ISO 27001 certification in Ireland means an accredited body, such as NSAI, audits your information security management system and confirms it meets ISO/IEC 27001:2022. Certificates run on a three-year cycle with yearly surveillance audits, and fees are quoted per organisation. ERS IT Solutions does not certify or hold ISO 27001. Since 1983 we have run IT for Irish organisations, and today we help clients put in place and evidence the technical controls the standard expects.
What is ISO 27001 certification?
ISO/IEC 27001 is the international standard for an information security management system (ISMS). An ISMS is the set of policies, risk assessments, controls and reviews an organisation uses to protect information, run as an ongoing process rather than a one-off project.
According to the National Standards Authority of Ireland (NSAI), certification requires you to show that you have defined the scope of your ISMS, identified information security risks, put controls in place through a documented risk treatment process, assigned roles and governance, and set up monitoring, internal audit and continual improvement.
In Ireland the standard is published as I.S. EN ISO/IEC 27001:2023. NSAI states it is identical to ISO/IEC 27001:2022, and certification to either gives the same recognition.
How does ISO 27001 work?
The standard has two parts. Clauses 4 to 10 are the management system requirements: understanding your context, leadership, planning (including risk assessment), support, operation, performance evaluation and improvement. These are mandatory.
Annex A is a reference list of 93 information security controls in four themes: organisational, people, physical and technological. You do not have to apply all 93. You assess your risks, choose the controls that treat them, and record your choices and the reasons for any exclusions in a Statement of Applicability (SoA).
It follows the Plan, Do, Check, Act cycle: plan the ISMS and risk treatment, do it, check it through monitoring and internal audit, and act on what you find. NSAI's certification guide says you are expected to show this PDCA cycle at the registration audit.
Who certifies ISO 27001 in Ireland?
Certification must come from a certification body accredited to audit ISO 27001. In Ireland, accreditation is granted by the Irish National Accreditation Board (INAB). NSAI is accredited by INAB to certify organisations to ISO/IEC 27001:2022, and it is the state's own standards body. Other international certification bodies also audit Irish organisations under accreditation from INAB or another national accreditation body.
To check whether a certificate is genuine, or to look up ISO 27001 certified companies, use IAF CertSearch, the global database of accredited certificates backed by the International Accreditation Forum. There is no single official "ISO 27001 registered companies list" for Ireland, and certificates from unaccredited bodies will not appear.
ERS is not a certification body and does not issue ISO 27001 certificates.
How much does ISO 27001 certification cost in Ireland?
No Irish certification body publishes a fixed price list. NSAI provides a no-obligation quote, and its certification guide says quotations cover the full certification cycle, in most cases three years. The audit fee is set mainly by the number of auditor days, which depends on:
- Headcount and sites. More people and locations in scope means more audit time.
- Scope. Certifying one service or department costs less than the whole organisation.
- Complexity. The number of systems, cloud services, suppliers and how much is outsourced.
- Readiness. A failed Stage 1 effectively becomes a gap assessment and has to be repeated.
The certification fee is often the smaller part of the total. The real cost of ISO 27001 is internal time and the work to close gaps: writing policies, running the risk assessment, fixing technical controls, training staff and running internal audits. Some firms also pay a consultant to run the project. Because none of these costs is published as a reliable Irish range, the honest way to budget is to get a certification quote and a gap assessment first, then price the fixes.
For individual qualifications such as Lead Implementer or Lead Auditor, prices are public. See our guide to ISO 27001 lead implementer and lead auditor certification.
What are the ISO 27001 certification requirements?
To pass, you need:
- A defined ISMS scope and an information security policy approved by leadership.
- A documented risk assessment method and a completed risk assessment.
- A risk treatment plan and a Statement of Applicability covering all 93 Annex A controls.
- The controls you selected actually working, with records to prove it.
- Defined roles, staff awareness and competence records.
- Monitoring and measurement of how well the ISMS works.
- At least one internal audit and one management review before the certification audit.
- A process for handling nonconformities and corrective actions.
How to get ISO 27001 certified: the steps
NSAI describes the certification path as application and quotation, a Stage 1 audit, a Stage 2 audit, ongoing surveillance audits and recertification. Before that comes your own implementation work. A typical ISO 27001 implementation plan looks like this:
- Get management commitment and agree a budget and an owner.
- Set the scope: which parts of the business, locations and systems.
- Run a gap analysis against the clauses and Annex A.
- Do the risk assessment and write the risk treatment plan.
- Write the policies and the Statement of Applicability.
- Implement the controls, technical and organisational.
- Train staff and keep records.
- Run an internal audit and a management review.
- Book the certification audits with an accredited body.
ISO 27001 Stage 1 vs Stage 2 audit
| Stage 1 (preliminary assessment) | Stage 2 (registration assessment) | |
|---|---|---|
| Purpose | Check you are ready | Confirm the ISMS works as described |
| What is reviewed | Documentation, scope, legal requirements, policies, internal audits and reviews | Full management system, records and evidence that controls operate |
| Outcome | Report on readiness and areas to fix | Recommendation for certification, or not |
NSAI recommends several weeks between the two so you can fix issues raised at Stage 1. If Stage 1 finds you are not ready, it becomes a gap assessment and has to be repeated. After Stage 2 you submit an action plan for any findings before the certificate is issued.
How long does it take to get ISO 27001 certification?
It depends on your starting point. The certification audits themselves run over a few weeks, with the gap NSAI recommends between Stage 1 and Stage 2. The implementation before that is usually the longer part, because you need the ISMS running long enough to produce records, an internal audit and a management review. A small organisation with good IT already in place moves faster than one starting with no policies, no MFA and unsupported devices.
How long does ISO 27001 certification last?
NSAI certificates expire every three years. NSAI visits each registered organisation at least once a year for a surveillance audit, and carries out a full reassessment before the expiry date. Older ISO 27001:2013 certificates (I.S. EN ISO/IEC 27001:2017) expired after 31 October 2025, so any certificate still in use should be to the 2022 version.
ISO 27001 vs Cyber Essentials vs NIS2
| ISO 27001 | Cyber Essentials | NIS2 | |
|---|---|---|---|
| Type | Voluntary international standard | Voluntary UK certification scheme | EU law |
| Covers | Whole ISMS: risk, policy, people, suppliers, 93 controls | Five technical controls | Ten minimum risk management measures plus incident reporting |
| Checked by | Accredited certification body | IASME-licensed assessor | Irish competent authority, once the Act is in force |
| Cycle | Three years, yearly surveillance | Renew every 12 months | Ongoing supervision |
| Typical fit | Firms whose customers or tenders demand it | Any SME wanting a low-cost baseline | Medium and large firms in listed sectors |
For most Irish SMEs, Cyber Essentials comes first because it is quick and cheap and fixes the basics ISO 27001 auditors look at anyway. ISO 27001 is the right next step when customers ask for it or when you are, or supply, a NIS2 entity. The NCSC says it will continue to recognise ISO 27001 alongside its CyFun framework as a way of organising NIS2 measures. ISO 27001 does not on its own prove NIS2 or GDPR compliance, and NSAI says so for GDPR. Read our NIS2 guide for scope and deadlines, or compare ISO 27001 with SOC 2, NIST and other frameworks.
Which ISO 27001 controls can an MSP like ERS help with?
Many of the technological controls, and the evidence for them, are day-to-day IT work. ERS does not write your ISMS or certify you, but our managed services cover a large share of what auditors test:
| Annex A area | What ERS does |
|---|---|
| Access control, privileged access, secure authentication | MFA, separate admin accounts, Conditional Access and Microsoft 365 monitoring |
| Endpoint devices, configuration management | Device enrolment, encryption and policies through mobile device management |
| Technical vulnerability management | Patching and vulnerability assessment |
| Protection against malware, logging, monitoring activities | 24/7 managed detection and response |
| Information backup, ICT readiness for business continuity | Backup and disaster recovery with tested restores |
| Information security awareness, education and training | User awareness training with phishing simulations |
| Threat intelligence | Dark web monitoring for leaked credentials |
| Network security | Network management and firewall configuration |
We also produce the monthly reports and configuration evidence your internal auditor and certification body will ask for. Organisational controls such as the risk assessment, policies, supplier contracts and the management review stay with you or your ISO consultant. A clear split of who owns what is one of the first things to agree.