ISO/IEC 27001:2022
ISO 27001 Standard Implementation
ISO/IEC 27001 is the leading international standard for information security management systems (ISMS). It defines how an organisation identifies risks to information and systematically manages them — through people, processes and technology.
What is ISO/IEC 27001:2022?
ISO 27001 protects three properties of information: confidentiality, integrity and availability. The 2022 revision brought a modernised Annex A with 93 controls across four themes (organisational, people, physical and technological), including new controls for cloud services, threat intelligence and secure coding.
Today the certificate is effectively the entry ticket to serious B2B contracts in the IT sector, finance and public-sector work — it lets clients shorten their own supplier due diligence. On top of that, an ISMS is a natural foundation for aligning with the NIS2 directive, GDPR and sector-specific information-security regulations.
A legal obligation in the EU and in Montenegro
In the European Union, the NIS2 directive requires essential and important entities to manage information-security risk, and member states set the details in national law. In Montenegro, the Law on Information Security (Official Gazette of Montenegro, No. 113/2024) entered into force on 5 December 2024 and aligns Montenegro with the EU's NIS2 directive — Montenegro is among the first Western Balkans countries to do so. The law introduces the categories of "key" and "important entities": state bodies, critical-infrastructure operators and companies from sensitive sectors (energy, transport, healthcare, finance, digital infrastructure, public services and others), regardless of their size.
Of these, only key entities are required to obtain a MEST ISO/IEC 27001 certificate within 30 months of the law entering into force — by June 2027 at the latest; important entities apply the prescribed security measures without a mandatory certificate. Implementing an ISMS realistically takes several months: cataloguing information assets, risk assessment, applying Annex A controls and an internal audit. The earlier you start, the less pressure as the deadline approaches.
If you're not sure whether the law applies to your organisation, or how much time you realistically need to comply, get in touch — we will assess the scope of work free of charge and propose a plan that meets the deadline.
Implementation phases
The real phases we guide every project through — from preparation to the certificate, which comes only at the end:
Improvement and Corrective Actions
The steps follow the structure of clauses 4–10 of the standard itself, so the project's progress is also evidence of compliance at the audit. Not sure whether you already meet these requirements? Check with the short self-assessment at the bottom of this page.
Organisational context and ISMS scope
We analyse internal and external issues and interested parties, and precisely define the scope — which locations, processes and systems fall within the ISMS.
Leadership and the security policy
Management adopts the Information Security Policy, roles and responsibilities are assigned, and resources are secured.
Risk assessment and treatment
The heart of the standard: cataloguing information assets, identifying threats and vulnerabilities, risk evaluation and selecting controls from Annex A. The result is a Risk Treatment Plan and Statement of Applicability (SoA).
Support: resources, competence, documentation
Procedures and records, training and awareness-raising — from phishing tests to clear-desk rules and password management.
Operational implementation of controls
The controls from the SoA go into practice: access management, cryptography, backup, incident handling, supplier security, continuity.
Monitoring, measurement and internal audit
Performance indicators, an internal audit of the whole ISMS, and a management review — mandatory evidence for certification.
Improvement and corrective actions
Nonconformities are analysed and resolved; the system enters the PDCA cycle of continual improvement.
The path to certification
Certification is carried out by an independent accredited certification body, in two stages.
The prerequisite for everything: the system is implemented and applied in practice — every requirement of the standard met, the internal audit carried out and the management review completed.
Checking whether the ISMS is documented in line with the standard and ready for Stage 2.
Interviews with employees and review of evidence that controls actually work.
A certificate valid for 3 years once nonconformities are closed.
Annual audits maintain the system; recertification in the third year.
Benefits of Adopting the Standard
Internationally recognised proof that you take data protection seriously — an increasingly common condition for contracts and tenders.
Risks are treated before an incident, reducing the likelihood of costly data breaches.
A solid foundation for NIS2, GDPR and information-security laws.
A point of differentiation in the market, especially in IT, finance and telecommunications.
An illustrative, typical scenario we often hear from clients — it does not represent a specific, named client.
“Before ISO/IEC 27001 we did not even know how many information assets we actually had — servers, databases, contracts, employee access rights, all scattered with no record. During implementation we built an asset register, classified data by confidentiality, assessed our information risks and wrote a business continuity plan in case the system goes down. The certificate was the trigger, but today we know exactly what we are protecting and from what.”
— a common scenario among our clients
Related standards
The NIST Cybersecurity Framework (CSF) and ISO 27001 complement each other well: NIST's functions (Govern, Identify, Protect, Detect, Respond, Recover) map directly onto Annex A controls, so organisations doing business with the US market often use both. ISO 27701 extends the ISMS to privacy, ISO 22301 deepens business continuity, and ISO 42001 covers AI management on the same principles.
ISO/IEC 27001 training — from a basic understanding of the standard to internal auditor training. Delivered at your premises, online or as a combination of both.
FAQ about ISO/IEC 27001:2022
How long does ISO 27001 implementation take?
For small and medium organisations, usually 4 to 8 months, depending on process maturity, the scope of the system and team availability. For large systems — over 500 employees, multiple locations or an integrated system of several standards — a project realistically runs beyond a year; we handle those clients too.
Is ISO 27001 mandatory?
For most organisations it's voluntary. The Law on Information Security (Official Gazette of Montenegro 113/2024), in force since December 2024 and aligned with the EU's NIS2 directive, introduces "key" and "important entities" — regardless of size, these are state bodies, critical-infrastructure operators and companies from sensitive sectors (energy, transport, healthcare, finance, digital infrastructure, public services and others). Only key entities are legally required to obtain a MEST ISO/IEC 27001 certificate within 30 months of the law entering into force — by June 2027 at the latest. Important entities apply the prescribed security measures without a mandatory certificate, and for everyone else the certificate is voluntary — but it's increasingly required by clients, tenders and contracts. Who is covered and which deadlines apply is explained on the page NIS2 and the Law on Information Security.
What is Annex A?
93 security controls across 4 themes: organisational, people, physical and technological. They are selected based on the risk assessment and documented in the Statement of Applicability (SoA).
What's the difference between ISO 27001 and the NIST CSF?
ISO 27001 is a certifiable management-system standard; the NIST CSF is a voluntary best-practice framework. They complement each other well and map onto one another.
How long is the certificate valid?
Three years, with mandatory annual surveillance audits, then recertification.
How much does ISO 27001 implementation cost?
There is no fixed price that applies to everyone — the cost depends on the organisation's field of activity, its size and number of employees, the chosen standard and the current state of the system. Send us a short description of your organisation and we will prepare a free, tailored estimate.
Standards that fit together like a honeycomb
Each standard keeps its own shape, but together they form a single solid, integrated management system (IMS) — with no gaps or overlaps. Click a hexagon to open that standard.
More about the integrated management system
An integrated management system (IMS) combines two or more ISO standards — for example ISO/IEC 27001 with ISO 9001 or ISO 14001 — into one shared framework of documentation, objectives and internal reviews, instead of each standard living in its own parallel procedure.
A single structure (the High-Level Structure — HLS) shared by every modern ISO standard. Thanks to it, the quality policy, risk management, internal audits and management review can be common to several standards at once.
Each standard on its own addresses one part of the business — quality, environment, safety, information. When an organisation introduces several of them, separate systems quickly duplicate the same documentation and the same auditors.
Less duplicated procedure work, simpler management, stronger process oversight, more efficient use of resources and easier preparation for a combined certification audit.
ISO/IEC 27001 can be implemented on its own or as part of an integrated system — the decision depends on how many standards you're targeting and whether you're introducing them at once or gradually.
Check your organization's readiness
Answer a few questions and receive an indicative assessment of your organization's current level of readiness for ISO/IEC 27001.
This self-assessment provides an indicative readiness result only. It does not constitute certification, an official audit, or formal confirmation of compliance.
The EU, the US and other markets
ISO/IEC 27001 is the same standard wherever you certify it — what differs is the designation, the accreditation behind the certificate and what your customers ask for.
In the European Union the standard is adopted with an EN prefix, and what your buyer in the Netherlands, Germany or France looks at is not the prefix but the accreditation behind the certificate: a body accredited by a signatory of the international recognition arrangement (Global Accreditation Cooperation, formerly IAF) is recognised in other markets too. What EU partners and EU regulation expect is on the page about the EU market.
For companies with customers in the United States — supplier audits, security questionnaires and how ISO sits alongside SOC 2 — see the page about the US market.
Wherever your customer is, we run the project remotely in English — over Teams, WhatsApp or Viber, with documentation and records in English — and on site when that is easier.
Montenegro and the region: MEST ISO/IEC 27001:2023
When people ask about a MEST ISO/IEC 27001:2023 certificate (or a ISO/IEC 27001:2022 certificate), they mean the confirmation issued by an independent accredited certification body to an organisation whose system complies with every requirement of this standard. Montenegro's national edition of the standard carries identical content to the international edition — the same requirements, the same clauses, just under a national designation — which is why both designations turn up in tenders for the same standard.
Why do the designations differ if it's the same standard?
Every member country of the European and international standardisation system adopts the same standard into its own national catalogue and adds a national prefix — in Montenegro, that's MEST. The content, structure, clauses and every requirement an auditor checks during certification remain completely identical regardless of which designation appears on the document. That's why a certificate issued under one designation fully covers the other — it isn't two standards, but one and the same, simply under two names.
Our core activity is standards implementation and rollout: we prepare your organisation so the certification audit goes without surprises, and we explain terms like "ISO/IEC 27001:2022 certification" and "MEST EN ISO/IEC 27001 certificate" because that's exactly how clients search for them. What certification, accreditation, IAF and surveillance audits involve — read the Certification / ISO Certificate page, and about tender designations on the ISO Standards in Tenders page.
Montenegro is where we work from: our consultants are based in Podgorica, Budva and Bijelo Polje, documentation and training come in Montenegrin or in English, and the certificate itself is issued by an independent accredited certification body — not by us. We work on site in Serbia, Bosnia and Herzegovina, Croatia, North Macedonia, Albania and Kosovo as well — more about what we do in Montenegro.
Some of our references
More than 400 organisations in Montenegro and the region have gone through implementation with us — from banks and public bodies to manufacturing, IT, laboratories and hospitality.
These are only some of our clients. More about us →
Request a free consultation
We will assess the scope of work and propose a realistic plan and budget for your organisation. Call us or send an inquiry — we reply within 24 hours.