ISO 27001 certification in Nigeria: process, timeline and cost factors

ISO/IEC 27001 is the international standard for an information security management system (ISMS): a structured way to find your security risks, manage them, and keep improving. Certification means an independent, accredited body has checked your ISMS against the standard.

New certifications use the 2022 version of the standard.

Why Nigerian businesses get certified

• Winning contracts. Banks, government agencies and multinationals increasingly ask suppliers for ISO 27001.
• Regulation. It gives you a solid, documented base for duties under the Nigeria Data Protection Act 2023 and sector rules such as the CBN’s cybersecurity framework.
• Fewer incidents. The process forces you to find and fix real risks.

The certification process, step by step

1. Decide the scope

Which parts of the business are covered: one product, one office, or the whole company? A clear, sensible scope keeps the project manageable.

2. Gap assessment

Compare what you do today with what the standard requires. This shows how much work is ahead.

3. Risk assessment and treatment

List your important information and systems, the threats to them, and how you’ll treat each risk. Then write a Statement of Applicability saying which controls from the standard (Annex A) you use, and why.

4. Build the ISMS

Write the required policies and procedures, put the controls in place, train staff, and run the system for a while so there’s evidence it works.

5. Internal audit and management review

Check your own ISMS before the certification body does, and have management review the results.

6. Stage 1 audit

The certification body reviews your documents and design: is the ISMS set up correctly, and are you ready for Stage 2?

7. Stage 2 audit

The auditors check that the controls actually work in practice, through interviews, observation and evidence. Pass this and you’re certified.

8. Keep it running

The certificate usually lasts three years, with surveillance audits in the years between and a full recertification audit at the end.

How long does it take?

It depends on your size, scope and starting point. A small, well-organised business with a narrow scope moves much faster than a large organisation starting from scratch. Leave time between finishing your ISMS and the Stage 2 audit to build up evidence that it runs properly.

What drives the cost

We don’t quote a single figure, because the honest answer depends on:

• Scope and size: more people, sites and systems mean more work and longer audits.
• Your starting point: existing policies and controls cut the work a lot.
• Certification body fees: audit days are based on the size of your organisation.
• Help you buy in: consulting, tools and training.
• Fixing gaps: for example new security tools, testing or monitoring.

Choosing a certification body

Use one that is accredited for ISO 27001 by a recognised accreditation body, so your certificate is trusted by clients at home and abroad. Ask to see the accreditation, and check which version of the standard they audit against.

How we help

We run gap assessments, risk assessments and penetration tests, put security controls in place, provide the monitoring evidence auditors look for, and prepare the evidence packs for your audits.