ISO/IEC 27001:2022 · Information security management system · Certifiable standard
What is ISO 27001?
ISO/IEC 27001:2022 is the international standard for an information security management system, or ISMS: the risk assessment, policies, controls, internal audit and management review an organisation runs to protect information. Published on 25 October 2022, it is certifiable, with a three-year certificate and annual surveillance audits, and its Annex A lists 93 reference controls in four themes.
Sources: ISO/IEC 27001:2022, Information security management systems: Requirements, ISO; ISO/IEC 27001 information security management, ISO; ISO/IEC 27001:2013 and ISO/IEC 27001:2022 comparison, ANAB; BCB 125, Accreditation Criteria for Information Security Management Systems Certification, NABCB, Jan 2026; Information Security Management System (ISMS) certification, STQC; SEBI circular SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113, Cybersecurity and Cyber Resilience Framework for SEBI Regulated Entities
Key facts
| Owner | ISO and IEC, joint technical committee JTC 1/SC 27 (information security, cybersecurity and privacy protection) |
|---|---|
| Published | 25 October 2022 (third edition). It replaced ISO/IEC 27001:2013; certificates to the 2013 edition had to be transitioned by 31 October 2025 |
| Structure | Clauses 4 to 10 follow the harmonised management-system structure: context, leadership, planning, support, operation, performance evaluation, improvement. Annex A lists 93 reference controls in four themes: organisational (37), people (8), physical (14) and technological (34). Eleven controls are new in the 2022 edition; the 2013 edition had 114 in 14 sections |
| What is mandatory | A defined scope, an information security policy, a risk assessment and risk treatment process (clauses 6.1.2 and 6.1.3), a Statement of Applicability that compares your chosen controls with Annex A and justifies every exclusion (clause 6.1.3), security objectives, competence and awareness records, operational controls, monitoring and measurement, an internal audit (clause 9.2), a management review (clause 9.3) and corrective action (clause 10). Annex A itself is a reference list, not a checklist you must implement in full |
| Certificate | Three years, after a Stage 1 (documentation) and Stage 2 (implementation) audit, with a surveillance audit each year and a recertification audit before the certificate expires. The certificate names the scope, so read the scope statement before you rely on someone else's. The standard sets no minimum operating period, but Stage 2 needs evidence that the ISMS has run, including an internal audit and a management review. |
| Accreditation | In India, NABCB (National Accreditation Board for Certification Bodies, Quality Council of India) accredits ISMS certification bodies against ISO/IEC 27006:2015/Amd 1:2020 under its criteria document BCB 125 (Jan 2026). Abroad, UKAS (UK), ANAB (US) and the other IAF members do the same. A certificate carrying the mark of any IAF MLA signatory is recognised across the arrangement |
| Who certifies in India | STQC, the Standardisation Testing and Quality Certification directorate under MeitY, has run an NABCB-accredited ISMS scheme (accreditation ISMS003) since November 2001. Bodies accredited abroad also certify Indian companies; check which accreditation mark is on the certificate |
| Where an Indian regulator requires it | SEBI's Cybersecurity and Cyber Resilience Framework (circular of 20 Aug 2024, para 4.2.1 and standard PR.IP.S16) makes ISO 27001 certification, latest version, mandatory for market infrastructure institutions and Qualified REs, to be obtained within one year of the circular, with evidence submitted alongside the cyber audit report |
| Cost in India | Not published yet. Infofacility will post an Indian price range, with what it covers, once it has three comparable quotes. |
| Pairs with | ISO 27701 for personal data (a PIMS built on the same management system), ISO 42001 for AI (same clause structure, one integrated audit), SOC 2 (the same control evidence serves both), and the DPDP Act 2023, whose s. 8(5) requires reasonable security safeguards without naming a standard |
Who needs it
- Most organisations hold ISO 27001 because a customer or a tender asks for it. It is the certificate Indian IT services, SaaS, BPO and GCC operations are most often asked for by customers in India, Europe, the Middle East and Asia, and it appears in procurement and vendor-onboarding requirements across sectors. Unlike SOC 2, it comes with a certificate from an accredited body, which is what tender evaluators and procurement portals want to see.
- One Indian regulator requires it outright. SEBI's CSCRF of 20 August 2024 makes ISO 27001 certification mandatory for market infrastructure institutions (exchanges, clearing corporations, depositories) and for Qualified REs, the larger brokers, depository participants, asset managers and others SEBI places in that category, and the certificate scope has to include the primary data centre, disaster recovery and near-DR sites. Vendors to those entities feel the requirement second-hand, because outsourced services covered by the scope must be certified too.
- The standard does not prescribe controls by size or sector. A ten-person SaaS company and a bank both start from the same risk assessment and the same Annex A list; what differs is the scope, the risks they find and the controls they choose. The DPDP Act 2023 does not name ISO 27001, but s. 8(5) requires every data fiduciary to take reasonable security safeguards, and a certified ISMS is the most common way Indian companies expect to show they have.
How certification works
Step 1
Set the scope
Decide which business units, locations, systems and services the ISMS covers and write it down (clause 4.3). A narrow, honest scope beats a wide one you cannot evidence; customers will read the scope statement on the certificate.
Step 2
Write the policy and assign the roles
Top management approves an information security policy and makes someone accountable for the ISMS (clause 5). Name who owns risk decisions, who maintains the Statement of Applicability and who reports to management.
Step 3
Assess and treat risks
Build a risk assessment method, identify risks to confidentiality, integrity and availability, score them, and choose treatments (clauses 6.1.2 and 6.1.3). Compare your chosen controls with the 93 in Annex A and record what applies and why in the Statement of Applicability.
Step 4
Implement the controls and the paperwork
Put the controls in place, from access control and logging to supplier agreements and secure development, and keep the documented information clause 7.5 asks for. Train staff and keep the records.
Step 5
Measure, audit yourself, review
Monitor the controls you said you would (clause 9.1), run an internal audit (clause 9.2) and hold a management review (clause 9.3). Fix what the audit finds through corrective action (clause 10.2). Stage 2 will ask for all three.
Step 6
Stage 1 and Stage 2 with an accredited body
Choose a certification body whose accreditation covers ISO/IEC 27001:2022 (NABCB in India, or another IAF member). Stage 1 reviews documentation and readiness; Stage 2 tests that the ISMS operates. Nonconformities must be closed before the certificate is issued.
Step 7
Keep the certificate alive
A surveillance audit each year and recertification in year three. Changes in scope, a new office or a new product need to flow into the risk assessment and the Statement of Applicability before the next audit, not after.
Get there with Infofacility
GRC · Infofacility service
ISO 27001 certification support
From gap assessment to the certification audit, with the Statement of Applicability written with you. 3 to 6 months.
Request a callbackQuestions
Is ISO 27001 mandatory in India?
Not generally. It is a voluntary standard. The exception is SEBI's CSCRF (circular of 20 August 2024), which requires ISO 27001 certification for market infrastructure institutions and Qualified REs. Other regulators, including RBI and the DPDP Act 2023, ask for security controls or reasonable safeguards without naming the standard.
Does our 2013 certificate still count?
No. The transition from ISO/IEC 27001:2013 ended on 31 October 2025, three years after the 2022 edition was published, and accreditation for the 2013 edition ended with it. NABCB's own transition policy set the same date for Indian certification bodies. Any certificate still citing the 2013 edition should be treated as expired.
Do we have to implement all 93 Annex A controls?
No. Annex A is a reference list. Clause 6.1.3 asks you to choose controls from your risk treatment, compare them with Annex A to check nothing necessary has been missed, and record in the Statement of Applicability which controls apply and why any are excluded. An excluded control with a sound justification is normal; an exclusion with no reason is a finding.
Should we pick an NABCB-accredited body or a foreign-accredited one?
Either produces a recognised certificate, because NABCB, UKAS, ANAB and the other IAF members recognise each other's accreditations under the IAF multilateral arrangement. Some tenders and customers name the accreditation body they want to see on the certificate, so check what your buyers write in their requirements before choosing.
Related
Change log
4 Nov 2026 First version.
This page explains the law in plain English. It is not legal advice.
Weekly · Watching 6 regulators