ISO 27001 for MSPs: is it worth it in 2026?

TL;DR

For an Italian MSP in 2026, ISO 27001:2022 costs €15-35k year one + €8-12k maintenance. Worth it if you sell to regulated customers or have more than 15 BCDR customers. Sectors where you cannot work without ISO: public administration, healthcare, finance.

Real costs

Year one

• consultant: €8-15k;
• certification body (TÜV, DNV, Bureau Veritas): €5-12k;
• internal hours (CISO, Quality, IT): 200-400 hours valued;
• tooling (potentially new): €2-5k.

Realistic total: €20-35k.

Annual maintenance

• surveillance audit: €3-5k;
• part-time consultant: €4-7k;
• internal hours: 80-150 hours;
• training: €1-2k.

Total: €8-12k/year.

Expected ROI

Three return sources:

1. New market access: public-sector tenders, regulated customers. 15-30% revenue uplift in 18 months.
2. Lower insurance premiums: -20-30% on cyber policies.
3. Easier sales: shorter sales cycles, fewer vendor questionnaires.

Typical break-even: 12-18 months.

Sectors where ISO is de-facto mandatory

• public administration (AgID tenders);
• healthcare (public sector customers);
• finance (banks, insurers);
• NIS2 critical services (essential).

Without ISO you are excluded a priori.

Sectors where ISO is "nice to have"

• generic manufacturing SMBs;
• professional firms;
• non-regulated e-commerce;
• companies with all-SMB customers.

Still worth it for positioning.

The 5 mistakes that fail the first certification

1. scope too wide: certify only BCDR/managed services first.
2. generic copy-paste policies: the auditor spots them in 5 minutes.
3. DR drills never done: A.5.30 fails.
4. no formal risk assessment.
5. undocumented risk treatment.

Sefthy as ISO accelerator

For MSPs certifying with their own Sefthy service, Sefthy provides:

• backup, DR, drill evidence;
• documented restore plans;
• own certification attestations (reduce supply chain effort for the MSP).

Cuts continuity cluster work by 50-70%.

FAQ

Should ISO 27001 be certified even for SMB customers?

Not mandatory. But it is the fastest way to justify 20% higher prices.

Can I certify only "Sefthy + managed DR"?

Yes, limited scope is valid. Extend in subsequent cycles.

For certifications and tenders, Certifications and public tenders. For DR audits, ISO 27001 audits and DR.