What Is ISO 27001?
Key takeaways
- ISO 27001 certifies a management system, not a product, so the certificate covers the organisation's ISMS and the scope you declare, and the scope statement on the certificate is what tells a customer what is actually covered.
- The 2022 edition uses the Annex A structure with 93 controls in 4 themes, replacing the 114 controls of the 2013 edition, so an old gap analysis does not map cleanly onto the current version.
- Certification runs on a three-year cycle with a stage 1 audit, a stage 2 audit, and annual surveillance audits, and a lapse in surveillance is the most common reason a certificate is suspended.
- In India the cost band for a first certification for a small to mid-sized organisation is roughly Rs 2,00,000 to Rs 8,00,000 depending on scope and employee count, and much of that is internal preparation time, not the audit fee.
- The commercial driver in India is customer due diligence, so before certifying, get two or three target customers to confirm the certificate is on their required list, because a certificate nobody asks for is an expensive decorative object.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
What does an ISO 27001 certificate actually certify?
It certifies that your organisation runs an information security management system: a documented set of policies, a risk assessment, a risk treatment plan, defined responsibilities, internal audits, management review, and a set of controls from Annex A applied according to the risks you identified. An accredited certification body audits this against the standard, and certification is granted for a declared scope, which appears on the certificate itself. Read the scope statement before you celebrate. A certificate covering only the development centre in Kochi says nothing about your cloud production environment, and a customer who reads it carefully will notice, so either broaden the scope or be explicit about what is excluded.
What changed in the 2022 edition and does it matter to you?
The 2022 edition restructured the standard around ten themes and reduced Annex A from 114 controls to 93, adding controls for cloud services, data protection, data leakage, threat intelligence, data security in use, and the organisational and people-side controls that make an ISMS work. It also dropped the separate documented statement of applicability, replacing it with the risk treatment and control list. For an Indian company this matters twice: a gap analysis written against the 2013 edition will not map cleanly and will need redoing, and the new controls map well onto the DPDP Act and the CERT-In directions, so a single control library can serve the certification audit and the regulatory audit at the same time.
What does ISO 27001 cost in India, and what drives the number?
Two separate costs. The audit fee, which for a small to mid-sized organisation in India commonly lands around Rs 1,00,000 to Rs 3,00,000 per audit depending on the certification body, the number of sites and the employee count, and certification runs on a three-year cycle with annual surveillance. And the internal cost, usually the larger one: the time of a project owner, the documentation, the risk assessment, the internal audit, the management review, and remediation of the gaps stage 1 finds. Expect the first-cycle effort to land around Rs 2,00,000 to Rs 8,00,000 for an organisation of typical Indian size, and be suspicious of a quote far below that band, because the cheap version is documentation written for the auditor.
When do you actually need ISO 27001, and when is it waste?
You need it when enterprise customers require it in their vendor security process, when a public sector, financial or healthcare buyer makes it a condition of tender, when a large customer makes it a condition of contract, or when a funding round or a global expansion raises the question. It is close to waste when nobody on your customer list has asked for it, when the organisation is under twenty people and still learning its processes, or when it is pursued as a substitute for the controls you actually need. A sensible order is: get the ISMS in place, because the CERT-In directions require one anyway, then certify once the evidence supports it and a customer has confirmed the need.
| Stage or artefact | What it is | Relation to Indian obligations |
|---|---|---|
| Risk assessment | Identification, analysis and treatment of information security risks | Feeds the ISMS required by the CERT-In directions |
| Statement of applicability | The control list and the justification for each control | Maps Annex A 2022 controls to DPDP and CERT-In requirements |
| Internal audit | A management-led audit of the ISMS at planned intervals | Evidence for both certification and regulatory readiness |
| Management review | Top management's documented review of the system's effectiveness | Supports the Board reporting duty under the DPDP Rules |
| Stage 1 and stage 2 audit | Readiness and certification audits by an accredited body | Separate from, but well aligned with, the CERT-In empanelled audit |
| Surveillance audits | Annual audits confirming the system still works | Where most lapses happen, so calendar them properly |
What are the frequently asked questions?
Get a straight answer on this
Send us your current ISMS documents or tell us you have none, and we will return a costed certification path with the gap list to close first.
Send us the details See pricing