ISO certification, explained clearly

isocertificering.org is the bilingual knowledge base for ISO certification, ISMS, NIS2 and audit readiness. You get direct answers, roadmaps, checklists and comparisons — practical for executives, IT and compliance, with no certification guarantees. Start with ISO 27001, ISMS or NIS2; go deeper via cluster hubs. For execution and tooling we point to ISO Ready.

Start with ISO 27001 Doe de gratis ISO 27001 Quickscan

Readiness preview Indicative

Scope80%

Risk analysis60%

Evidence42%

Audit readiness28%

ISO certification and audit readiness can feel overwhelming — policies, scope, risk treatment, evidence and recurring audits. isocertificering.org is an independent knowledge base for Dutch and international teams: ISO 27001, ISMS setup, NIS2, GDPR, templates, costs and practical comparisons. Educational content only — no certification guarantees.

Where do you want clarity?

Pick your route — primary topics for certification and regulation; compact links for hosting, supply chain, and the scan.

ISO 27001 certification — From scope to certification audit: a practical route to a workable ISMS that auditors can follow.
NIS2 obligations — Governance, supply chain, and incident notification: what NIS2 means for your organisation and vendors.
GDPR & privacy — Align privacy, data flows, and processors with your security narrative and audit evidence.
Build an ISMS — Policy, roles, risks, and evidence: the building blocks every certification audit expects.

From orientation to audit-ready

A clear path: less noise, more evidence — aligned with how auditors assess an ISMS.

Understand the requirements — Translate the standard, laws, and contract clauses into concrete obligations for your scope.
Define scope and risks — Document scope, stakeholders, and risk treatment as the backbone of your ISMS and SoA.
Implement policy and controls — Connect policy to roles, processes, and controls — workable in the line, not only on paper.
Collect documentation and evidence — Traceable decisions, registers, and examples that match how you actually operate.
Prepare for the audit — Sampling, storyline, and evidence pack: show the ISMS runs and improves (PDCA).

Compare the core topics

What is it, when does it matter, and where do you start?

Practical tools and checklists

Concrete next steps: scan, checklist, or quick scan — each with a clear follow-up.

Start with our knowledge base, dive into ISO 27001 certification or NIS2 obligations. For hands-on tooling we link to ISO Ready where relevant.

Where do you want clarity?

Pick your route — primary topics for certification and regulation; compact links for hosting, supply chain, and the scan.

ISO 27001 certification

From scope to certification audit: a practical route to a workable ISMS that auditors can follow.

NIS2 obligations

Governance, supply chain, and incident notification: what NIS2 means for your organisation and vendors.

GDPR & privacy

Align privacy, data flows, and processors with your security narrative and audit evidence.

Build an ISMS

Policy, roles, risks, and evidence: the building blocks every certification audit expects.

EU hosting Vendor management Audit preparation Readiness scan ↗

From orientation to audit-ready

A clear path: less noise, more evidence — aligned with how auditors assess an ISMS.

1
Understand the requirements
Translate the standard, laws, and contract clauses into concrete obligations for your scope.
2
Define scope and risks
Document scope, stakeholders, and risk treatment as the backbone of your ISMS and SoA.
3
Implement policy and controls
Connect policy to roles, processes, and controls — workable in the line, not only on paper.
4
Collect documentation and evidence
Traceable decisions, registers, and examples that match how you actually operate.
5
Prepare for the audit
Sampling, storyline, and evidence pack: show the ISMS runs and improves (PDCA).

See the ISO 27001 roadmap

Compare the core topics

What is it, when does it matter, and where do you start?

ISO 27001

What is it?: A certifiable information security management system (ISMS) aligned with the international standard.
When is it relevant?: When you need demonstrable control over confidentiality, integrity, and availability — often required by customers and contracts.
Where do you start?: Start with context and scope, then risk assessment and Annex A control selection.

NIS2

What is it?: EU legislation focused on cyber risk, governance, and the supply chain.
When is it relevant?: Relevant for essential/important entities and frequently for vendors bound by contractual chain requirements.
Where do you start?: Confirm applicability, roles (e.g. CISO/accountable executive), and a proportionate control set with evidence.

GDPR

What is it?: The EU GDPR: rules for personal data processing and data subject rights.
When is it relevant?: Always relevant when you process personal data; often combined with ISO 27001 for security and privacy.
Where do you start?: Document processing activities and retention; map processors and DPIAs to your risks.

ISMS

What is it?: The information security management system: policy, processes, roles, and evidence.
When is it relevant?: When you must show the “system” works — not only isolated documents or tools.
Where do you start?: Move from context and stakeholders to risks, objectives, and a controlled control baseline (e.g. Statement of Applicability).