ISO 27001 Certification in Poland: Costs, Timeline and Implementation Guide

ISO 27001: From Strategy to Implementation

Introduction: Why ISO 27001 Is Now a Must

Data has become a company's most valuable asset. Losing it, leaking it or even having it unavailable for a short time can cost millions of zlotys and wreck a reputation that took years to build. That's why information security has moved from "nice to have" to an absolute necessity.

ISO/IEC 27001 is the international standard for building and maintaining an Information Security Management System (ISMS, or SZBI in Polish). It isn't just another certificate to file away. It's a practical tool for managing risk in a way that both IT and the executive team can understand.

This article is a complete guide to ISO 27001 certification in Poland. It covers the requirements of the GDPR (RODO), the National Interoperability Framework (KRI) and what implementation really costs.

How ISO 27001 Works: The Foundations

The CIA Triad: Three Pillars of Security

ISO 27001 doesn't prescribe specific technologies. Instead, it gives you a flexible management framework built on three pillars, known as the CIA triad:

Confidentiality: Only authorized people can access the data
Integrity: Data is complete and has not been altered
Availability: Data is accessible when it's needed

The PDCA Cycle: Continuous Improvement

The system runs on the Deming cycle (PDCA), a simple but effective method:

Plan: analyze risk and plan your controls
Do: implement the controls and train your team
Check: monitor, audit and verify that the controls work
Act: make corrections and improvements

The cycle never ends. Security is a process, not a project.

What Do You Need to Analyze?

The standard requires you to understand your organization's context:

Inside the company: culture, structure, budget, resources
External environment: the GDPR, the National Cybersecurity System Act (KSC), competitors, the market
Interested parties: customers, suppliers, the Personal Data Protection Office (UODO), the Polish Financial Supervision Authority (KNF)

What's New in the 2022 Version

The latest version, ISO 27001:2022, is simpler. It has 93 controls (down from 114) in 4 categories:

Organizational: 37 controls (policies, roles, governance)
People: 8 controls (training, awareness)
Physical: 14 controls (server room access, surveillance)
Technological: 34 controls (encryption, backups, logging)

Risk Management: The Heart of the System

Risk management isn't theory. It's a set of concrete actions that protect your business. There are two ways to approach it:

Approach 1: Asset-Based

This is the traditional approach, preferred by regulated sectors such as finance and energy. It works like this:

Build an asset inventory: list every resource (servers, data, people, documents)
Assign owners: who is responsible for what?
Identify threats: fire, hackers, weak passwords
Assess risk: likelihood × impact = risk level

Approach 2: Scenario-Based

This modern approach goes over better with executives because it speaks the language of business. Instead of saying "server-001 has vulnerability CVE-XYZ," you say:

"A ransomware attack could halt shipping for 48 hours, costing us PLN 500k and our largest customer."

That kind of concrete statement gets through to decision makers.

What to Do About Risk: 4 Options

Once you know your risks, you have to decide how to handle each one:

Reduce: implement controls (firewall, training, backups)
Avoid: stop doing the risky activity (e.g., processing sensitive data)
Transfer: buy cyber insurance or outsource to an external provider
Accept: make a deliberate decision that the risk is low enough to take no action

The key point: every decision must be documented.

The Statement of Applicability (SoA): Your "Contract" with the Auditor

The Statement of Applicability (SoA) is the most important document in the entire ISMS. It lists all 93 ISO 27001 controls, and for each one you must record:

Do you apply it? (yes/no)
Why do you apply it? (e.g., "Risk R-12: laptop theft" or "GDPR Art. 32 requirement")
Why DON'T you apply it? (e.g., "We do not process biometric data")
Implementation status (planned/in progress/implemented)

The "Golden Thread": The Key to Passing the Audit

The auditor will look for a logical chain, often called the "golden thread":

Threat → Mitigation decision → SoA control → Evidence of operation

Example:

Threat: Theft of a laptop containing customer data
Decision: We implement disk encryption
SoA control: A.8.11 "Data encryption"
Evidence: A BitLocker screenshot from every laptop

If even one link in the chain doesn't hold up, you have a nonconformity.

How Long Does It Take? A Realistic Implementation Timeline

Time Estimates for Poland

Implementation time depends on the size of the company and its maturity:

Micro and small businesses (up to 50 employees): 3–6 months
Mid-sized companies (50–250 employees): 8–12 months
Large enterprises (250+ employees): 12–18 months

5 Project Phases

Phase 1: Gap Analysis (Pre-Assessment)

We compare where you are now with where you need to be
Cost for SMBs: PLN 5,000–7,500
Duration: 2–4 weeks

Phase 2: System Design

We write the security policies
We define the scope (what is in the ISMS and what isn't)
We define roles and responsibilities

Phase 3: Risk Management

Workshops with your team
Risk register
Statement of Applicability (SoA)

Phase 4: Control Implementation

Purchases (firewall, backup, encryption)
Physical changes (locks, surveillance)
Employee training
Penetration testing

Phase 5: Internal Audit

Checking that everything works
Management review
Preparing for the certification audit

How Much Does It Cost? Real Prices in Poland (2024–2025)

Now for the numbers: what will ISO 27001 certification cost you in Poland?

Implementation Costs (Before the Audit)

Consulting:

Micro/small business (up to 50 employees): PLN 7,000–14,000 net
Mid-sized company (50–250 employees): PLN 14,000–28,000 net
Large company: PLN 30,000–100,000 net

Automation platforms (GRC):

Vanta, Drata, Secureframe: USD 3,000–10,000 per year
A good fit for tech companies and startups

Additional costs:

Penetration testing: PLN 2,000–8,000
Employee training: PLN 1,000–5,000
New security measures (firewall, backup): depends on your infrastructure

Certification Costs (Certification Body Audit)

The certificate is valid for 3 years. During that time you must pass:

1 certification audit (Stage 1 + Stage 2)
2 annual surveillance audits

Estimated costs in Poland:

Company Size	Certification Audit	Surveillance Audit (per year)	Total (3 years)
Micro/Small (<50 employees)	PLN 8,000–15,000	PLN 3,500–5,000	PLN 15,000–25,000
Mid-sized (50–250 employees)	PLN 15,000–30,000	PLN 5,000–9,000	PLN 25,000–48,000
Large (>250 employees)	PLN 30,000–150,000	Custom quote	PLN 60,000–300,000+

So what's the total? For a typical small company (30 employees): roughly PLN 30,000–50,000 (implementation plus 3 years of certification).

The Certification Audit: What to Expect

The audit isn't a memory test. It verifies that your system ACTUALLY works in practice.

Stage 1: Documentation Review (Desktop Review)

The auditor reviews your documents without leaving the office:

ISMS scope
Statement of Applicability (SoA)
Security policies
Risk register

Outcome: A report listing "Areas of Concern." If there are critical gaps, Stage 2 won't go ahead until you fix your documentation.

Stage 2: The Main Audit ("Show Me")

Now the auditor comes on-site to verify that what you wrote down actually works:

Observation: watches how people work (are desks clear, are screens locked?)
Interviews: talks to employees ("What do you do if you lose your laptop?")
Evidence: checks logs, screenshots and policies signed by employees

This is the moment of truth. You can't bluff your way past a well-prepared auditor.

Nonconformities: When Do You Fail?

Major Nonconformity:

A systemic problem (e.g., NO ONE has completed GDPR training)
Lack of management commitment
Result: The certificate is NOT issued

Minor Nonconformity:

An isolated lapse (e.g., one person didn't sign the policy)
Result: You must fix it within 90 days, but you still get the certificate

The Most Common Mistakes in Polish Companies

No real management commitment: the CEO signed the policy but never read it
Weak supplier oversight: no data processing agreements in place
"Clean Desk" only on paper: the policy exists, but documents containing personal data are lying around the office
Untested backups: "we have backups," but nobody has ever tried to restore one
Continuity plans gathering dust: a polished BCP document that no one knows about

Choosing a Certification Body: What to Look For

Not all certificates are created equal. Accreditation is what matters, and in Poland that means the Polish Centre for Accreditation (PCA).

Polish certification bodies:

PCBC
PRS
UDT-CERT

International bodies (often more expensive, but more prestigious):

TÜV Rheinland/SÜD
DNV
BSI Group

When choosing a certification body, check:

Whether it is PCA-accredited (otherwise your certificate may not be valid)
Its experience in your industry
Reviews from other companies
Auditor availability (will you wait 6 months for a date?)

ISO 27001 and the Law: GDPR, KRI, NIS2

GDPR (RODO)

ISO 27001 is considered best practice for meeting Article 32 of the GDPR (technical and organizational measures). Certification helps you:

Demonstrate due diligence to the Personal Data Protection Office (UODO)
Reduce fines in the event of a breach
Build customer trust

Note: ISO 27001 is not the same as GDPR compliance, but it makes compliance much easier to achieve.

The National Interoperability Framework (KRI)

For public sector entities (government offices, schools, hospitals), § 20 of the KRI recognizes an ISMS based on ISO 27001 as meeting the legal requirements. You must carry out regular internal audits.

NIS2 and DORA

New EU regulations require advanced cybersecurity systems. ISO 27001 makes it much easier to demonstrate compliance and prepare for audits.

After Certification: Maintaining the System

Certification isn't the finish line. It's the starting point:

Surveillance audits (once a year):

The auditor reviews 30–50% of the system
Cost: PLN 3,500–9,000 (depending on company size)

Recertification (after 3 years):

A full audit from scratch
Cost: roughly 60–70% of the initial audit

Ongoing work:

Management reviews
Risk updates
Employee training
Incident response

Key Takeaways

ISO 27001 is a business tool, not just an IT tool: it helps you manage risk in terms executives understand
Management commitment is essential: without real support from the CEO, all you have is "dead documentation"
Scale it to fit your business: small companies don't need to copy corporate processes. Keep it simple and practical.
Combine it with the GDPR and other requirements: many controls overlap, which saves you time and money
Security is a process, not a project: the certificate is just the "exam." The real value comes from what you do every day.

Who Needs ISO 27001?

Companies that work with the public sector
Tech startups looking for investors
Entities covered by NIS2 or DORA
Companies planning international expansion
Anyone who cares about customer trust

ISO 27001 is no longer a luxury. It's a necessity for any organization that takes security seriously.

References

Key Requirements of ISO 27001: The Path to a Certified Information Security Management System - nFlo Link
The Statement of Applicability in ISO 27001: The Key to Effective Security Controls – Progress Q&S Link
ISO 27001 and Personal Data Protection - Akademia LTCA Link
ISO 27001 Clause 10.2: Nonconformity and Corrective Action - DataGuard Link
How to Conduct an ISO 27001 Audit - dominikakrolik.pl Link
Risk Assessment Methods for ISO 27001:2022 | ISMS.online Link
ISO 27005 standard explained - NordLayer Link
The two approaches for information security risk identification proposed by ISO/IEC 27005:2022 - RIGCERT Education Link
Scenario vs. Asset-Based Risk Assessments: Understanding the Key Differences Link
How to Write an ISO 27001 Statement of Applicability: Free Template + Example Link
How to Write a Statement of Applicability (SOA) ISO 27001 | by Tahir - Medium Link
How to Write an ISO 27001 Statement of Applicability - Hyperproof Link
How Long Does ISO 9001 Implementation Take? - iso sklep Link
How Long Does It Take to Get ISO Certified? - PCC CERT Link
How much does ISO 27001 certification cost? - Vanta Link
ISO 27001 Certification Cost Breakdown: Plan Your Compliance Budget - Sprinto Link
How Much Does ISO 27001 Certification Cost? | Secureframe Link
ISO 27001 Gap Analysis: What is It and How to Perform One? - Drata Link
ISO 27001 Statement of Applicability Guide - Scrut Automation Link
What Is ISO 27001? What Is an Internal Audit in an Organization? - Pełni Wiedzy Link
ISO 9001 Certification - Multicert Sp. z o.o. Link
Here's How Much ISO 27001 Certification Costs - Network Assured Link
ISO 27001 certification: Cost, process, timelines and implementation in 2025 - TrustCloud Link