Find a Cert Body

Ask 3 certification bodies for quotes you can compare

Answer 4 questions. Get the email to send, the audit days to expect and your decision dates.

See your result: 8-10 audit days
Standards

Pick all that apply.

Information security.
Privacy extension.
AI management system.
People in scope

Employees and long-term contractors.

Where they work
  • Germany
Certificate needed by

Pick 1.

2 Feb
3 May
1 Aug

Your request on 2026-11-04

ISO/IEC 27001, 40 people, Germany

Audit days for stage 1 and 2

8-10 days

About 20.5-22.5 days over 3 years. Below 5.5, ask the body why.

Your dates

  1. Send 4 Nov
  2. Replies due 13 Nov
  3. Decide 18 Nov
  4. Certificate No deadline

Get your RFQ pack as a PDF

  • This request, a price grid per audit and the attachment checklist.
  • A scoring sheet for up to 4 replies.
  • A calendar file: replies 13 Nov, decision 18 Nov.

The email to send

16 questions, 6 attachments

Subject Request for quotation: ISO/IEC 27001:2022 certification, 40 people

Hello,

We ask for a quotation for initial certification to ISO/IEC 27001:2022.
Please send your quotation by 13 November 2026. It should cover the full 3-year certification cycle.

ABOUT US
- Certification: Initial certification: ISO/IEC 27001:2022
- People in scope: 40. 15 of them develop or maintain software.
- Locations: 1 office in scope. People work in Germany.
- Audit format: We ask for remote audits wherever your rules allow them.
- Language: Audit, report and certificate in English.

PRICE: PLEASE FILL IN EVERY LINE
- Stage 1 audit: ___ audit days, ___ of them on site, price ___
- Stage 2 audit: ___ audit days, ___ of them on site, price ___
- Surveillance audit, year 2: ___ audit days, ___ of them on site, price ___
- Surveillance audit, year 3: ___ audit days, ___ of them on site, price ___
- Recertification audit: ___ audit days, ___ of them on site, price ___
Please also list every other fee: application, certificate, annual registration, report and travel. Write "none" when a fee does not apply.

QUESTIONS
A. Accreditation
A1. Which accreditation body accredits you for ISO/IEC 27001 certification? What is your accreditation number?
A2. Please send the direct link to your entry in the registry of that accreditation body.
A3. Does your accreditation scope name ISO/IEC 27001:2022?
A4. Will our certificate show your accreditation mark and your accreditation number?
A5. Can you send a sample certificate?
B. Independence
B1. Do you, or a company under your control, sell ISO/IEC 27001 consultancy or implementation work? If you offer a pre-audit, on what terms?
B2. Do you pay a commission to a consultant, a platform or a partner for this referral?
B3. Will your auditors plan and do their own tests? Can you confirm this in writing?
C. Price and audit days
C1. Please fill in the price grid: audit days, days on site and price for each of the 5 audits in the cycle.
C2. Which fees are not in these prices: application, certificate, annual registration, report or travel?
C3. For how long are these prices fixed? Do the surveillance audit prices change each year?
D. Audit team
D1. Who will lead our audit? What experience does the audit team have with companies of our size and our sector?
D2. Give 2 examples of what the auditor will test in our cloud environment.
E. Remote audit
E1. Can you do the stage 1 and stage 2 audits fully remote? Which parts need a visit?
E2. Which video and file-sharing tools do you use in a remote audit? How do you protect our data?
E3. Does a remote audit change the number of audit days?

ATTACHED
- Number of people in scope per location: full-time, part-time and shift workers. Add an organisation chart.
- A draft scope statement: the services, teams and locations the certificate must cover.
- A list of locations in scope with the main activities at each one. Write "remote only" if there is no office.
- The Statement of Applicability, if it exists. Write "in progress" if not.
- A list of outsourced processes and key suppliers, for example cloud hosting, payroll and customer support.
- A short IT profile: number of developers, business applications, cloud platforms and laptops.

We will decide by 18 November 2026. Thank you.

Kind regards,

[Your name and company]
Open in mail app

Attach to the email

  • Number of people in scope per location: full-time, part-time and shift workers. Add an organisation chart.

    Headcount is the main input for audit time. The NSAI quotation form asks for it per site.

  • A draft scope statement: the services, teams and locations the certificate must cover.

    The scope text appears on the certificate. The body prices the audit from it.

  • A list of locations in scope with the main activities at each one. Write "remote only" if there is no office.

    Each extra site can add audit time and travel.

  • The Statement of Applicability, if it exists. Write "in progress" if not.

    Certification bodies ask for it with the quotation form when it exists.

  • A list of outsourced processes and key suppliers, for example cloud hosting, payroll and customer support.

    Outsourced processes are part of the audit. The body asks for them to plan the time.

  • A short IT profile: number of developers, business applications, cloud platforms and laptops.

    Bodies use the size and complexity of the IT to set the audit time for ISO/IEC 27001.

How it works 45 s

One request every body prices the same way, the replies compared over 3 years, and the registry check of the certificate.

Which reply to pick

Drop any body that fails a test. Then take the lowest 3-year total.

  1. Accreditation counts. The accreditation body is recognised for ISO/IEC 27001. Check it.
  2. Independence. The body sells you no consultancy and pays no referral fee. Warning signs.
  3. Enough days, every audit priced. Compare the replies.
  4. Auditor and dates fit. The auditor knows SaaS, speaks your language and can start before your deadline. Questions to ask.