Get certified to ISO/IEC 27001
with international accreditation

ISO/IEC 27001:2022 is the international standard that sets requirements for an information security management system. STB ISO/IEC 27001-2024 is its national version in Belarus, and GOST R ISO/IEC 27001-2021 is the Russian version of the previous edition, ISO/IEC 27001:2013.

In February 2024, ISO/IEC 27001:2022 was amended by Amd 1:2024, which requires the company to determine whether climate change is relevant to its management system.

The core requirements of all three standards are comparable, but the certificate designation, the certification scheme and where the certificate applies are different. Operating in Belarus or taking part in a tender may require STB specifically, a Russian customer may require GOST R, and export calls for the international ISO/IEC 27001.

We check the requirements of your customer or the tender documentation and recommend only the certificates they actually list.

The certificate is issued by an independent certification body. It makes the decision based on its own audit.

We prepare your information security management system (ISMS) and documents, select a certification body for your goals and support your company through the certification audit.

No, ISO/IEC 27001 is not required by Belarusian law.

But a management system based on ISO/IEC 27001 helps you meet the requirements of the personal data protection law for organizational and technical measures, and the certificate shows your customer that the system has been checked by an independent body.

Most often, organizations get it because a customer or a tender requires it, for export, or to be included in the supplier lists of large companies.

The set of documents depends on your industry, the size of your organization, the number of sites and how your processes already work.

Typically you need:

• an information security policy;
• the ISMS scope;
• an information security risk assessment and the Statement of Applicability (SoA);
• procedures for access control, incident management and business continuity;
• allocation of responsibilities;
• control of documents and records;
• records of internal audits and management reviews.

We develop or adapt the documentation for your company, train the responsible employees and prepare the company for the certification audit.

Certification usually takes 45 to 90 business days. The timeline depends on your headcount, the number of branches and sites, how ready your documentation is and the auditors’ schedule.

First we assess the current state of your information security, then we develop the ISMS documents: the policy, the risk assessment, the Statement of Applicability and the Annex A controls. After that we train the responsible employees, conduct an internal audit and support your company through the two-stage certification audit. For large companies we calculate the timeline separately, and we fix the final plan before the project starts.

International ISO/IEC 27001 certification for a company with up to 25 employees starts at $4,700, including preparation and the certification audit. The final cost depends on your headcount, the number of sites, the ISMS scope, how ready your information security processes are, the chosen certification body, and whether you need a national STB certificate or an international ISO/IEC 27001 one.

The calculator on this page shows an approximate price in Belarusian rubles and US dollars. After a 15-minute intro call, we send you a quote with the exact price and fix it in the contract. Payment in installments: 50/50 or 25/50/25, with the final payment after you receive the certificate.

For export, we choose a certification body whose accreditation is part of the international mutual recognition system. A foreign customer, bank, marketplace or supply chain partner will find such a certificate easier to accept.

But there is no automatic recognition for every deal: a specific client or tender may set its own requirements for the standard, the certification body and accreditation. We check these conditions before the project starts. If needed, we arrange an apostille and translation of documents as a separate service.

Every certificate has a unique number. First, find it in the certification body’s register. There, the certificate must be shown as valid, and the organization name, address, standard, certification scope and issue date must match the certificate itself.

For an accredited certificate, also check the certification body itself and its scope of accreditation. International certificates are also visible in IAF CertSearch if the certification body has submitted the data there. Once the certification body issues your certificate, we will send you instructions and a link for verification.

That depends on the documentation of the specific procurement. In one case, ISO/IEC 27001:2022 is enough; in another, the customer specifically requires STB ISO/IEC 27001-2024 or GOST R ISO/IEC 27001-2021, a particular accreditation or additional data protection measures.

Send us the clause of the tender documentation with the certificate requirement. We will analyze the wording and suggest the minimum set of certificates that is enough for that clause.

Hiring a dedicated full-time specialist is usually not necessary. The company appoints one or more responsible employees who know the processes and can maintain the system after certification.

We develop the documentation, assign roles, train the responsible employees and support the team through the certification audit. As a result, the ISMS stays manageable within the company, and employees understand what records to keep and when.

After the initial audit, the certification body carries out annual surveillance audits. The company continues to keep records, update documents, conduct internal audits and management reviews, and correct any nonconformities found.

Before the end of the three-year cycle, the certification body conducts recertification. We remind you of key dates in advance. Annual surveillance is a separate paid service of the certification body and is not included in the cost of the initial certification project.

Yes, if the certificate is valid and was issued by an internationally accredited body (Global ACI MRA, formerly IAF MLA). This is usually needed when the previous body no longer works with the company or the certificate is about to expire.

We check the certificate status, its scope and the surveillance already completed, and then assess whether a transfer is possible. If it is not, we plan initial certification with the new body and coordinate the dates so that your certification stays uninterrupted for contracts and tenders.