Your EU customer asks for ISO/IEC 27001. Prepare the documentation in your language and see what is still missing before the audit.
Normalius is a compliance system in your language for IT companies in the region that have to prove security to an EU customer. It generates drafts of the mandatory documents under ISO/IEC 27001:2022 and guides you through the records only you can create.
Review before audit, not certification. Certification is done only by an accredited certification body that you choose.
Start your preparationSee how it works
The questionnaire is free and carries no obligation.
Free Normalius Provjera check (15 questions and 3 optional ones about your company)
The problem
An EU customer sent you a security questionnaire or wrote ISO/IEC 27001 into the contract. Now you need:
the documents the standard requires (scope, policy, risk assessment and treatment, Statement of Applicability with 93 controls)
records showing the system actually runs: internal audit, management review, monitoring results
and a realistic view of how long it takes and what it costs, including the certification body.
Generic English templates do not know your company. Normalius builds the documents from your answers: your tools, roles and deadlines.
The solution
Company questionnaire. You answer questions about people, roles, tools and processes.
Document drafts for your company. Deterministic templates turn your answers into documents in the language you choose: Bosnian, Croatian, Serbian (Latin or Cyrillic script) or English. Bosnian and Serbian (Latin and Cyrillic script) are available now; for Croatian and English we state the delivery date in the pro-forma invoice before payment. Every draft carries the mark "DRAFT, not validated by the auditor" until it receives the status VALIDATED after a Lead Auditor review.
Records plan. You get the list of records you must keep yourself (trainings, access reviews, internal audit, management review) with dates.
Review by a named Lead Auditor. A Lead Auditor ISO/IEC 27001 reviews the package before it is handed over and issues a report with findings per clause; a document gets the status VALIDATED only after that review. The report contains findings only, no solutions, and it is not certification.
ISO/IEC 27001 pilot (founding)
EUR 1,490 for year 1. Year 2 onward: EUR 1,490 per year.
What the package includes:
| Item | Description |
|---|---|
| Document package | 33–47 documents for companies of 10 to 25 people, most of them 1–3 pages; language of your choice: Bosnian, Croatian, Serbian (Latin or Cyrillic script) or English (for Croatian and English the date is in the pro-forma invoice) |
| DNS/TLS evidence | passive check of your domain's public DNS and TLS data, as evidence in the package |
| Documentation review report | Lead Auditor findings per clause and per document |
| Stage 1 readiness report | issued only after you pass the maturity gate (at least about 3 months of records of the system in operation, an internal audit and a management review). Until then you receive the report "Review before the audit: findings". |
Internal audit (clause 9.2). Before Stage 2 you must have an internal audit done. We can offer it as a separate line on the pro-forma invoice; it is performed by an auditor who did not review your package.
Fallback delivery (part of the offer and terms, before the pro-forma invoice)
If we notify you in writing that we are stopping development of the Normalius platform, or if the platform is not available by 1 Mar 2027, the pilot still receives:
- the complete template package (DOCX);
- the documentation review report;
- the readiness report, after you pass the maturity gate (until then: "Review before the audit: findings");
- 12 months of template updates by e-mail.
No refunds are given. Our liability is limited to the amount you paid in 12 months, except for damage caused intentionally or by gross negligence (details in the Terms).
The full path to certification (honest, with all costs)
Normalius, pilot
EUR 1,490 (year 1)
Certification body, Stage 1 + Stage 2
ESTIMATE EUR 3,000–8,000 for companies of 10 to 50 people
Your internal work
ESTIMATE 80–200 h
Time
ESTIMATE 4–6 months
Choice of certification body
your choice
Realistic sequence (ESTIMATE): documentation drafts in about 2 weeks from the completed questionnaire; then at least about 3 months of records of the system in operation, an internal audit (clause 9.2) and a management review (clause 9.3) before the readiness report and Stage 2; certification realistically in 4–6 months. The audit outcome depends on the certification body and on your work.
Who this is for
- IT companies that export services and do not have ISO/IEC 27001 yet
- with 10 to 50 people and one or more customers in the EU
- when someone in the company can keep records a few hours a week
Not a fit if you need certification within a few weeks: the certification body asks for records of the system in operation before Stage 2.
Subprocessors and your data
This page does not collect any data. We currently take orders by e-mail: info@normalius.com
Hostinger
hosting of normalius.com; temporary storage of encrypted quote requests. Hostinger has no key to decrypt.
Processing location: Hostinger data centre (under the hosting agreement)
Evolushost
virtual server on which requests are decrypted and documentation is generated.
Processing location: Austria (EU)
Microsoft 365 (e-mail)
receiving and sending e-mail with you (request, pro-forma invoice) and internal transfer of the encrypted package to the provider.
Other tools
Payment is by bank transfer; card payment via Stripe (Stripe, LLC, USA) is planned once available. The list is updated before the first processing and you are notified.
Language models (AI APIs) are not used on your data. If that changes, the list is updated before the first processing and you are notified.
FAQ
Is this certification?
No. Certification is done only by an accredited certification body, through the Stage 1 and Stage 2 audit. We prepare the documentation and the review before the audit. Review before audit, not certification.
Can you promise the audit outcome?
No. The audit outcome depends on the certification body and on how your system works in practice.
How many documents do we get?
For companies of 10 to 25 people, 33–47 documents, most of them 1–3 pages. The exact number depends on your size and on which controls apply.
Who does the review?
A named Lead Auditor ISO/IEC 27001 reviews the package before it is handed over and issues a report with findings; a document gets the status VALIDATED only after that review. The auditor who reviewed your package does not take part in your company's certification audit for 24 months.
How do we pay?
We state the payment method in the pro-forma invoice (bank transfer; card via Stripe once available). The amount in the pro-forma invoice is the amount you pay the Provider; the Provider adds no VAT to it. Your company bears any tax obligations under the laws of its country (Terms, cl. 3.4).
In which languages do we get the documents?
You choose the document language in the questionnaire: Bosnian, Croatian, Serbian (Latin or Cyrillic script) or English. Bosnian and Serbian (Latin and Cyrillic script) are available now; for Croatian and English we state the delivery date in the pro-forma invoice before payment. The document language can differ from the language of the site.
The questionnaire is free and carries no obligation.