Win EU and enterprise clients
Nearshore buyers shortlist certified vendors first. Certification puts a Kosovar company on the same page as a Vienna or Munich supplier.
ISO 27001 for Kosovo's ICT sector
Trust that opens markets.
ISO 27001 certification turns your security practice into something EU clients, banks and public buyers can verify. For Kosovar software and IT companies it is the shortest route past the procurement gate.
A programme by SHPiK and OCG
Independent advice, no cost
Why ISO 27001
A certificate your clients can read without reading your code.
Buyers in Austria, Germany and the wider EU cannot audit every supplier. They ask for a standard they already trust. ISO 27001 is that standard.
Pass procurement security reviews
Security questionnaires with 200 questions shrink to one line: "ISO 27001 certified, certificate attached." Sales cycles get shorter.
Reduce incident risk and cost
A working ISMS means risks are known, owned and reviewed. When something does go wrong, you have a plan instead of a crisis.
Build a security culture
Policies people actually follow, onboarding that covers access and devices, and a team that treats client data as its own.
Trust in numbers
The world's most widely adopted information security standard.
0
controls in Annex A
ISO/IEC 27001:2022, down from 114 in the 2013 edition
0
control themes
Organisational, people, physical, technological
0+
valid certificates worldwide
ISO Survey of certifications, latest published edition
0yrs
certification cycle
Annual surveillance audits, recertification in year three
Recognised in every EU member stateIssued by accredited certification bodies under the same international rules, so an audit in Prishtina carries the same weight as one in Vienna.
Maps onto GDPR and NIS2Article 32 of the GDPR asks for "appropriate technical and organisational measures". A certified ISMS is the clearest way to show you have them.
Risk-based, not checklist-basedYou decide which controls apply through your own risk assessment. A 20-person software company is not audited like a bank.
The journey
From first conversation to certificate in six steps.
Most ICT companies of 15 to 150 people reach certification in six to twelve months. The path below is the one we walk with you.
1Week 1
Readiness check
A 30-minute call and a short self-assessment. You learn where you stand and what the effort will be.
2Weeks 2–4
Gap analysis
We compare your current practice against the 93 controls and define the scope of your ISMS.
3Months 2–3
Risk assessment and design
Identify assets and risks, choose controls, write the Statement of Applicability.
4Months 3–7
Implementation
Policies, access management, supplier controls, training. Evidence starts to accumulate.
5Month 8
Internal audit and review
An internal audit and a management review close the loop before anyone external looks.
6Months 9–12
Certification audit
Stage 1 checks documentation, Stage 2 checks that it works. Then the certificate is issued.
Certified. Now go sell it.
The certificate is valid for three years. We help you put it to work in proposals, on your website and in every security questionnaire that lands in your inbox.
Book a meetingReadiness check
How far are you already?
Five honest answers. Most companies are further along than they think, and the gaps are usually documentation rather than technology.
The full assessment covers 40 questions across the four control themes and produces a report you can bring to your board. We walk through it with you on the call.
Do you have a written information security policy approved by management?
Is there a register of your information assets and who owns each one?
Do you review user access at least every six months?
Have you done a documented risk assessment in the last year?
Do you have an incident response plan your team has practised?
—
Answer the five questions to see an indicative readiness score.
Book a meeting
Talk to an ISO 27001 expert.
A 30-minute video call with a certification advisor from the SHPiK and OCG programme. In English or Albanian.
- Where you stand today. We go through your readiness answers and what they mean for scope and effort.
- What certification would take. A realistic timeline and budget for a company of your size.
- What it would unlock. Which markets, tenders and client conversations open up once you are certified.
No cost, no obligation. Your details are used only to arrange the call.
Pick a day
Available times on
Times shown in Central European Time (Prishtina / Vienna). 30 minutes.
Your request is in.
An advisor will confirm the slot by email within one business day and send a calendar invitation with the video link.
Co-funded by:
