ISO/IEC 27001:2022 standard · ISMS
ISO 27001 certification in Luxembourg.
ISO 27001 is the global standard for information security management systems (ISMS). In Luxembourg, it is increasingly required by international clients and the financial sector (CSSF), and it is the best foundation for meeting NIS 2 and DORA requirements. Luxgap supports you from the mock audit to certification.
Why aim for ISO 27001?
Three concrete benefits: (1) access to international B2B markets (large companies require ISO 27001 from their IT/SaaS suppliers); (2) NIS 2/DORA compatibility (an ISO 27001 ISMS covers 80% of the requirements); (3) lower cyber insurance premiums, by up to 30%.
In Luxembourg, the CSSF, the BCL and several PSF require ISO 27001 from their critical providers. Certification also opens the French, German and UK markets.
In Luxembourg, the CSSF, the BCL and several PSF require ISO 27001 from their critical providers. Certification also opens the French, German and UK markets.
How does ISO 27001 certification work?
1. Gap analysis: current state vs Annex A (93 ISO 27001:2022 controls), prioritisation. 2-3 weeks.
2. ISMS implementation: policy, scope, risk analysis, treatment plan, documentation (policies + procedures), training. 3-6 months depending on maturity.
3. Internal mock audit: our team checks compliance before the official audit.
4. Certification audit by an accredited body (Bureau Veritas, LSTI, AFNOR, etc.) that we select with you according to budget and sector.
5. Annual surveillance + recertification after 3 years.
2. ISMS implementation: policy, scope, risk analysis, treatment plan, documentation (policies + procedures), training. 3-6 months depending on maturity.
3. Internal mock audit: our team checks compliance before the official audit.
4. Certification audit by an accredited body (Bureau Veritas, LSTI, AFNOR, etc.) that we select with you according to budget and sector.
5. Annual surveillance + recertification after 3 years.
What makes our ISO 27001 approach pragmatic?
No consultancy producing 300 pages of policies that nobody reads. We set up an operational ISMS: just the required documentation, technical controls that are actually applied, and staff training that works. You get certified, but above all your security is REALLY improved.
We reuse your existing tools as much as possible (Microsoft 365 Security, Defender, your SIEM/EDR) rather than imposing new purchases. No licence to buy from us, just expertise.
Request an ISO 27001 quote →
We reuse your existing tools as much as possible (Microsoft 365 Security, Defender, your SIEM/EDR) rather than imposing new purchases. No licence to buy from us, just expertise.
Request an ISO 27001 quote →
How much does ISO 27001 certification cost?
It depends on: size of the organisation (scope, number of sites, number of employees), initial maturity (gap analysis), IT complexity (cloud/on-prem/hybrid), and the chosen certification body. For an SME with 50-100 staff starting from scratch, allow 60-120 k EUR excl. VAT over 6-9 months (Luxgap + certification audit). For an organisation that is already structured (mature IT department, ISO 9001), 30-60 k EUR. We calibrate after an initial audit.
Let's talk about your situation.
Quote within 24 business hours. No commitment, no sales pressure.