A customer demands ISO 27001, and nobody has time for it.
A customer or tender demands an ISO 27001 certificate, usually with a date attached, and internally nobody has the time or the experience to lead that programme. Within two days you'll have an experienced lead implementer interviewed who has done this before. If what you actually need is a permanent security officer, we recruit those just as well, though not within two days.
The moment
The question rarely comes from IT. It comes from sales. A major customer writes "ISO 27001 required" into its supplier terms, a tender asks for the certificate at submission, or an existing customer wants to know at contract renewal when you'll be certified. From that moment it's no longer a security wish but a commercial deadline, and it turns out the IT manager who was going to "do it on the side" doesn't have three days a week for it. That's the point at which organisations call us: not for an advisory report, but for someone who will lead the programme and arrive at the audit on time.
What the standard asks of you
ISO 27001 is not a checklist but a management system for information security (an ISMS): you define the scope, run a risk analysis, choose from the 93 controls of the 2022 version, record why you don't apply some of them, and prove with an internal audit and a management review that the system is running. Then comes the external audit in two stages, and the certificate is valid for three years with an annual surveillance audit. Since 31 October 2025 only certificates on the 2022 version are valid; the old 2013 certificates expired or were withdrawn at that point. How long it takes depends on what's already in place; a lead implementer tells you after the gap analysis what's realistic, which is more honest than a date we'd call out now.
What needs to happen now
- Scope and gap analysis. Which services, locations and systems are in scope, and what's missing between what you do now and what the standard asks. The lead implementer's work, in the first weeks.
- Risk analysis and Statement of Applicability. The heart of the system: which risks, which controls, and which deliberately not. Lead implementer, together with the people who know the processes.
- Policies and controls that fit you. Not a binder nobody reads, but agreements that work in practice and can be evidenced. Lead implementer with the line; a security officer for day-to-day execution.
- Internal audit and management review. The standard requires you to test yourself before the auditor arrives. An independent view, so preferably not the person who built it.
- The certification audit. Stage 1 (documentation) and stage 2 (operation), with a certification body you choose yourself. After that someone has to keep the system running, or it's gone again at the surveillance audit.
Who leads this
To obtain the certificate, organisations look for an ISO 27001 lead implementer: someone who sets up the system, takes the organisation along and stands next to you at the audit. For the management afterwards, a security officer or ISO who stays, and if the board needs to come along in the story, an interim CISO. Which of those roles it is for you depends on what's already there and who's already in place; that's where the intake starts, and the question often turns out to be different from the job title. If you need someone permanently, that's simply permanent recruitment; temporarily, it's interim. We've been doing both for years.
Interim: within two days, and what it costs
Fast doesn't mean sloppy. We start with a proper intake: which certificate, which date, what's already in place, who this person needs to bring along. Then we search a network of interim professionals we have usually known for years, which is how, for an interim assignment, you'll have your first candidate interviewed within two days. If you need someone permanently, it works differently and takes longer. The best permanent candidates are rarely actively looking: they're settled somewhere and only move for the right arguments, from someone who knows them and what drives them. That is exactly our work, and it produces the best match, but not within two days. Interim professionals are entrepreneurs: more commercial, more flexible in both directions, and therefore faster to propose from the network we actively maintain. If we don't have someone who truly fits, we'll say so, because a profile that wastes your time is worse than an honest no. You always see the professional's rate and our margin separately, and that margin is never more than €15 per hour on a full-time assignment. You can contract the freelancer directly or through your own broker, in which case we invoice only our margin, or entirely through Gruzzy with a single invoice. Who is available right now, and in which rate band, is listed anonymously with the available interim professionals.
Freelance, and the Dutch DBA Act
Obtaining a certificate is an assignment with a clear beginning and end: there's a result, the professional decides how the work gets done, and there's no employer-style line of authority. That is exactly what the Dutch tax authority wants to see now that enforcement on false self-employment has resumed since 2025, so freelance fits well here, with a model agreement. The management afterwards is a different story: a security officer who comes back every week and works in the line is really a job. Then we'll say so. Usually that's a permanent role through recruitment; if you really want someone temporarily on payroll, secondment is possible, although it isn't our core business. We're happy to advise on this before you sign.
Call today?.
Call us, or book a slot yourself. Within fifteen minutes you'll know whether we can help and who the right person is.
Call: 020 399 1●●●
Available for interim now.
A selection of the interim professionals who can start right now. Anonymous until you get in touch; rate and availability are listed.
NIS2 / Cyberbeveiligingswet · DORA · SOX (ITGC)
- interim · €95k–100k gross per year
ISO 27001 · ISO 27002 · NIS2 / Cyberbeveiligingswet
- Interim / Freelance · €120–130 per hour
ISO 27001 · NIS2 / Cyberbeveiligingswet · AVG/GDPR
- Arnhem-Nijmegen
- interim / freelance · €120–130 per hour
Frequently asked questions.
How long does it take to obtain ISO 27001?
That depends on what's already in place: an organisation with policies, backups and access management in order is done sooner than one starting from zero. A lead implementer can tell you after the gap analysis in the first weeks what's realistic, which is more honest than a date we'd name now. What is certain: the certification body schedules the audit in two stages, so you need to book that in time.
How fast can you provide someone?
For interim: within two days you'll have your first candidate interviewed; for a permanent role it takes longer, because the best candidates are rarely actively looking and have to be moved with the right arguments; we discuss what's realistic at the intake. We start with an intake about the certificate, the customer's date and what's already in place, then search a network of interim professionals we have usually known for years. If we don't have anyone who truly fits, we'll say so.
Freelance, secondment or permanent: what suits a certification programme?
Obtaining the certificate is an assignment with a clear beginning and end, and then a freelancer with a model agreement fits well. Managing the management system afterwards is usually a job: a security officer who stays. Then we'll say so and recruit that person permanently. If you really want someone temporarily on payroll, secondment is possible, although it isn't our core business.
What does an interim ISO 27001 lead implementer cost?
That depends on the person and the assignment, and you always see the professional's rate separately from our margin. That margin is never more than €15 per hour on a full-time assignment. The rate bands of who is currently available are listed anonymously with the interim professionals on this site.
Our customer also accepts SOC 2 or an ISAE 3402 report. Which is smarter?
Your customer decides that, not us. ISO 27001 is a certificate on a management system; SOC 2 is an audit report on controls over a period. Many Dutch customers ask for ISO 27001, international and American customers more often for SOC 2. The lead implementers in our network have usually worked with both, so tell us at the intake exactly what the customer requires.
We still have a certificate on the 2013 version. Is it still valid?
No. The transition period to ISO 27001:2022 ended on 31 October 2025; certificates on the 2013 version expired or were withdrawn at that point. Anyone who didn't transition in time is treated by the certification body as a new client and goes through a full initial audit. That too is a programme someone has to lead.
What happens after the certificate?
Then the management system has to keep running: updating the risk analysis, evidencing controls, performing internal audits and passing an annual surveillance audit. That's ongoing work for a security officer or ISO, sometimes part-time. Many organisations get the certificate with an interim professional and then recruit someone permanently; we can do that in one move.
Does ISO 27001 also help with NIS2 and the Dutch Cybersecurity Act?
Yes, to a large extent. The duty of care under the Cybersecurity Act requires a substantiated risk analysis and demonstrable measures, and that is exactly what an ISMS delivers. A certificate is not a free pass, but whoever has ISO 27001 has the foundation in place. If your organisation falls under the Act, also see our page on NIS2 and the Dutch Cybersecurity Act.
Can this be done part-time, say two days a week?
Yes, some of the interim professionals in our network work on exactly that basis for several organisations at once. On a part-time assignment our margin per hour may be higher than on a full-time one; you see that up front, just like the rate.
Customer deadline in sight?
Tell us which certificate is required and by when. If you need an interim professional, your first candidate is interviewed within two days — and if we don't have anyone who fits, we'll say so.