Certification required? From assessment to certificate.
Customers, banks, insurers, regulators and tenders increasingly demand proven information security and continuity. We run the complete ISO/IEC 27001 and ISO 22301 program, led by a Lead Auditor in both standards, with the same team all the way to the certification body's audit. And NLC covers the cost of certification.
You invest in implementation. NLC pays for the certificate.
The initial certification audit by the accredited certification body (stages 1 and 2) is paid for by NLC as part of the program. No second bill at the end of the project, and our commitment aligned with yours: we only finish when the certificate is issued.
Pick the standard. See what we deliver.
ISO 27001 is required. Can you prove it?
The international information security standard: proof to customers and partners that the company's data and systems are protected with method, evidence and continual improvement.
- ISO/IEC 27001:2022 gap assessmentConformance with clauses 4 to 10 and the 93 Annex A controls, with a closure plan.
- ISMS implementationContext, scope, policy, roles, documentation and Statement of Applicability (SoA).
- InfoSec risk management (ISO 27005)Methodology, asset inventory, analysis, acceptance criteria and treatment plans.
- Controls with evidenceAwareness, vulnerability management, pentest and the NLC SOC, which covers controls A.8.15, A.8.16 and A.5.24 to A.5.28.
- Internal audit, certification and surveillanceInternal audit, management review, support through stages 1 and 2 and readiness for annual audits.
If you stop today, can you prove you recover?
The international business continuity standard: proof that the company knows what is critical, how fast it must recover and that this has been tested, not just written down.
- ISO 22301 gap assessmentConformance with clauses 4 to 10 and current continuity maturity, with a closure plan.
- BCMS implementationContext, scope, policy, roles, documentation and business integration.
- BIA and risk assessmentCritical processes, RTO and RPO, dependencies and strategies by criticality.
- Tested plansContinuity, IT recovery and crisis plans, with tabletop exercises and live tests that measure the real RTO.
- Internal audit, certification and surveillanceInternal audit, management review, support through stages 1 and 2 and readiness for annual audits.
Two certifications, one effort
Both standards follow the same clause structure. Implemented together, they share policy, roles, risk, documentation, internal audit and management review.
- One assessment for both standardsSecurity and continuity gaps mapped at once, with a single closure plan.
- Single documentation and governanceOne policy, one committee, one risk matrix and one KPI calendar.
- Controls that serve bothBackup, IT recovery, incident response and crisis management meet both standards at the same time.
- Combined auditsInternal and certification audits planned together, with less disruption for the business.
What the auditor will ask for and what we deliver.
Both standards share the same seven-requirement backbone: context of the organization, leadership, planning, support, operation, performance evaluation and improvement. What changes is what each one protects.
93 controls in 4 themes
What you receive: For ISO 27001, you receive the ISMS scope with security policy and objectives, the risk methodology and report with the treatment plan and Statement of Applicability, the policies and procedures for applicable controls with evidence that they work, and the KPIs, internal audit report and management review minutes the auditor will ask for.
The continuity cycle
What you receive: For ISO 22301, you receive the BCMS scope with continuity policy and objectives, the BIA per ISO 22317 and the disruption risk assessment, the continuity, IT recovery and crisis strategies and plans, and the exercise program with reports, internal audit and management review that prove the system is alive.
A certificate valid for 3 years, maintained year after year.
Readiness and documentation
The certification body reviews scope, documentation and whether the company is ready for the main audit.
Certification audit
The auditor checks, through sampling and interviews, that the system works in practice and produces evidence.
Issued for 3 years
With no open major nonconformities, the accredited body issues the certificate.
Surveillance audits
Annual audits confirm the system is still alive, measured and improving.
Recertification
A new full audit renews the certificate for another 3 years.
NLC does not issue the certificate: to ensure independence, the audit is carried out by an accredited certification body chosen together with you. NLC prepares, supports and pays for the initial certification.
From the first assessment to the certificate.
We start with a gap assessment against every requirement of the standard and define with you the right scope, priorities, owners and timeline. We then implement the management system: policies, roles, risk analysis, controls and plans. The system then operates for a period, producing the evidence the auditor will ask for, with tests, exercises and team awareness. We run the internal audit and management review, fix what is needed and support the company through stages 1 and 2 of the certification audit, which NLC pays for.
Led by a Lead Auditor
The program is run by an ISO 27001 and ISO 22301 Lead Auditor who knows the standards from the auditor's side. Less rework and no surprises at audit.
Evidence, not just documents
24x7 SOC, recovery tests and crisis exercises produce the proof auditors ask for, all within NLC.
Everything in one place
Cyber, continuity, privacy and risk with the same team, with no vendor patchwork to close requirements.
Typical timeline of 6 to 12 months per standard, depending on scope and maturity. The certification audit is performed by an accredited body, and NLC prepares, supports and pays for the initial certification.
ISO/IEC 27001
ISO 22301Certification is required. What changes when you have it?
Lost contracts and tenders
- ✕Out of the biddingCustomers, banks and tenders that require certification are out of reach.
- ✕Endless questionnairesEvery customer asks for its own audit and the team answers everything again.
- ✕Incidents without a responseWithout a tested plan, an attack or outage becomes a crisis.
- ✕A project that never endsImplementation without method produces documents, not certificates.
Proven security and continuity
- ✓Open doorsA certificate recognized by customers, banks, insurers and regulators.
- ✓One answer for everyoneThe certificate replaces much of the customer questionnaires and audits.
- ✓Tested resilienceRisks treated, plans exercised and real RTO measured.
- ✓Certification paid by NLCFrom assessment to certificate, without the bill for the initial audit.
What we are often asked before starting.
What exactly does NLC pay for?
The accredited body's initial certification audit, stages 1 and 2, for the standard covered by the program. Terms and scope are set out in the proposal.
Do I need to certify the whole company?
No. The scope can be one site, product, service or critical process. Starting with a well-chosen scope shortens the timeline and already meets the customer's requirement.
How long does it take?
Typically 6 to 12 months per standard, depending on scope and maturity. The system needs to run and produce evidence for some time before the stage 2 audit.
Is it worth doing both together?
Yes, when both are required. Since the structure is the same, policy, risk, documentation, internal audit and management review are shared, and the audit can be combined.
What if the auditor finds nonconformities?
It is common and part of the process. We prepare the action plan and support the correction and the submission of evidence to the certification body until the certificate is issued.
And after the certificate?
We offer ongoing support: KPIs, annual internal audit, management review and readiness for surveillance audits and recertification in the third year.
Certification with people who know the auditor's side.
Start with a gap assessment and leave with the roadmap to the certificate, which NLC pays for.