Certification Service Terms

Effective date: 5 October 2026

These terms apply when a customer purchases an ISO certification preparation and coordination package from Caldermark P.S.A. They supplement the accepted proposal, order confirmation or invoice for the relevant engagement.

1. Caldermark's role

Caldermark provides a structured certification preparation and coordination service. Depending on the purchased package, this may include scope review, management-system documentation, risk and control documentation, internal preparation, audit coordination and administration of the certification process.

Caldermark is not the independent certification body unless this is expressly stated in the order documents. The formal audit findings and certification decision are made by the independent certification body responsible for the certification route.

2. Standard ISO/IEC 27001 package

The standard price of the initial ISO/IEC 27001:2022 package is EUR 5,900 excluding VAT, unless a different package price has been agreed in writing in a proposal, campaign or order confirmation.

The standard package is based on one legal entity, a maximum of one site and a maximum of 50 employees or other persons within the certification scope. Larger organisations, several legal entities or several sites receive a separate quotation.

Caldermark accepts an engagement at the fixed package price only after the initial intake and feasibility review have been completed. If Caldermark determines before acceptance that substantial technical or organisational remediation is needed to create a realistic chance of certification, this is first discussed with the customer and is not automatically included in the standard package.

The standard package includes:

• certification-scope review and wording;
• preparation or completion of the core ISO/IEC 27001:2022 ISMS documentation set;
• risk assessment and risk-treatment documentation;
• Statement of Applicability;
• required policies, procedures and registers within the agreed package scope;
• internal-audit and management-review preparation/documentation;
• remote certification-audit coordination;
• coordination of Stage 1 and Stage 2 audit documentation;
• administration of the initial certification process and digital certification file where issued.

The exact deliverables in the accepted order take precedence over this general description.

3. Items not included unless expressly agreed

Unless specifically included in writing, the package does not include:

• major infrastructure remediation or engineering work;
• implementation of new security products or enterprise systems;
• extensive penetration testing, source-code review or forensic investigation;
• travel or on-site audit costs;
• legal opinions or regulatory representation;
• annual surveillance audits, recertification audits or future certification-cycle fees;
• work caused by a material expansion of the agreed scope, additional sites or substantial organisational changes after the project has started.

Small documentation, policy, register or configuration corrections that are reasonably part of normal certification preparation may be handled within the package where practicable.

Optional maintenance package. Caldermark offers an optional maintenance package at EUR 1,490 excluding VAT per year, starting in year 2. It covers the preparation and coordination of the annual surveillance audit including the regular surveillance-audit fee, the internal audit, the management review and the updating of the management-system documentation. Recertification audits, additional audit days, on-site or travel costs and costs resulting from scope changes are not included unless expressly agreed in writing. The package is invoiced annually before the surveillance audit and can be cancelled for the following year at any time before the next annual invoice. Customers are not obliged to purchase it from Caldermark.

4. Customer responsibilities

The customer must provide complete and materially accurate information, make relevant personnel available, review documents within reasonable time, implement agreed actions that require customer control, and cooperate with the independent auditor or certification body.

The customer remains responsible for operating its management system in practice. Documents should reflect the organisation's actual operation and must not be treated as a substitute for controls that are required to exist in reality.

5. Independent certification decision

Caldermark can prepare and coordinate the process but cannot override the independent certification body's audit findings or certification decision. Certification therefore cannot be guaranteed where the customer does not meet the applicable requirements, fails to cooperate, materially misrepresents its implementation, or does not close required nonconformities.

Where an audit identifies reasonable documentation corrections or minor actions within the original scope, Caldermark will support closure as described in the purchased package. Material remediation or work outside scope may require a separate quotation.

A major nonconformity identified by the certification body, necessary technical remediation or additional audit activity may lead to additional work, costs and delay and is not automatically covered by the fixed package price.

6. Certification body and route

The independent certification body, accreditation route and verification mechanism applicable to the engagement are communicated in the proposal, order confirmation or project communication. Caldermark may change a proposed external certification body or audit partner before formal engagement where this is operationally or commercially necessary, provided the replacement route remains suitable for the agreed certification objective and any accreditation or verification requirements agreed in advance are respected.

7. Remote process

The standard package is designed for remote preparation and, where accepted by the certification body for the relevant scope, remote audit coordination. If an on-site visit becomes necessary because of the customer's scope, certification rules or auditor requirements, additional travel or on-site costs may apply if they were not included in the order.

8. Fees and payment

Fees, tax treatment and payment dates are stated in the accepted proposal, order confirmation or invoice. Work may be paused if an undisputed invoice is overdue.

Unless the accepted proposal states otherwise, 50% of the package price is invoiced on acceptance of the engagement, after Caldermark has reviewed the intake and accepted the engagement as feasible. The remaining 50% is invoiced after a positive certification decision and before Caldermark hands over the final certification file or certificate, where this is provided through Caldermark. If the certification body delivers the certificate directly to the customer, the second invoice is due as soon as certification has been granted.

If certification is not obtained as a result of incorrect or incomplete information from the customer, failure to implement agreed measures, failure to close identified nonconformities, insufficient cooperation, a material change of scope or other circumstances within the customer's control, the remaining amount remains payable.

9. Changes of scope

A change is outside the original scope where it materially increases the number of legal entities, sites, employees in scope, systems, products, standards, audit days or documentation workload. Caldermark will identify a material scope change before charging additional fees.

10. Confidentiality and information security

Caldermark will treat non-public certification information as confidential and will use it only for the engagement, internal administration, legal compliance and security purposes. Information may be shared with the independent certification body, auditor and necessary service providers for the certification process.

Personal data is processed in accordance with the Caldermark Privacy Policy and any applicable data-processing agreement.

11. Customer materials

The customer remains responsible for rights in information and documents supplied to Caldermark. The customer authorises Caldermark to use and adapt those materials as necessary to perform the engagement.

12. Caldermark materials

Caldermark retains ownership of its pre-existing templates, methodologies, software, know-how and reusable document structures. Once paid for, the customer may use the customer-specific final management-system documentation internally for its own certification and operations, unless the order states broader rights.

No right to resell Caldermark templates, source materials or software is granted unless expressly agreed.

13. Termination and rescheduling

Either party may terminate for material breach if the breach is not remedied within a reasonable period after written notice. Customer-requested cancellation or audit rescheduling may lead to charges already incurred with external auditors or certification providers and for work already performed.

14. Liability

Liability is subject to the commercial agreement governing the engagement and mandatory law. Caldermark is not responsible for an independent certification body's exercise of professional judgment, for customer non-compliance that was not disclosed or could not reasonably be identified, or for delays caused by missing customer information or external audit availability.

15. Order of precedence

If there is a conflict, the following order applies: signed agreement or accepted proposal; order confirmation; these Certification Service Terms; general Website and Electronic Services Terms.

16. Contact

Certification-related contractual questions may be sent to info@caldermark.com.

17. Governing law and jurisdiction

These terms and the engagement are governed by Polish law, unless mandatory law provides otherwise. Disputes fall under the jurisdiction of the court competent for the registered office of Caldermark P.S.A., unless the parties agree otherwise in writing.