ISO 27001 Certification India — Complete Implementation Guide 2026

Why ISO 27001 Certification Matters for Indian Companies in 2026

ISO 27001 is the world’s leading information security management standard — and for Indian IT, SaaS, BFSI, and healthcare companies, it has shifted from a nice-to-have to a commercial necessity. Enterprise buyers in the US, EU, and Middle East routinely demand ISO 27001 as a vendor qualification gate. SEBI’s CSCRF circular (2024) references ISO 27001 for regulated financial entities. And with the DPDP Act 2023 now operational, ISO 27001 provides the most defensible operational framework to demonstrate compliance.

Critically: all ISO 27001:2013 certificates expired on 31 October 2025. If your organisation holds or is pursuing certification, it must be to the ISO 27001:2022 edition. This guide covers everything you need to know — from scope to surveillance audit.

ISO 27001:2022 — What Changed from 2013

The 2022 revision is significant but manageable. The standard’s 10 clauses (the mandatory requirements) are largely unchanged. The major change is in Annex A — the control reference set:

Dimension	ISO 27001:2013	ISO 27001:2022
Total controls	114	93
Control domains/themes	14 domains	4 themes
New controls	—	11 new controls
Merged controls	—	57 merged
Certificate validity	Expired 31 Oct 2025	Current edition

The 11 new controls most relevant to Indian organisations are: Threat Intelligence (5.7), Information Security for Cloud Services (5.23), ICT Readiness for Business Continuity (5.30), Physical Security Monitoring (7.4), Configuration Management (8.9), Information Deletion (8.10), Data Masking (8.11), Data Leakage Prevention (8.12), Monitoring Activities (8.16), Web Filtering (8.23), and Secure Coding (8.28).

The 4 Annex A Themes and 93 Controls

ISO 27001:2022 organises its 93 controls into four themes. You are not required to implement all 93 — you select controls based on your risk assessment and document exclusions in the Statement of Applicability.

Theme 1: Organisational Controls (37 controls, A.5.x)

Covers policies, roles, responsibilities, supplier relationships, and incident management. Key controls for Indian SaaS companies: A.5.7 Threat Intelligence (new — requires a structured process to collect and act on threat feeds), A.5.19–A.5.22 Supplier Security (vendor due diligence, contracts, supply chain), and A.5.23 Cloud Service Security (new — governance of cloud platforms including AWS, Azure, GCP).

Theme 2: People Controls (8 controls, A.6.x)

Covers screening, terms of employment, security awareness, disciplinary processes, and remote working. A.6.3 Information Security Awareness, Education and Training is frequently cited as deficient in Indian SME audits. Annual security awareness training with documented completion records is the minimum bar.

Theme 3: Physical Controls (14 controls, A.7.x)

Covers physical perimeters, entry controls, CCTV, clean desk, equipment maintenance, and secure disposal. For cloud-native companies with no data centre, many physical controls apply to office premises. You must still address them — you cannot exclude A.7.x entirely without a documented risk justification.

Theme 4: Technological Controls (34 controls, A.8.x)

The most operationally intensive theme. Key controls: A.8.8 Management of Technical Vulnerabilities (patch management SLAs), A.8.15 Logging, A.8.16 Monitoring Activities (new — SIEM or equivalent), A.8.24 Use of Cryptography, A.8.28 Secure Coding (new — SSDLC requirements), and A.8.32 Change Management.

ISO 27001 Certification Timeline in India

Phase	Activity	Duration
Phase 1	Scope definition + Gap analysis	3–5 weeks
Phase 2	Risk assessment + Risk treatment plan	3–4 weeks
Phase 3	Control implementation + Documentation	6–12 weeks
Phase 4	Internal audit + Management review	2–3 weeks
Phase 5	Stage 1 Audit (documentation review)	1–2 weeks
Phase 6	Stage 2 Audit (on-site effectiveness)	1–2 weeks
Total	First certificate	4–9 months

After certification, you must maintain the ISMS with annual surveillance audits (Years 1 and 2) and a full recertification audit in Year 3. Surveillance audits typically cost 40–50% of the initial certification audit fee.

ISO 27001 Certification Cost in India (2026)

Organisation Size	Consulting + Implementation	Certification Audit	Total Year 1
Startup / less than 50 staff	Rs 1–3 lakh	Rs 1.5–2.5 lakh	Rs 4–6 lakh
Mid-market / 50–250 staff	Rs 4–10 lakh	Rs 2.5–5 lakh	Rs 8–15 lakh
Enterprise / 250+ staff	Rs 10–25 lakh	Rs 5–12 lakh	Rs 20–40 lakh

The 10 Mandatory ISO 27001 Clauses

• Clause 4: Context of the organisation (internal/external issues, interested parties)
• Clause 5: Leadership (top management commitment, security policy, roles)
• Clause 6: Planning (risk assessment, risk treatment, SoA, security objectives)
• Clause 7: Support (resources, competence, awareness, communication, documentation)
• Clause 8: Operation (operational planning, risk treatment implementation)
• Clause 9: Performance evaluation (monitoring, internal audit, management review)
• Clause 10: Improvement (non-conformity, corrective action, continual improvement)

ISO 27001 vs DPDP Act — How They Align

DPDP Obligation	ISO 27001:2022 Control
Section 8(1) — Reasonable security safeguards	Annex A Theme 4 (Technological Controls)
Section 8(6) — Breach notification within 72 hours	A.5.26 Response to Information Security Incidents + A.6.8
Section 8(7) — Retain data only as long as necessary	A.5.33 Protection of Records, A.8.10 Information Deletion
Section 9 — Data Principal rights (access, correction, erasure)	A.5.31 Legal, Statutory, Regulatory and Contractual Requirements
Section 28 — Data Fiduciary obligations	A.5.19–A.5.22 Supplier/Third-Party Security

Common ISO 27001 Failure Points in Indian Audits

1. Incomplete Risk Assessment — Assets identified but threat-vulnerability pairs not mapped; risk ratings not documented or reviewed annually.
2. SoA not maintained — Statement of Applicability prepared for Stage 1 but not updated when controls change.
3. Awareness training not evidenced — Training conducted but completion records, quiz scores, and annual refresh dates not available.
4. Vendor contracts missing security clauses — Sub-processors and cloud providers not covered by formal information security agreements (A.5.20).
5. Internal audit independence — Internal auditors audit their own areas, violating Clause 9.2 independence requirements.
6. Management review not documented — Reviews happen informally; no formal minutes with decisions and actions recorded.

How to Choose a Certification Body in India

Only use an IAF-accredited certification body. In India, accreditation is granted by NABCB (National Accreditation Board for Certification Bodies) under the Quality Council of India. Verify accreditation at nabcb.qci.org.in before engaging any CB. Well-recognised bodies operating in India: BSI Group, Bureau Veritas, TUV SUD, DNV, Intertek, and KPMG Global Services.

ISO 27001 Fast-Track: Is It Possible?

Yes — organisations with a mature security posture (existing security team, documented policies, cloud-native with limited physical footprint) can achieve Stage 2 audit in 12–16 weeks with the right consultant. The prerequisites are: narrow scope, executive sponsor with decision authority, dedicated internal project owner (minimum 20% of one FTE), and no material non-conformities in the gap analysis.

Fast-track is not recommended if your gap analysis reveals more than 20 missing controls, you have multiple physical sites, or your risk assessment has never been formally conducted.