicative market ranges. This guide does exactly that for 2026, by organisation size, and covers the recurring costs over the three-year certificate cycle, the timeline, what pushes the cost up or down and how NIS2 changes the equation for Belgian organisations.
Key takeaways
- Indicative year-1 external budget: about €18,000 to €50,000 below 50 staff, €40,000 to €110,000 for 50 to 250 staff, €90,000 or more above 250. Internal time comes on top.
- The certification body audit is rarely the biggest line: consulting support, internal effort and technical remediation usually weigh more.
- Certification is a three-year cycle: Stage 1 and Stage 2 in year 1, surveillance audits in years 2 and 3, then recertification.
- Typical timeline: 6 to 12 months from gap analysis to certificate.
- In Belgium, ISO 27001 is one of the two CCB-recognised NIS2 conformity routes, alongside CyberFundamentals (CyFun), which can save you a second assessment.
What makes up the cost of ISO 27001 certification?
The cost of ISO 27001 certification is the sum of nine components. Only one of them, the certification body audit, is a fixed external fee; the others depend on your scope and starting point.
- Internal effort. Someone must own the ISMS, and managers, IT, HR and operations must contribute to the risk assessment, policies and evidence. For an SME, this commonly represents 300 to 600 hours over the project. It is the cost most often forgotten.
- Implementation and consulting support. Gap analysis, scope definition, risk methodology, Statement of Applicability, policies and audit preparation. You can buy a full implementation or only targeted help. See our ISO 27001 gap analysis guide.
- Tools (optional). Many SMEs run their ISMS with documents and the collaboration tools they already have. Dedicated ISMS or GRC platforms save time on evidence collection but add a yearly subscription.
- Certification body audit (Stage 1 + Stage 2). Billed per auditor day by a body accredited to ISO/IEC 17021-1 and ISO/IEC 27006-1. The number of days depends mainly on the people in scope and the complexity of the ISMS. Stage 1 reviews readiness and documentation; Stage 2 tests implementation. Details in our ISMS and ISO 27001 audit guide.
- Surveillance audits (years 2 and 3). Shorter audits on a sample of clauses and controls, at least once per calendar year.
- Recertification audit (year 3). A full review before the three-year certificate expires, priced close to the initial audit.
- Internal audit. Clause 9.2 requires an impartial internal audit programme covering the full scope before Stage 2 and every year after. If nobody internally is qualified and independent, you outsource it.
- Training and awareness. Clause 7.3 and control A.6.3 require staff awareness, plus competence for key roles (clause 7.2).
- Pentest and vulnerability scanning, if your risk treatment requires them. ISO 27001 requires technical vulnerability management (A.8.8), not a pentest as such. A pentest enters the budget when your risk assessment, a client or a regulator calls for it. See penetration testing cost in Belgium and vulnerability scanning vs pentesting.
One more line hides behind all nine: technical remediation. If the gap analysis reveals missing MFA, untested backups, no central logging or unmanaged endpoints, fixing them is part of the real cost of the project, even if it is not an “ISO 27001 fee”.
ISO 27001 cost in Belgium by organisation size (2026)
The table below gives indicative market ranges for Belgium and the Benelux in 2026, excluding VAT. They are synthesised from publicly available price guides from certification bodies, consultants and software vendors, cross-checked against the audit-day logic of ISO/IEC 27006-1. They are not quotes: use them to size a budget and to challenge offers, then ask for proposals based on your actual scope.
| Cost item | Fewer than 50 staff | 50 to 250 staff | More than 250 staff |
|---|---|---|---|
| Gap analysis + implementation support (consulting) | €10,000 to €30,000 | €25,000 to €60,000 | €50,000 to €120,000+ |
| Certification audit, Stage 1 + Stage 2 (year 1) | €5,000 to €12,000 | €10,000 to €25,000 | €20,000 to €45,000+ |
| Surveillance audit, per year (years 2 and 3) | €3,000 to €6,000 | €5,000 to €12,000 | €10,000 to €20,000 |
| Recertification audit (end of year 3) | €4,000 to €10,000 | €8,000 to €20,000 | €15,000 to €35,000 |
| Internal audit, if outsourced (per year) | €2,500 to €5,000 | €4,000 to €8,000 | €8,000 to €15,000 |
| Awareness training (per year) | €1,000 to €3,000 | €2,000 to €5,000 | €5,000 to €15,000 |
| ISMS / GRC tooling (optional, per year) | €0 to €6,000 | €2,000 to €15,000 | €10,000 to €30,000 |
| Internal effort (not invoiced) | About 300 to 600 hours over the project | About 0.5 to 1 FTE during the project | A dedicated ISMS role plus part-time control owners |
| Indicative year-1 external budget (excl. pentest) | €18,000 to €50,000 | €40,000 to €110,000 | €90,000 to €220,000+ |
For reference, certification bodies commonly charge around €1,100 to €1,800 per auditor day in the Benelux and neighbouring markets, and a small organisation’s initial audit (Stage 1 plus Stage 2) usually takes a handful of auditor days. Surveillance audits typically cost a third to two thirds of the initial audit. Over a full three-year cycle, the certification body fees alone (initial audit, two surveillance audits and the recertification) commonly add up to roughly €15,000 to €35,000 for an organisation below 50 staff.
How long does ISO 27001 certification take?
ISO 27001 certification typically takes 6 to 12 months. The limiting factor is rarely writing documents: it is running the ISMS long enough to produce evidence, one complete internal audit and one management review before Stage 2.
| Phase | Typical duration | Main cost driver |
|---|---|---|
| Gap analysis and scope | 2 to 6 weeks | Consulting days, management availability |
| Risk assessment, SoA, policies | 1 to 3 months | Internal workshops, consulting support |
| Implementation and remediation | 2 to 6 months | Technical fixes, training, supplier reviews |
| Internal audit and management review | 2 to 4 weeks | Auditor independence (internal or outsourced) |
| Stage 1 and Stage 2 audits | 1 to 3 months including corrections | Certification body days, nonconformities to close |
What drives the cost up, or down?
- Headcount in scope and number of sites. They drive the auditor days and the number of people to train and interview.
- Starting maturity. An organisation with documented processes, an asset inventory and working backups pays far less than one starting from zero.
- The regulatory purpose of the scope. A certificate obtained for one product line can be narrow; one used as a NIS2 conformity route must cover the organisation and its NIS2 services.
- Cloud and outsourced IT. Every key supplier must be assessed and contractually covered (A.5.19 to A.5.23).
- Technical debt. Missing MFA, logging, patching or tested backups turn into remediation projects.
- Deadline pressure. A client or tender deadline compresses the plan and usually increases external support.
- Nonconformities. A major nonconformity at Stage 2 can trigger an extra audit visit and delay the certificate.
Seven ways to reduce the cost of ISO 27001
- Get the scope right first. A scope that matches the business purpose avoids both over-engineering and a certificate nobody accepts.
- Reuse your NIS2 and CyFun work. CyberFundamentals is built on international references including ISO/IEC 27001, so a CyFun self-assessment, risk register or incident plan feeds directly into the ISMS.
- Build on an existing ISO 9001 system. ISO 27001 shares the harmonised structure of ISO 9001 (clauses 4 to 10): document control, internal audit, management review and corrective actions can be shared, and certification bodies can run integrated audits under IAF MD 11.
- Use templates, but adapt them. Good templates save weeks; copy-paste policies that do not match reality are a classic audit finding.
- Start with a gap analysis. It turns an open-ended project into a scoped plan and avoids paying for work you do not need.
- Compare two or three accredited certification bodies on the full three-year cycle, not only the first audit. The CCB publishes a list of conformity assessment bodies for NIS2.
- Plan the internal audit and management review early. Missing either is one of the most common reasons Stage 2 is postponed, which costs money.
Regional SME support schemes in Brussels, Wallonia and Flanders sometimes cover part of cybersecurity consulting costs. Eligibility and rates change regularly, so check the current rules before signing.
ISO 27001, NIS2 and CyFun: one investment, two obligations
Under the Belgian NIS2 law of 26 April 2024, essential entities must undergo regular conformity assessment. The Centre for Cybersecurity Belgium (CCB) recognises two routes: CyberFundamentals (CyFun®) certification or ISO/IEC 27001 certification, with a scope covering the organisation and its NIS2 services. Important entities are not required to certify but can do so voluntarily to benefit from a presumption of conformity. For essential entities following the ISO route, the CCB timeline points to 18 April 2027; confirm your exact obligations with the CCB.
From a budget perspective, this means ISO 27001 can serve both your clients and your regulator. If you need a certificate that is recognised internationally, choosing the ISO route for NIS2 avoids paying for two parallel assessments. If your only driver is NIS2, CyFun may be the lighter start. We compare both in CyFun vs ISO 27001 in Belgium, and map the requirements in NIS2 and ISO 27001 in Belgium. See also our NIS2 compliance service.
How ICTLAB supports your ISO 27001 project
ICTLAB’s ISO 27001 practice is led by Caner Korkut, ISO 27001 Lead Implementer. We start from the regulatory purpose (client requirements, NIS2, DORA) to fix a scope that holds, then deliver what you actually need: a gap analysis, the risk assessment and Statement of Applicability, policies sized for your organisation, technical controls, an impartial internal audit, a mock Stage 1 and support during the certification audit. You decide how much you do internally; we quote the rest on your real scope.
At ICTLAB we always aim to stay below market rates while keeping a high level of quality.
Discover our ISO 27001 certification support or ask for a scoped estimate.
ISO 27001 certification cost: frequently asked questions
How much does ISO 27001 certification cost in Belgium?
As an indicative market range for 2026, a Belgian organisation with fewer than 50 staff should budget roughly €18,000 to €50,000 of external costs in the first year (consulting support, Stage 1 and Stage 2 audits, internal audit, awareness, optional tooling), an organisation with 50 to 250 staff roughly €40,000 to €110,000, and a larger one €90,000 or more. Internal time comes on top. Scope, maturity and technical remediation explain most of the spread.
How much does the certification body audit cost?
Certification bodies bill per auditor day, commonly around €1,100 to €1,800 per day in the Benelux and neighbouring markets. The number of days is set by ISO/IEC 27006-1 from the number of people in scope and the complexity of the ISMS. For an SME, Stage 1 plus Stage 2 typically lands between €5,000 and €12,000; for 50 to 250 staff, between €10,000 and €25,000. Ask two or three accredited bodies for a quote covering the full three-year cycle.
What are the recurring costs after ISO 27001 certification?
The certificate is valid three years. In years 2 and 3 you pay a surveillance audit (roughly a third to two thirds of the initial audit), then a recertification audit at the end of year 3 (close to the initial audit). Add the yearly internal audit, management review, awareness training, any tooling subscription and the internal time needed to keep the ISMS running, typically a few hours per week for an SME.
How long does it take to get ISO 27001 certified?
Typically 6 to 12 months from gap analysis to certificate. A small, well-organised company with existing security practices can sometimes reach Stage 2 in 4 to 6 months; multi-site or heavily regulated organisations often need 12 months or more. The ISMS must run long enough to produce evidence, a full internal audit and a management review before Stage 2.
Can we get ISO 27001 certified without a consultant?
Yes. A consultant is not required by the standard, and some organisations succeed with templates and a dedicated internal owner. The trade-off is internal time and risk: a non-repeatable risk method, a copy-paste Statement of Applicability or a scope that does not fit NIS2 are frequent causes of failed or delayed audits. Many organisations buy targeted help only: gap analysis, risk assessment, internal audit and a mock Stage 1.
Is ISO 27001 or CyFun cheaper for NIS2 compliance in Belgium?
It depends on your situation. CyberFundamentals (CyFun) is the CCB framework built for Belgian NIS2 entities and is often lighter to start with; ISO 27001 is international, recognised by clients abroad and also accepted by the CCB as a conformity route for essential entities, under scope conditions. If you already hold or need ISO 27001 for commercial reasons, using it for NIS2 avoids paying for two separate assessments.
Is a penetration test mandatory for ISO 27001?
No. ISO 27001 does not explicitly require a penetration test. It requires technical vulnerability management (Annex A control 8.8) and controls chosen through your risk assessment. In practice, most organisations run regular vulnerability scans, and a pentest becomes part of the budget when the risk treatment plan, a client contract or a regulator calls for it. A focused pentest in Belgium usually starts around €4,000.
All figures are indicative market ranges for Belgium and the Benelux in 2026, excluding VAT, synthesised from public price guides (certification bodies, consultancies and ISMS software vendors) and the audit-time rules of ISO/IEC 27006-1. They are not ICTLAB prices or quotes. NIS2 information is based on the Belgian NIS2 framework as published by the CCB; not legal advice.