Pillar 3: Certify
ISO and NEN 7510, without the paper tiger
ISO 9001, ISO 27001, ISO 14001 and NEN 7510: a management system that makes your business better and gives clients confidence. With a lead auditor in-house, you know in advance what the auditor will ask. And ready for the Dutch Cybersecurity Act in the Netherlands and CyFun in Belgium.
Four standards, one approach
ISO 9001
Quality management: fixed processes, satisfied clients and continuous improvement.
ISO 27001
Information security: control over risks, access and suppliers. Often the first choice for MSPs.
ISO 14001
Environmental management: map your impact and demonstrably become more sustainable, increasingly required in tenders.
NEN 7510
Information security in healthcare. Essential if you have healthcare organisations as clients.
Why MSPs are certifying now
Clients ask for it
A certificate answers the question of whether your information is secure and your quality assured, before it is even asked.
Tenders
Without ISO 27001 you cannot take part with many government bodies and larger organisations.
Dutch Cybersecurity Act
Since 15 August 2026: duty of care, duty to report, and the board has final responsibility.
CyFun in Belgium
Essential entities must show where they stand by 18 April 2027. ISO 27001 counts as a route.
Always a baseline assessment first
Every project starts with a baseline assessment. That way you know exactly where you stand before you start anything.
- 2 hours together with you: we go through the requirements of the standard based on your organisation
- 2 hours of write-up: we work the findings into a report
What you get
- A report on where you stand: what you already have in place and what not yet
- An action plan with the steps to certification
- A tailored quote for the project
From baseline assessment to certificate, and beyond
We take your business as the starting point, not the standard. And we record it where your team already works: in your PSA.
1. Baseline assessment
Where do you stand against the standard? With a report, action plan and tailored quote.
2. Setup in Yice
Risks, policies and measures in one place.
3. Implement
Processes and PSA adjusted, team trained.
4. Internal audit
Plus management review, so you are ready.
5. Certification
We are there during the audit.
6. Three years of maintenance
So the certificate keeps working.
The Netherlands and Belgium side by side
The Netherlands: Cybersecurity Act
- In force since 15 August 2026
- Registration with the NCSC
- Duty of care and duty to report incidents
- Directors must have knowledge and take training
Belgium: NIS2 and CyberFundamentals
- Conformity or progress report by 18 April 2027 at the latest
- Levels Basic, Important and Essential
- ISO 27001 counts as a route
- Your clients will ask you about this too
Whether you fall under the law yourself depends on your services and size. The check gives a first picture; then we assess it together.
Gert Koeslag
Business coach, ISO
Gert has worked with quality, environmental and security standards since the nineties. His goal: a system that supports rather than hinders.
After the baseline assessment you receive a tailored quote. The costs of the certification body come on top of that.
Frequently asked questions
How long does a project take?
With guidance usually 6 to 12 months. That depends on your size and how much time your team frees up.
What does the audit itself cost?
The certification body charges separately. We help you request and compare quotes.
What is Yice?
Software in which you maintain your management system: risks, measures, audits and improvement actions. Included in the maintenance contract.
Which standard do I need?
ISO 9001 is about quality, ISO 27001 about information security, ISO 14001 about the environment and NEN 7510 about information security in healthcare. For MSPs, 27001 is often the first choice; if you have healthcare clients, NEN 7510 is added. Several standards in one management system is also possible. In the baseline assessment we decide together what suits you.
What does the baseline assessment involve?
Two hours together with you, in which we go through the standard, and two hours of write-up by us. You receive a report on what you already have in place and what not yet, an action plan and a tailored quote.