ISO 27001 | Information security you can demonstrate | Newblend
Newblend Book an introduction
Certification

ISO 27001

ISO 27001 is the standard for information security. Not a stack of documents but a management system: you know which risks you have, which measures you take and you keep it current. We follow that route ourselves too.

In short
  • Newblend is certified against ISO/IEC 27001:2023.
  • A certificate from your IT supplier saves you work in your own supply chain accountability.
  • ISO 27001 covers much of the NIS2 duty of care, but not the reporting duty and board accountability.
  • Above all the standard asks you to keep it current: risk assessment, internal audit and management review on a fixed cycle.
  • We set up the technology and the records; the certification audit is done by an independent body.
Last updated: 5 August 2026
What is included

What a management system involves

Scope and risk assessment

What it covers: which systems, locations and processes. Then per risk the likelihood, the impact and the measure you choose.

Policy and procedures

Access management, change management, incident management, supplier management. Short and readable, because policy nobody reads is not followed.

Technical measures

Multi-factor authentication, endpoint protection, logging, backup and patch management. In practice the part that removes the most risk.

Awareness

Staff know what is expected of them and report incidents instead of hiding them.

To awareness

Internal audit

Checking yourself whether it works as intended, with findings that lead to improvements.

Management review

The board periodically reviews whether the system still fits the organisation and its risks, and records decisions.

From our own experience

What an audit asks in practice

Auditors care less about the thickness of your documentation than about whether it matches reality. If it says you patch monthly, they want to see that in the system. If it says new staff receive training, they will ask for an example.

What almost always comes up: access management, offboarding and supplier management. Exactly the parts that erode when nobody maintains them.

So we set it up so the records come out of daily work: tickets, monitoring and management reports. Then you do not have to reconstruct a file for an audit.

How it relates to NIS2

Much of the NIS2 duty of care overlaps with ISO 27001. The additional points are in the reporting duty, supply chain responsibility and board accountability. Read more about NIS2 and the Cybersecurity Act.

Frequently asked questions

Do we have to be ISO 27001 certified?

Usually not mandatory, but customers and tenders ask for it more and more. Even without certification the standard is useful as a framework to get your measures in order.

How long does a project take?

For a mid-sized organisation usually six to twelve months up to the certification audit, depending on how much is already in place and how much time the organisation can free up.

Do you certify us?

No. Certification is carried out by an independent certification body. We implement, document and guide you to the audit.

Does Newblend work with NEN 7510 too?

NEN 7510 builds on ISO 27001 with additional requirements for healthcare. If you work in healthcare, say so up front and we include those requirements in the design.

Read on

Want to talk it over?

Book a half-hour introduction. We are happy to think along, even if you are not sure yet what you are looking for.