ISO 27001 Certification

What Changed in ISO 27001:2022

The main clauses — 4 through 10, covering context, leadership, planning, support, operation, evaluation, and improvement — only got modest updates. Clause 6.3 is genuinely new, requiring that changes to the ISMS happen in a planned way rather than ad hoc. Clause 4.2 now explicitly asks which interested-party requirements will be addressed through the ISMS.

Annex A is where the real restructure happened. The old 114 controls across 14 domains became 93 controls across four themes:

Eleven controls are entirely new, and they're the part most organisations actually have to build from scratch — threat intelligence, information security for cloud services, ICT readiness for business continuity, physical security monitoring, configuration management, information deletion, data masking, data leakage prevention, monitoring activities, web filtering, and secure coding.

Each control now also carries attributes — control type (preventive, detective, corrective), security properties (confidentiality, integrity, availability), and cybersecurity concepts (identify, protect, detect, respond, recover) — which makes mapping against frameworks like SOC 2 or NIST CSF far less painful than it used to be.

Who Actually Needs This

• IT services and software companies bidding for enterprise or overseas contracts, where the security questionnaire arrives before the proposal does.
• SaaS and cloud platforms handling customer data, where buyers want independent assurance rather than a self-signed policy document.
• BPO and KPO operations processing client data on behalf of banks, insurers, or healthcare firms.
• Fintech and payment companies, where ISO 27001 sits alongside RBI and PCI-DSS obligations rather than replacing them.
• Healthcare and pharma organisations handling patient or trial data subject to cross-border privacy rules.
• Any organisation serving EU clients, since GDPR compliance conversations almost always circle back to demonstrable security governance.

Documents You'll Need to Produce

ISO 27001:2022 requires specific documented information. These are the ones auditors will ask for:

• ISMS scope statement — what's in, what's out, and why
• Information security policy, approved at leadership level
• Risk assessment methodology and the risk assessment results
• Risk treatment plan
• Statement of Applicability (SoA) — the central document, listing all 93 Annex A controls with justification for each inclusion or exclusion
• Information security objectives and how they're measured
• Evidence of competence, training, and awareness activities
• Operational planning and control records
• Internal audit programme and audit results
• Management review minutes
• Records of nonconformities and corrective actions
• Incident management and business continuity procedures

The Statement of Applicability is where most first-time applicants lose time. It isn't a tick-box exercise — every exclusion needs a defensible reason tied back to your risk assessment, and auditors probe this harder than almost anything else.

The Certification Process, Step by Step

1. Gap analysis. We assess your current security posture against all 93 controls and the clause requirements, and produce a concrete list of what's missing.
2. Define the ISMS scope. Decide which parts of the business, which locations, and which systems fall inside the ISMS.
3. Risk assessment and treatment. Identify information security risks, evaluate them, and decide how each is treated. Residual risks need explicit risk owner approval under the 2022 version.
4. Build the documentation and controls. Write the policies, procedures, and the Statement of Applicability, then implement the controls.
5. Training and awareness. Auditors interview employees; if nobody's heard of the policy, that's a finding.
6. Internal audit. Mandatory before the certification body arrives, and your best chance to catch problems early.
7. Management review. Leadership formally reviews ISMS performance; minutes are a required record.
8. Stage 1 audit. A desk-based readiness check by the certification body.
9. Stage 2 audit. On-site (or remote) audit of whether the ISMS is genuinely implemented and effective.
10. Certification and surveillance. Valid for three years, with annual surveillance audits and recertification at the end.

How Long It Takes

For a small to mid-sized organisation starting from a reasonable baseline, plan for 4 to 8 months from gap analysis to certificate. Companies with existing security maturity sometimes move faster; organisations starting from scratch, or with a wide multi-site scope, routinely take longer.

The part that's hardest to compress is the evidence trail. Auditors want to see the ISMS operating over a period, not switched on the week before Stage 2.

What It Costs

Certification body fees — priced on headcount, scope, and number of sites. For a small Indian company this often lands in the ₹1.5 lakh to ₹5 lakh range across the three-year cycle, including surveillance audits.

Implementation and consulting — gap analysis, documentation, risk assessment, internal audit, and preparation support, which varies with how much you build in-house.

If someone offers an ISO 27001 certificate in two weeks for a flat fee with no audit, that certificate is worthless. Confirm your certification body is accredited under NABCB in India or a member of the IAF.

Why Work With LegalDev

Most organisations don't fail ISO 27001 because their security is bad. They fail because the Statement of Applicability doesn't tie back to the risk assessment, the internal audit was done as a formality, or the eleven new 2022 controls were never properly implemented.

LegalDev's approach starts with an honest gap analysis, builds ISMS documentation around how your business genuinely operates, runs your internal audit properly, prepares your team for auditor interviews, and stays with you through Stage 1 and Stage 2 — and beyond, through the surveillance cycle.

Frequently Asked Questions