Complass
ISO 27001: the road to certification – for companies in every sector
A tender, a mandatory field "ISO/IEC 27001 certificate" – and the question of how long the road there really takes. What the standard requires and how to plan the way.
ISO/IEC 27001 is the internationally recognised standard for information security management systems (ISMS). Customers, tenders and supplier assessments require it in more and more sectors – from IT service providers through healthcare, advisory and retail to manufacturing.
The whitepaper explains the requirements of clauses 4 to 10, risk assessment, the 93 Annex A controls and the Statement of Applicability, the two-stage certification with surveillance and recertification, and the link to NIS2 and the GDPR – with a 10-step plan and a checklist. Standard texts are not quoted but paraphrased with a clause reference.
Each obligation chapter includes a short "Implementation in Complass" box with a platform screenshot: only features already live are named.
13 pages · Version 1.0 · as of 05.10.2026 · Author Marc Linden, Complass GmbH i. G.
Try Complass with your own data
Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.