ISO 27001: get certified or just implement?
Updated: 2026-11
Certification pays off when key customers require it, tenders make it a condition or you want to stand out clearly. Working to the standard without a certificate is enough when the focus is good security organisation and meeting NIS2, and customers accept documented implementation.
The standard is the same; the difference lies in external confirmation. A certificate proves to third parties that the ISMS has been audited, but it costs audit days and commits you to an annual rhythm.
Many companies start without a certificate and decide later, once customer requirements are clearer.
Head to head
| Criterion | Get certified | Work to the standard without a certificate |
|---|---|---|
| Evidence for customers | Strong, confirmed by an accredited body | Own documentation, sufficient for some customers |
| Tenders | Meets requirements that demand a certificate | Can exclude you where it is mandatory |
| Effort | ISMS plus audits and surveillance | ISMS without external audits |
| Discipline in operation | Annual audit enforces maintenance | Depends on internal consistency |
| NIS2 | Makes evidence easier | Not legally required |
| Flexibility | Bound to the standard and audit rhythm | Freer in scope and pace |
When Get certified wins
- —Key customers or tenders explicitly require a certificate.
- —You sell to regulated sectors that vet suppliers strictly.
- —You want to demonstrate security externally as a selling point.
When Work to the standard without a certificate wins
- —Customers accept documented implementation or a completed questionnaire.
- —The focus is meeting NIS2 and improving internal organisation.
- —The team is small and should build the foundations first.
Our take
Build the ISMS so that certification is possible at any time, and decide on the audit based on your most important customers’ requirements.
If you already receive questionnaires that ask for a certificate, certification often saves more time than the audits cost.
Parent service: Cyber readiness & IT security
Matching offers
Building an ISMS to ISO 27001
An ISO 27001 ISMS is the solid foundation for NIS2, TISAX, customer requirements and possible certification. We build it to fit your company: scope, risk assessment, statement of applicability, policies, responsibilities and internal audit. The certification audit is carried out by an accredited body.
Answering customer security questionnaires
Under NIS2 and DORA, large customers must assess their suppliers’ security and send extensive questionnaires to do so. We help answer them honestly and completely, compile the evidence required and build an answer library so the next questionnaire takes hours rather than days.
FAQ
Can we still certify later?
Yes. An ISMS built to the standard can be certified later with manageable additional effort.
Does NIS2 require ISO certification?
No. NIS2 requires appropriate risk management measures; certification can ease evidence but is not mandatory.