ISO/IEC 27001:2022 Implementation: A Step-by-Step Guide to Certification for Indian Companies
ISO/IEC 27001:2022 implementation is a programme of scoping, risk assessment, control selection and evidence that ends in a two-stage certification audit. Every step from first decision to certificate, the 93 Annex A controls, the documents auditors expect, the mistakes that cost time, and what Indian regulators and customers ask for.
Compliance
ISO/IEC 27001 is the certificate customers ask for, the one tender documents require, and the one most often misunderstood as a document-writing exercise. It is not. The standard certifies a management system: a repeatable way of deciding what to protect, how much, and whether it is working, with evidence. Organisations that treat it that way get certified in months and keep the certificate without drama; those that buy a template binder spend longer and find the auditor unimpressed. Here is the whole programme, from the first decision to the certificate and the surveillance audits that follow, with the specifics that apply in India.
In short. Decide the scope carefully, because everything else follows from it. Run a risk assessment with the people who own the systems, choose controls from the 93 in Annex A based on the risks, and record the choices in a Statement of Applicability. Write only the documents the standard requires and the ones your organisation will use. Operate the controls long enough to generate evidence, then audit yourself and hold a management review before the certification body arrives for stage 1 and stage 2. Expect three to twelve months depending on size and starting point, a certificate valid for three years, and an audit every year to keep it. Use an accredited certification body, which in India means one accredited by NABCB or another recognised accreditation body, and check any certificate you rely on in IAF CertSearch.
What the 2022 edition changed, and the transition that just ended
The current edition, ISO/IEC 27001:2022, was published in October 2022, with a short amendment in February 2024 adding that "the organization shall determine whether climate change is a relevant issue" and a note that interested parties may have climate-related requirements. The management system clauses, 4 to 10, were lightly revised: a new clause 6.3 on planning changes, a requirement to monitor objectives, and the order of clause 10 swapped so that 10.1 is continual improvement and 10.2 is nonconformity and corrective action.
The larger change was Annex A. The 114 controls of the 2013 edition became 93, arranged in four themes rather than fourteen domains: 37 organisational, 8 people, 14 physical and 34 technological. Eleven controls were new, 58 were updated and 24 were merged. The new eleven are the ones auditors look for in a transitioned system:
| Control | Name | What the auditor expects to see |
|---|---|---|
| 5.7 | Threat intelligence | Threat information collected, analysed and used, for example CERT-In advisories acted on |
| 5.23 | Information security for use of cloud services | A process for acquiring, using, managing and exiting cloud services |
| 5.30 | ICT readiness for business continuity | Recovery requirements and tested capability |
| 7.4 | Physical security monitoring | Premises monitored for unauthorised access |
| 8.9 | Configuration management | Secure configurations defined, applied and monitored |
| 8.10 | Information deletion | Data deleted when no longer required, including at vendors |
| 8.11 | Data masking | Masking or pseudonymisation where policy requires |
| 8.12 | Data leakage prevention | Measures against unauthorised disclosure, proportionate to classification |
| 8.16 | Monitoring activities | Networks, systems and applications monitored for anomalous behaviour |
| 8.23 | Web filtering | Access to external websites managed |
| 8.28 | Secure coding | Secure coding principles applied in development |
The transition deadline has passed. Under the international accreditation rule for the change, all certificates to the 2013 edition expired or were withdrawn by 31 October 2025, and India's accreditation body, NABCB, set the same date. If a vendor shows you a 2013 certificate today, it is not valid. One further change for anyone checking paperwork: the international accreditation bodies IAF and ILAC merged into Global Accreditation Cooperation, Global ACI, from 1 January 2026, so references to IAF are now historical.
Step 1: decide why, and what is in scope
The scope statement in clause 4.3 is the most consequential sentence in the whole programme. It defines which locations, systems, services and people the certificate covers, and therefore which risks you must assess and which controls you must operate. Too narrow and the certificate does not cover the service your customers care about; too wide and you are certifying the canteen. The right scope is usually the service or product your customers and regulators are asking about, with the infrastructure and people that deliver it.
Two scope lessons from Indian regulation. SEBI's CSCRF requires market infrastructure institutions to obtain ISO 27001 certification with a scope covering, among other things, the primary data centre, disaster recovery site, SOC and colocation facilities; a 2025 clarification made the certificate recommended rather than mandatory for other qualified regulated entities. And IRDAI's 2026 guidelines allow an insurer to rely on a vendor's ISO 27001 certificate in place of periodic audits only where the service "is included under the scope / statement of applicability". Scope is what makes a certificate mean something to the people reading it.
Step 2: context, leadership and the policy
Clauses 4 and 5 ask you to understand the organisation's context and interested parties, which in practice means listing the laws, regulators, customers and contracts that impose security requirements, and to show leadership commitment through an information security policy, defined roles and resources. The policy should be a page, approved by top management, saying what the organisation commits to. The auditor will ask senior managers about it, so they need to have read it.
Step 3: the risk assessment
Clause 6.1.2 requires a defined, repeatable risk assessment process that identifies risks to the confidentiality, integrity and availability of information in scope, assigns owners, and analyses and evaluates them against criteria you set. ISO/IEC 27005:2022 is the companion guidance. This is the step most often done badly: a certification body's analysis of its own audits found that 78% of certified organisations had at least one finding, and that 27% did not meet the risk assessment requirement.
What works is a workshop with the people who run the systems, a register with a manageable number of real risks rather than hundreds of generic ones, and a scoring method simple enough to repeat next year. Our enterprise risk assessment service exists to run exactly this, and our guide to business impact analysis covers the availability side.
Step 4: treatment and the Statement of Applicability
For each risk you decide whether to modify, retain, avoid or share it, choose controls, and compare your choices with Annex A to make sure nothing necessary has been missed. The result is the Statement of Applicability required by clause 6.1.3 d): a list of all 93 Annex A controls, each marked applicable or not, with a justification and whether it is implemented. The SoA is the document auditors read first and refer to throughout, and it is also the document customers and regulators ask for alongside the certificate. The 2022 edition's control attributes, which classify each control by type, security property, cybersecurity concept, capability and domain, are a useful way to check coverage, though they are defined in ISO/IEC 27002 rather than in 27001 itself.
From the SoA comes the risk treatment plan: who implements which control, by when, with what resources. That plan is the project schedule for the rest of the programme.
Step 5: write only what is required, and what you will use
The standard mandates a specific set of documented information. Everything beyond it is a choice, and every document you create is one the auditor can ask to see followed.
| Clause | Required documented information |
|---|---|
| 4.3 | Scope of the ISMS |
| 5.2 | Information security policy |
| 6.1.2 and 6.1.3 | Risk assessment process, risk treatment process, Statement of Applicability, risk treatment plan |
| 6.2 | Information security objectives |
| 7.2 | Evidence of competence |
| 8.1 | Evidence that operational processes were carried out as planned |
| 8.2 and 8.3 | Results of risk assessments and risk treatment |
| 9.1 | Results of monitoring and measurement |
| 9.2 | Internal audit programme and results |
| 9.3 | Results of management reviews |
| 10.2 | Nonconformities and corrective actions |
Beyond that, Annex A controls imply policies and procedures on topics such as access control, supplier relationships, incident management and secure development, but how many documents, and how long, is up to you. A twenty-page policy nobody reads is a nonconformity waiting to happen. Our policy and control framework work sizes the document set to the organisation.
Step 6: operate the controls and collect evidence
The certification body audits a system that is running, not one that is designed. That means the controls in the SoA have to have operated long enough to produce records: access reviews done, backups tested, changes approved, incidents logged, vulnerabilities assessed and fixed, suppliers reviewed, staff trained. The practical rule is at least one full cycle of every periodic activity before stage 2. This is where the risk assessment pays off: controls chosen because of real risks are controls someone already wanted to run.
The technical controls also need technical evidence. Annex A 8.8 requires technical vulnerabilities to be identified and addressed, and 8.29 requires security testing in development; a penetration test on a defined cadence is the usual evidence for both. Our guide to how often to test explains how ISO's risk-based approach sits beside the regulators' fixed intervals.
Step 7: internal audit and management review
Clause 9.2 requires an internal audit of the ISMS against the standard and your own requirements, by someone objective and competent, before certification and at planned intervals after. Clause 9.3 requires top management to review the system's performance, with specific inputs including audit results, risk changes and improvement opportunities, and to record decisions. Both must happen before the certification body's stage 2 visit, and both must be real: an internal audit that finds nothing is itself a finding.
Step 8: certification, and what comes after
Choose an accredited certification body
Certification bodies are themselves assessed, against ISO/IEC 17021-1 and ISO/IEC 27006, by accreditation bodies. In India that is NABCB, a board of the Quality Council of India and a signatory to the international mutual recognition arrangement for ISMS certification since 2015; bodies accredited by other recognised accreditation bodies are equally valid. An unaccredited certificate is a piece of paper.
Stage 1
A review of the documented system: scope, policy, risk assessment, SoA, internal audit and management review records. The auditor confirms you are ready for stage 2 and identifies areas of concern.
Stage 2
The audit of effectiveness: interviews, records and observation across the scope, usually weeks after stage 1. Findings are classified as major or minor nonconformities or observations; majors must be closed before the certificate is issued.
Certificate, surveillance and recertification
The certificate is valid for three years, with surveillance audits every year and a full recertification audit before it expires. Anyone can verify an accredited certificate in IAF CertSearch, the global database operated for ISO and Global ACI.
How long it takes
One certification body's published guidance says that "for small organizations with one location and small systems, it can take as little as 3 months to achieve certification", and up to 18 months for larger ones. Our experience is similar: three to six months for a focused scope in an organisation with existing security controls, six to twelve for a multi-site scope or one starting from little, and longer only when the scope keeps changing or the risk assessment is left to the end. Certification body lead times add a month or two, so book stage 1 early.
Who asks for ISO 27001 in India
- SEBI. Mandatory for market infrastructure institutions under the CSCRF, with a defined scope; recommended for other qualified regulated entities; and SEBI's FAQ expects outsourced data centre, DR and SOC providers to be certified for the services they provide.
- IRDAI. Accepts a vendor's certificate in place of periodic audits where the scope covers the service, and recommends cloud providers that conform to ISO 27001 for physical and environmental security.
- RBI. The 2026 cybersecurity directions and the 2023 IT governance direction do not require ISO 27001; they set their own controls, though the structure of a certified ISMS maps closely onto them. Our guide to RBI's NBFC directions covers that mapping.
- UIDAI. Its compliance checklist for authentication and KYC user agencies cites ISO 27001 as an example of the standards a security policy should follow, not as a certification requirement.
- Government and enterprise procurement. MeitY's cloud empanelment criteria, audited by STQC, reference ISO 27001-family certifications, and many tenders and enterprise security questionnaires ask for the certificate outright.
- Customers abroad. For a company selling into the US, ISO 27001 and SOC 2 are usually both requested; the AICPA publishes a mapping between the two, and our SOC 2 versus ISO 27001 comparison explains when to do which first.
India is now the second-largest holder of ISO 27001 certificates in the world: the ISO Survey for 2024 counted 6,758 valid certificates in India, behind China's 33,359, out of 96,709 worldwide. The worldwide figure roughly doubled from the previous survey because of a change in how the data is collected, so treat the trend with caution, but the ranking is a fair picture of demand.
Standards that build on it
ISO/IEC 27001 is designed to be extended. ISO/IEC 27701, the privacy information management standard, was republished in October 2025 as a standalone standard, so a 27001 certificate is no longer a prerequisite, though the two integrate naturally; with the DPDP Rules commencing in May 2027, it is the obvious next step for organisations processing personal data at scale. ISO/IEC 27017, revised in 2026, and ISO/IEC 27018, revised in 2025, cover cloud security and cloud privacy. ISO/IEC 42001 for AI management systems uses the same harmonised structure, with identical clause numbers and core text, so, in the words of the ISO committee's own journal, organisations that already maintain an ISMS "are expected to be able to integrate AI management with their existing ISMS". Our guide to ISO 42001 and the NIST AI RMF covers that.
The mistakes that cost the most time
- Buying a document set first. Templates written for another organisation describe controls you do not run. The auditor will ask to see them running.
- Scoping by convenience. Excluding the system customers care about to make certification easier produces a certificate that does not answer the question.
- Marking every Annex A control applicable. The SoA should reflect your risks. Ninety-three "applicable" with no justification is a sign the risk assessment did not drive it.
- Starting evidence collection in the month before stage 2. Records need a cycle to exist.
- Treating the internal audit as a formality. It is the last chance to find what the certification body will find.
- Letting the system stop after the certificate. Surveillance audits come every year, and the first one usually tests whether anything happened in the twelve months since.
An ISO 27001 implementation engagement with us is built around avoiding these: scope and risk assessment in the first weeks, documents sized to the organisation, evidence habits from the start, and support through stage 1, stage 2 and the first surveillance.
Frequently Asked Questions
Click any question to expand the answer.
QWhat is ISO/IEC 27001:2022?
The international standard for an information security management system, published in October 2022 with a short amendment in February 2024. It sets requirements in clauses 4 to 10 for how an organisation decides what to protect, assesses risk, selects controls, operates them and improves, and lists 93 reference controls in Annex A. Certification means an accredited body has audited the system and found it conforms.
QHow long does ISO 27001 implementation take?
Three to six months for a focused scope in an organisation with existing controls, six to twelve for a multi-site scope or one starting from little. One certification body's guidance gives a range from three months for small single-site organisations to eighteen months for larger ones. Certification body lead times add a month or two.
QWhat are the steps to ISO 27001 certification?
Define the scope; establish context, leadership and policy; run a risk assessment; decide treatment and produce the Statement of Applicability and risk treatment plan; write the required documents; operate the controls long enough to produce evidence; conduct an internal audit and management review; then stage 1 and stage 2 audits by an accredited certification body.
QWhat is the Statement of Applicability?
A document required by clause 6.1.3 d) that lists all 93 Annex A controls, states whether each is applicable with a justification, and whether it is implemented. It is the document auditors refer to most and the one customers and regulators ask for alongside the certificate.
QHow many controls are in ISO 27001:2022?
93 in Annex A, arranged in four themes: 37 organisational, 8 people, 14 physical and 34 technological. The 2013 edition had 114; the 2022 edition added 11 new controls, updated 58 and merged 24.
QWhich documents are mandatory for ISO 27001?
The scope, the information security policy, the risk assessment and treatment processes, the Statement of Applicability, the risk treatment plan, security objectives, evidence of competence, evidence that operational processes ran as planned, risk assessment and treatment results, monitoring results, the internal audit programme and results, management review results, and records of nonconformities and corrective actions.
QWhat happens at stage 1 and stage 2 audits?
Stage 1 is a review of the documented system to confirm readiness and flag concerns. Stage 2, usually weeks later, audits effectiveness through interviews, records and observation across the scope. Major nonconformities must be closed before the certificate is issued.
QHow long is an ISO 27001 certificate valid?
Three years, subject to surveillance audits every year and a recertification audit before expiry. Certificates to the 2013 edition all expired or were withdrawn by 31 October 2025.
QHow do I check whether an ISO 27001 certificate is genuine?
Confirm the certification body is accredited, in India by NABCB or by another accreditation body recognised under the international mutual recognition arrangement, and look the certificate up in IAF CertSearch, the global database of accredited certifications. Then read the scope statement, because the certificate covers only what it names.
QDoes RBI require ISO 27001?
No. RBI's 2026 cybersecurity directions and the 2023 IT governance direction set their own controls without requiring certification. SEBI's CSCRF requires it for market infrastructure institutions and recommends it for other qualified entities; IRDAI accepts vendors' certificates in place of periodic audits where the scope covers the service.
QWhat is the difference between ISO 27001 and ISO 27002?
ISO 27001 contains the requirements and is the standard you certify against; ISO 27002 is guidance on implementing the controls listed in 27001's Annex A, including the control attributes introduced in 2022. You need 27002 to implement well but you are not certified to it.
QShould we do ISO 27001 or SOC 2 first?
It depends on who is asking. ISO 27001 is the certificate asked for in India, Europe and most tenders; SOC 2 is what US customers usually request. The two overlap heavily and the AICPA publishes a mapping, so most organisations that need both build the management system first and add the SOC 2 examination to it.
Related reading
For choosing between the two most requested attestations, see SOC 2 versus ISO 27001. For why a certificate is not the same as security, why compliance does not equal security. For the supplier controls in Annex A, third-party cyber risk. For the privacy obligations arriving in 2027, the 180-day DPDP readiness plan.
Sources
- ISO, ISO/IEC 27001:2022 Information security, cybersecurity and privacy protection — Information security management systems — Requirements.
- ISO and IAF, Joint communiqué on climate change amendments to management system standards (February 2024).
- IAF, IAF MD 26:2023 Transition requirements for ISO/IEC 27001:2022.
- NABCB, Policy for transition to ISO/IEC 27001:2022.
- APAC, Global Accreditation Cooperation Incorporated to replace IAF and ILAC.
- IAF CertSearch, Global database of accredited certifications.
- DNV, ISO 27001 changes and benefits.
- DNV, Insights from auditing information security management systems.
- DNV, ISO/IEC 27001 information security management system certification.
- A-LIGN, What's the difference between ISO 27001:2013 and ISO 27001:2022.
- Advisera, List of mandatory documents required by ISO 27001.
- ISO, ISO/IEC 27005:2022 Guidance on managing information security risks.
- DNV, Revision of ISO/IEC 27701 (2025).
- ISO/IEC JTC 1/SC 27, SC 27 Journal 2026, Issue 1.
- Securities and Exchange Board of India, CSCRF clarification circular SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2025/119 (August 2025).
- Securities and Exchange Board of India, CSCRF frequently asked questions (June 2025).
- IRDAI, Information and Cyber Security Guidelines for Regulated Entities, Version 2.0 (April 2026).
- UIDAI, Compliance checklist for AUA/KUA.
- AICPA, Mapping: 2017 Trust Services Criteria to ISO 27001.
Adayptus Consulting
Governance, Risk and Compliance, Adayptus
Adayptus Consulting Private Limited is a cybersecurity consultancy based in Noida, India, implementing ISO/IEC 27001 management systems that pass certification and keep working afterwards.
On This Page
- What the 2022 edition changed, and the transition that just ended
- Step 1: decide why, and what is in scope
- Step 2: context, leadership and the policy
- Step 3: the risk assessment
- Step 4: treatment and the Statement of Applicability
- Step 5: write only what is required, and what you will use
- Step 6: operate the controls and collect evidence
- Step 7: internal audit and management review
- Step 8: certification, and what comes after
- How long it takes
- Who asks for ISO 27001 in India
- Standards that build on it
- The mistakes that cost the most time
- Frequently Asked Questions
- Related reading
- Sources
