Your ISO 27001 Certification.

With Kertos' ISMS software and experienced compliance experts, you prepare for ISO 27001 certification in a structured way and are ready for the certification audit in 8 to 12 weeks. For companies in Germany and Austria.

100% audit success for our customers. Kertos itself is ISO 27001 certified.

Based on ISO 27001:2022, including Annex A, risk assessment, and SoA

ISO 27001, NIS2, SOC 2, and GDPR on one platform, with AI support and experienced experts at your side

Thank you for your booking

We look forward to speaking with you. If you haven't picked a time yet, you can do so using the link below:

Termin auswählen

4.9 Star Reviews

Something went wrong while submitting the form. Please try again.

Leading companies rely on Kertos

YOUR BENEFITS

The quick way to ISO 27001 certification

For startups, scale-ups, and mid-sized companies: with Kertos, you're ready for the certification audit up to 80% faster and at up to 50% lower cost.

Without Kertos

65%

Audit success

3–6

Months to audit readiness

People on the team

None

Integrations

With Kertos

100%

Audit success

8–12

Weeks to audit readiness

Expert at your side

300+

Integrations

FEATURES

ISO 27001 doesn't have to be complicated

Kertos makes your certification faster, easier, and less expensive.

Reduce your effort by up to 80%

Kertos reduces ISO 27001 time and effort by up to 80%. Focus on growing your business, not on compliance tasks.

Experts at your side at all times

Our European team will personally accompany you on your way to ISO 27001 and offers professional and solution-oriented support so that you pass your audit the first time you try.

100+ ready-to-use templates

Access a wide range of ISO 27001 templates and manage all of your ISMS processes in one place with Kertos. Be audit-ready at any time.

All-in-one framework control

Combine ISO 27001, NIS2, GDPR, and more — seamlessly manage all your compliance requirements from a single platform.

ISMS SOFTWARE

ISMS software for your ISO 27001 certification

You can build an ISMS with Excel and SharePoint. By the first surveillance audit at the latest, it gets painful: evidence is scattered, risks are outdated, and nobody knows which version of a policy applies. Kertos' ISMS software keeps everything in one place and up to date.

Risks and controls in one place

You assess risks, map the right Annex A controls, and generate your Statement of Applicability (SoA) from them. Every decision stays traceable for the audit.

Policies from 100+ templates

Adapt templates, get them approved, and track every version.

Evidence from 300+ integrations

Kertos collects evidence from your tools continuously, so you don't have to hunt for it before the audit.

One ISMS for multiple standards

What you implement for ISO 27001, you reuse for NIS2, SOC 2, or TISAX.

PROCESS & TIMELINE

Process and timeline for ISO 27001 certification

With Kertos, you're ready for the certification audit in 8 to 12 weeks. The certification body usually schedules the audit itself within another 4 to 8 weeks.

STEP 1

Scope and gap analysis

You define the scope. Kertos shows which requirements you already meet and where the gaps are.

STEP 2

Build your ISMS

Run the risk assessment, select controls from Annex A, create policies, and collect evidence automatically through integrations.

STEP 3

Internal audit and management review

You test your ISMS before the external audit and close the remaining gaps.

STEP 4

Certification audit: Stage 1 and Stage 2

In Stage 1, an accredited certification body reviews your documentation. In Stage 2, it checks that your controls are effective. Then you receive your ISO certificate.

The certificate is valid for three years. A surveillance audit follows in each of the next two years, and recertification in year three.

REQUIREMENTS

Requirements of ISO 27001:2022

Certification is against the current version, ISO/IEC 27001:2022. Certificates issued against the 2013 version have been invalid since October 31, 2025.

Clauses 4 to 10

Mandatory for every company: from context and leadership through risk assessment to continual improvement.

Annex A with 93 controls

93 controls in four themes: 37 organizational, 8 people, 14 physical, and 34 technological. Most startups and scale-ups implement 60 to 80 of them.

Risk assessment

You assess the risks to your information assets and derive the right controls from them.

Statement of Applicability (SoA)

For every Annex A control, you justify whether and why it is implemented.

Learn more about ISO 27001 requirements

COSTS

What does ISO 27001 certification cost?

Costs fall into three blocks: preparation, building the ISMS, and the certification body's fees. How high they are depends mainly on the number of employees in scope and your starting point.

What does ISO 27001 certification cost with Kertos?

With Kertos, costs drop mainly in preparation and implementation, because that's where the manual work is. Our customers reduce it by around 80%. You pay the certification body's fees directly to the auditor. After a short scoping call, you get a fixed budget tailored to your company size and starting point.

Request a fixed budget

Build your ISMS now

‍

Book a demo Request a quote

Herwig Gangl

Co-Founder

"Implementing data protection and compliance in a structured way with Kertos"

From the very start, we felt that we were working with a partner who takes a realistic view of the effort and the process involved. The result, for us, is now a central platform that lets us manage our compliance topics in a structured way, across teams.

Jonas Menesklou

CEO & Co-Founder

"We especially appreciate the Trust Center"

After having a disappointing experience with a US-based provider, we wanted a platform that truly supports us efficiently and saves time. With Kertos, we achieved ISO 27001 certification in just 2.5 months—without external consultants and without blocking our team. Everything was clearly structured, well managed, and technically well thought out. The decisive factor for us was also the integrated Trust Center: it allows us to immediately demonstrate to our customers how seriously we take security.

Janina Möllmann

CEO, GAIA Technologies

“ISO 27001 certification within a few weeks”

With Kertos, we were able to achieve our ISO27001 certification within a few weeks. It was immediately obvious that this was a powerful compliance automation solution developed in and for the European market!

Stefan Hessel

Salary Partner & Head of Digital Business, reuschlaw

“Reliable partner for all compliance issues”

For us, Kertos is the reliable partner for all compliance issues. Whether it's ISO27001 certification or data protection, we really appreciate Kertos' expertise and support.

Matthias Knoche

COO, McMakler

“European compliance automation built for mid-market teams”

As a mid-market company, we don't have a large compliance team, and Kertos means we don't need to build one. It automated our GDPR workflows so thoroughly that work which used to take days now takes minutes, and in many cases doesn't need a compliance manager to touch it at all. Onboarding took an afternoon, including connecting our own homegrown software via API. And unlike the mass compliance providers, we get a European partner who understands our requirements firsthand.

Julian Lübke

Co-Founder & CEO, deeploi

“Real compliance powerhouse”

Kertos quickly and precisely guided us through the GDPR and ISO27001 certification compliance jungle. The Kertos platform was easy to implement and is a real compliance powerhouse due to the high level of automation.

Adrian Kapsalis

CEO of Kyon Energy

“Adapts to our changing needs”

Kertos adapts to our changing needs so we can focus on growing our business.

FAQ

Frequently asked questions about ISO 27001 certification

How much does ISO 27001 certification cost?

At market rates, the first year costs €23,000 to €49,000 for startups with fewer than 50 employees and €37,000 to €80,000 for scale-ups with 50 to 200 employees, including preparation, implementation, and audit fees. With Kertos, the effort for preparation and implementation drops the most. After scoping, you get a fixed budget.

How long does ISO 27001 certification take?

Without software, getting to ISO 27001 certification usually takes three to six months, often longer. With Kertos, you're audit-ready in 8 to 12 weeks. The certification audit typically follows within another 4 to 8 weeks.

How does the certification audit work?

The audit has two stages. In Stage 1, the certification body reviews your ISMS documentation. In Stage 2, it checks on a sample basis whether your controls work in day-to-day practice. The certificate is then valid for three years, with annual surveillance audits.

What is an ISMS, and do I need an ISMS tool?

An information security management system (ISMS) is the set of policies, processes, and controls a company uses to manage its information security. ISO 27001 doesn't require a tool. But ISO 27001 software like Kertos replaces spreadsheets and folders, collects evidence automatically, and keeps you audit-ready between audits.

What does ISO 27001:2022 require?

Clauses 4 to 10 of the standard are mandatory. On top of that come the relevant Annex A controls, which you select through a risk assessment and justify in the Statement of Applicability (SoA).

Is an ISO 27001 certificate valid in Austria?

Yes. An ISO certificate from an accredited certification body is recognized internationally, in Germany, Austria, and beyond. Kertos supports companies in both countries.