Guide
This guide is for management boards whose customer has demanded ISO 27001 certification, or who want to get security in order before the obligations of the Polish National Cybersecurity System Act (KSC Act) apply. We show when 90 days to prepare for the audit is a realistic plan, what needs to be done week by week, what makes up the cost and what happens after you receive the certificate.
ISO/IEC 27001 is an international standard describing an information security management system (ISMS). Put simply, it is how a company decides which information matters to it, what threatens that information and how it is protected. A certificate confirms that such a system works and that an independent body has checked it.
The standard is voluntary, and companies usually adopt it for one of three reasons. Most often, a large customer requires it in a supplier questionnaire or a tender. The second reason is banks and insurers, which since 17 January 2025 have had to oversee risk at their IT suppliers under the DORA regulation. The third is the amended Polish KSC Act: essential and important entities must implement an information security management system by 3 April 2027.
Take a hypothetical 80-person IT company that develops software for banks. Without a certificate, every customer sends it a questionnaire with several hundred questions, and some want to carry out their own audit. With a certificate, a single document answers many of those questions.
Certification does not always make sense. If no customer requires it and the company is not subject to the KSC Act, it is often better to start by getting the basics in order without formal certification. In the automotive industry, on the other hand, customers usually expect a TISAX assessment – an industry standard based on similar requirements – so check this before you start.
90 days means the time until you are ready for the certification audit, not until you receive the certificate. After that come waiting for an available date at the certification body, the two audit stages and time to fix nonconformities. In practice, several months usually pass from the start of the project to having the certificate in hand.
This timeline is achievable when all the conditions listed below are met. If one is missing, add time to put it in place. If two or more are missing, plan for six months instead. Rushing leads to documents that no one follows, and an auditor will quickly notice that when talking to employees.
The plan below assumes a mid-sized services or manufacturing company with one main location. The stages partly overlap, and the boundaries between them are approximate. The key thing is to hold the internal audit and the management review before the certification audit, because the certification body checks whether the system is already working. A management review is a meeting at which the board assesses how the system is performing.
Pay attention to the stage from day 31 to day 60. This is not about writing documents but about changes to everyday work: granting and removing access rights, supplier control, responding to incidents. This is where time most often runs short.
| Period | What needs to be done | Result |
|---|---|---|
| Days 1–14 | Analysis of the current state, setting the scope, a list of important information and systems, customer and legal requirements | Certification scope approved by the management board and a list of gaps to close |
| Days 15–30 | Risk analysis with department managers, security policy, allocation of responsibilities | Risk register, risk treatment plan, first version of the Statement of Applicability |
| Days 31–60 | Implementing selected controls: access rights, suppliers, incidents, backups, business continuity | Working procedures and the first records you can show the auditor |
| Days 61–75 | Training for all employees and separate training for people in key roles | Attendance list and a knowledge test after the training |
| Days 76–90 | Internal audit, corrections, management review | Internal audit report and management review minutes signed by the board |
The standard does not tell you to implement every control. It tells you to assess risk and choose protective measures to match. That is why risk analysis is the heart of the whole system, not a box-ticking formality.
The result of this analysis goes into the Statement of Applicability. This is a table in which, for each of the 93 controls in Annex A, the company states whether it applies it, why and how. When you exclude a control, you have to justify it.
For example, a company without its own server room that keeps its data in Microsoft 365 can justify excluding some physical controls for a data centre. However, it cannot exclude oversight of the cloud provider, because the risk has simply moved. The auditor usually starts with this document, so it is worth getting it right.
The controls are divided into four groups. The list below shows what they cover.
An auditor does not check whether you have nice policies. They check whether people in the company do what the policies say.
The audit is carried out by a certification body accredited for ISO/IEC 27001. Polish bodies are accredited by the Polish Centre for Accreditation (PCA), and foreign ones by the national accreditation bodies of their countries. You can check in the relevant register whether your chosen body is accredited for this standard. A certificate from a body without accreditation may not be recognised by your customer.
The audit has two stages. In the first, the auditor reviews the documents and assesses whether the company is ready for the main assessment. In the second, the auditor talks to employees, looks at records and checks whether the rules work in practice. The certification body calculates the number of audit days according to accreditation rules, mainly based on the number of people within the scope.
The auditor may find major or minor nonconformities. A major one, such as no internal audit or a control that is described but not applied at all, holds up the certificate until it is fixed. The company closes minor ones according to an action plan, which the certification body checks at its next visit.
The cost is made up of five elements, and their proportions vary a great deal between companies. We do not give average figures, because without knowing the scope and starting point they would be misleading. Instead, we show what each element depends on and what to ask when comparing proposals.
When comparing proposals from certification bodies, compare the price for the whole three-year cycle, not just the first audit. When talking to consultants, ask how many hours of your people’s time they assume and who will maintain the documentation after implementation.
| Component | What it depends on | What to watch out for |
|---|---|---|
| Employees’ time | Number of departments in scope, availability of managers, state of the documentation | Usually the biggest cost, but rarely included in the budget |
| External support | Whether you buy only templates, project management, or the internal audit as well | Off-the-shelf templates that are not adapted lead to nonconformities |
| Certification body | Number of people in scope, number of locations, complexity of systems | What counts is the cost of surveillance and recertification audits, not just the first one |
| Technical controls | Gaps found in the risk analysis: two-factor authentication, backups, endpoint protection, collecting logs (records of events in systems) | Some of these features are already in your existing Microsoft 365 licences |
| Training | Number of employees and roles that need specialist training | Training has to be repeated, not done just once |
The certificate is valid for 3 years. During that time the certification body comes back at least once a year for a surveillance audit, the first one within 12 months of the certification decision. After three years comes the recertification audit.
Between audits, the system has to be kept alive. Someone updates the risk analysis after changes in the company, keeps the incident register, carries out the internal audit and prepares the review for the management board. When no one is responsible for this, the documents go out of date within a few months.
Mid-sized companies solve this in one of two ways. Some appoint a person within the company; others use an external part-time security specialist (a so-called vCISO). Either way, it is worth putting the system review in the board’s regular calendar.
NIS2 is an EU directive that binds member states, not companies. In Poland it was implemented through the amendment to the National Cybersecurity System Act, in force since 3 April 2026. It is the Act, not the ISO standard, that imposes obligations on essential and important entities.
The Act requires these entities to have an information security management system and to report incidents, and requires essential entities to undergo regular audits as well (the first by 3 April 2028). The deadline for implementing the system and the other obligations is 3 April 2027. ISO 27001 provides a ready-made way to build such a system, so a certified company has a large part of the work behind it.
However, a certificate does not exempt you from statutory obligations. Reporting incidents within the deadlines set by the Act, registering in the official list and the audit required by the Act are separate matters. If your company is subject to the Act, set the certification scope so that it covers the services the regulations apply to.
Most audit nonconformities are not caused by a lack of technology. They are caused by a gap between what is written down and what people do every day. These are the mistakes we see most often:
Related topics in the knowledge base
FAQ
Questions management boards usually ask when planning certification that did not fit into the main text.
About this page
Sources
About the author
Kacper Włodarczyk
CEO of ALGORCOMP
Kacper specializes in implementing Microsoft 365 Copilot, Copilot Studio, Power Platform (Power Automate, Power Apps, SharePoint) and AI agents for mid-sized B2B companies in Poland. He leads dozens of projects covering AI strategy, Power Platform governance, document workflow automation and sales processes. In his writing he focuses on the practical side of AI adoption in organizations — from the first proof of concept to company-wide rollout — with particular attention to data security, compliance (GDPR, NIS2, the AI Act) and return on investment.
Meet the teamWe will help you assess whether 90 days is realistic for your company, agree the scope and prepare an implementation plan that divides the work between your team and external support.
Featured
What Claude Mythos is, who can use it, what the June suspension of access taught us and what a mid-sized company should change in its security.
What a vCISO does, what Poland’s new National Cybersecurity System Act requires of companies, when this model pays off, and when a full-time hire or a good IT provider is the better choice.
A comparison of an external and an in-house head of information security: what the Polish KSC Act says, how to calculate the cost of each model and when each one makes sense.
Author: Kacper Włodarczyk, CEO of ALGORCOMP