They expertly mapped the overlapping controls between SOC 2 and ISO 27001, which saved us from duplicating work.
Jasreet Kaur B.Silicon Physical Design Engineer · Small-BusinessSOC 2 + ISO 27001 · August 2026
ISO 27001:2022 Certification Services
Build a World-Class ISMS
with ISO 27001
Achieve global information security recognition with ISO 27001:2022 certification. Led by certified lead auditors who coordinate with accredited bodies (TÜV SÜD, BSI, DNV), backed by 1,000+ audits to date.
Our certified Lead Auditors coordinate with TÜV SÜD, BSI, DNV & INTERCERT
1,000+ audits delivered to date
Complete coverage of all 93 Annex A controls
Accredited-Body Ready · 93 Annex A Controls · Serving India, USA, UK, Australia & GCC
93ANNEX A CONTROLS
1,000+Audits DeliveredTo date
300+SOC 2 EngagementsTo date
6–12moTime to CertificationAverage timeline
93Annex A ControlsFull coverage
Overview
What is ISO 27001?
ISO/IEC 27001 is the international standard for information security management systems (ISMS). Published by ISO/IEC, it specifies requirements for establishing, implementing, maintaining, and continually improving an ISMS.
The standard helps organizations protect the confidentiality, integrity, and availability of information through a systematic, risk-based approach. ISO 27001 certification demonstrates to customers, partners, and stakeholders that your organization takes information security seriously.
- Recognized in 171+ countries worldwide
- 3-year certification cycle with annual surveillance audits
ISO 27001 — Key Takeaways
- ISO/IEC 27001:2022 is the international standard for an Information Security Management System (ISMS) — a certifiable framework recognized in 171+ countries.
- The 2022 revision defines 93 Annex A controls grouped into 4 themes — Organizational, People, Physical, and Technological — down from 114 controls in 14 domains under the 2013 edition.
- Certification is awarded by an accredited body after a two-stage audit (Stage 1 document review, Stage 2 effectiveness), and is valid for 3 years with annual surveillance audits.
- The Statement of Applicability (SoA) and risk assessment are the spine of the ISMS — every applicable control must trace to a documented risk decision, which is where most first audits are won or lost.
- Indicative TCSA ISO 27001 cost is ₹2–4 lakh in year one, all-in with the certification body’s fee, delivered across 1,000+ audits to date.
Benefits
ISO 27001 Delivers Business Value
ISO 27001 certification is more than compliance — it's a strategic investment that reduces risk, builds customer trust, and enables business growth.
Global Recognition
ISO 27001 is recognized in 171+ countries, providing international credibility and enabling market expansion across borders.
Risk-Based Approach
Implement systematic risk assessment and treatment processes that protect your organization's most critical assets.
Competitive Advantage
Win RFPs, satisfy vendor security requirements, and differentiate from competitors lacking certified information security.
93 Controls
Annex A Control Framework
ISO 27001:2022 reorganized controls into 4 themes with 93 total controls. Organizations select applicable controls based on risk assessment results.
Critical
Policies for Information Security
Information security policy and topic-specific policies approved by management, published, and communicated.
A.5.1 · 5 controls
Critical
Management of Technical Vulnerabilities
Timely information about technical vulnerabilities of information systems, evaluation of exposure, and appropriate measures.
A.8.8 · 1 control
Critical
User Endpoint Devices
Information stored on, processed by, or accessible via user endpoint devices protected against unauthorized access and disclosure.
A.8.1 · 1 control
Common
Information Security for Cloud Services
Processes for acquisition, use, management, and exit from cloud services established in accordance with information security requirements.
A.5.23 · 1 control
Common
Information Deletion
Data and information stored in systems, devices, or any other storage media deleted when no longer required.
A.8.10 · 1 control
Common
Configuration Management
Security configurations, including hardening requirements, established, documented, implemented, monitored, and reviewed.
A.8.9 · 1 control
Auditor Intelligence
Where Audits Fail
Based on 1,000+ audits, including ISO 27001 programs. These three Annex A controls account for the majority of Stage 2 nonconformities.
A.5.15
Access Control
Auditors test user provisioning, deprovisioning, and periodic access reviews. Terminated employees retaining access or missing quarterly reviews constitute significant findings.
Auditors Test
- MFA enforced for all users
- Quarterly access certification documented
- Same-day offboarding verified
A.8.32
Change Management
Auditors sample 10–15 production changes to verify approval workflows, testing procedures, and rollback plans. One undocumented emergency change = major nonconformity.
Auditors Test
- Change approval board documented
- Peer-reviewed deployments
- Rollback procedures tested
A.5.28
Collection of Evidence
Incident response and forensic evidence collection must be documented and tested. Auditors verify evidence preservation procedures and chain of custody.
Auditors Test
- Incident response plan documented
- Evidence collection procedures
- Annual tabletop exercises
From the Audit Floor
What Our Lead Auditors Actually See
Two of the most common — and most avoidable — reasons a first ISO 27001 certification slips, in the words of the TCSA Lead Auditors who run the readiness engagements.
“The number-one reason a first ISO 27001 certification slips is a Statement of Applicability that does not trace back to the risk assessment. Auditors open the SoA and the risk register side by side — if a control is marked "not applicable" with no documented justification, or an accepted risk has no owner, that is an immediate nonconformity before we ever discuss technical controls.”
“The control most teams get wrong is A.5.1 — they write a polished information-security policy and then never evidence that it was approved by top management and communicated to staff. Under ISO 27001:2022, management commitment is auditable. We make sure the approval, the version history, and the read-acknowledgement trail exist before Stage 1, not after the auditor asks.”
TCSA expert commentary, drawn from 1,000+ audits — including ISO 27001 programs — to date.
By the Numbers
ISO 27001, in Figures
The facts that define the standard — sourced to ISO, the body that publishes ISO/IEC 27001 — alongside TCSA’s own delivery record.
93Annex A Controls
ISO/IEC 27001:2022 reorganized Annex A into 93 controls across 4 themes (down from 114 in 14 domains).
ISO/IEC 27001:20224Control Themes
Organizational, People, Physical, and Technological — the four themes that structure the 2022 Annex A.
ISO/IEC 27001:20223-yearCertification Cycle
Certificates are valid for three years, sustained by annual surveillance audits and a recertification audit at year three.
Accredited certification scheme1,000+Audits Delivered
TCSA-led audit and certification engagements to date — including ISO 27001 programs.
TCSA engagement recordISO 27001:2022 Annex A — the four control themes
| Theme | Controls | Representative Controls |
|---|---|---|
| A.5 — Organizational | 37 controls | Information security policies, supplier relationships, threat intelligence (A.5.7), cloud security (A.5.23), incident management. |
| A.6 — People | 8 controls | Screening, terms of employment, security awareness, disciplinary process, remote working responsibilities. |
| A.7 — Physical | 14 controls | Secure areas, physical entry, equipment siting and protection, secure disposal, clear desk and clear screen. |
| A.8 — Technological | 34 controls | Access control, cryptography, secure development, configuration management (A.8.9), logging and monitoring, data leakage prevention. |
| Total | 93 controls | Across 4 themes in ISO/IEC 27001:2022 (revised from 114 controls / 14 domains in the 2013 edition). |
Control structure per ISO/IEC 27001:2022. Applicable controls are selected through your risk assessment and documented in the Statement of Applicability (SoA).
What's Included
Comprehensive ISO 27001 Certification Services
End-to-end support from initial gap analysis through successful certification and ongoing ISMS maintenance.
Gap Analysis
Comprehensive assessment of current security posture against all 93 Annex A controls.
ISMS Documentation
Develop complete ISMS documentation including policies, procedures, SOA, and risk treatment plan.
Risk Assessment
Structured risk identification, analysis, evaluation, and treatment aligned to ISO 27001 methodology.
Control Implementation
Deploy technical and organizational controls across all 93 Annex A requirements.
Internal Audit
Conduct complete internal ISMS audit before certification body Stage 1 and Stage 2 audits.
Certification Support
Coordinate with certification bodies (TÜV, BSI, DNV) and manage all auditor interactions.
Your Path to ISO 27001
Certification Timeline
Here is how a typical engagement runs, week by week. Your scope sets the actual pace.
- Weeks 1-2
Scoping & Gap Analysis
Define ISMS scope, identify information assets, and assess current posture against 93 Annex A controls.
- Weeks 3-6
Risk Assessment
Conduct comprehensive risk identification, analysis, and evaluation. Develop risk treatment plan.
- Weeks 7-12
Control Implementation
Deploy policies, procedures, and technical controls across all applicable Annex A requirements.
- Weeks 13-16
Documentation & Training
Complete ISMS documentation, Statement of Applicability, and conduct organization-wide training.
- Weeks 17-20
Internal Audit
Perform internal ISMS audit, management review, and remediate any identified nonconformities.
- Weeks 21-24
Certification Audit
Stage 1 (document review) and Stage 2 (on-site audit) by accredited certification body.
Why Choose Us
Your Trusted ISO 27001 Partner
Choose Tranquility for unparalleled expertise in ISO 27001 certification. Led by certified lead auditors who coordinate with accredited bodies, with deep CISO experience.
Certified Lead Auditors, Any Accredited Body
Led by certified ISO 27001 Lead Auditors who coordinate with accredited certification bodies, with deep CISO experience.
1,000+ Audits Delivered
Proven track record across India, USA, UK, Australia, and Middle East — including ISO 27001 programs — with zero Stage 2 failures.
6–12 Month Timeline
Structured implementation roadmap from gap analysis to certification.
BUILT FOR SCRUTINY
Programs engineered to survive the audit room — and the buyers who read the report.
Industries We Serve
ISO 27001 for Every Industry
From SaaS platforms to healthcare providers, we've guided organizations across all sectors to successful ISO 27001 certification.
- SaaS & TechnologyCloud platforms and software providers
- Financial ServicesBanks, FinTech, and payment processors
- HealthcareEHR systems and health data processors
- ManufacturingIndustrial and supply chain systems
- GovernmentGovTech and public sector services
- All IndustriesAny organization processing sensitive data
Learning Resources
Explore Our ISO 27001 Hub
Comprehensive guides, templates, and resources to support your ISO 27001 certification journey.
Control Reference
Annex A Controls Guide
Complete breakdown of all 93 controls in ISO 27001:2022 with implementation guidance.
Process Guide
Certification Guide
What to expect during Stage 1, Stage 2, and surveillance audits.
Implementation Guide
ISMS Implementation
Step-by-step roadmap for implementing your Information Security Management System.
Requirements
ISO 27001 Requirements
Complete requirements overview for achieving ISO 27001 certification.
Cost Guide
Certification Costs
Breakdown of consulting, audit, and implementation costs for ISO 27001 certification.
Resources
Templates & Downloads
Free ISO 27001 templates, checklists, and policy frameworks.
Proof
In their words.
Quotes verbatim from G2. Company names added where the client confirmed them.
Instead of simply providing generic templates or checklists, their team took the time to understand our environment and requirements.
Anand .Market Risk Analyst · Mid-MarketCompliance readiness · September 2026
The team’s willingness to work with us and ease of communication.
sam v.CEO · Small-BusinessSOC 2 Type I + ISO 27001 · August 2026
They delivered the project with speed, accuracy, and cost-effectiveness.
Maneet P.Mid-MarketSOC 2 · August 2026
My only regret is that we didn’t engage them sooner in our compliance journey, which would have saved us even more time.
Mahesh Raju C. · XonarSmall-BusinessSOC 2 · GRC · August 2026
They were always responsive and willing to go the extra mile whenever we had questions or needed guidance.
Chandan J. · DsiderSmall-BusinessSOC 2 Type I · August 2026
Managing the auditor relationship on our behalf was especially valuable — it took a lot of pressure off our internal team.
Achyut B.Senior Software Engineer · Small-BusinessSOC 2 + ISO 27001 · September 2026
Their focus on ensuring that we were genuinely audit-ready rather than simply completing documentation.
Ravi V.Founder & CEO · Mid-MarketSOC 2 Type II · August 2026
The guidance was not generic or simply based on a standard checklist — they suggested practical approaches that made sense for our business.
Verified UserInternational Trade and Development · Small-BusinessSOC 2 + ISO 27001 · September 2026
What I like best is the hands-on support and clear guidance throughout the SOC 1 and SOC 2 process.
Sai Sudha S. · ExcersSmall-BusinessSOC 1 + SOC 2 · September 2026
FAQ
Frequently Asked Questions
What is the difference between ISO 27001:2013 and ISO 27001:2022?
ISO 27001:2022 restructured Annex A from 114 controls (14 domains) to 93 controls (4 themes). New controls include cloud security (A.5.23), threat intelligence (A.5.7), and configuration management (A.8.9). The transition window for 2013-certified organizations closed on 31 October 2025, so all new and renewed certifications are now issued exclusively against the 2022 edition.
How much does ISO 27001 certification cost?
Indicative all-in cost is ₹2–4 lakh in year one (USD 3,000–6,000) for a typical 10–100 person company. That covers our consulting (gap analysis, implementation, internal audit) and the certification body’s Stage 1 and Stage 2 audit fees. Annual surveillance audits follow in years two and three. The cost varies with your organization’s size and complexity.
Do I need ISO 27001 if I already have SOC 2?
These serve different purposes. ISO 27001 is a certifiable international standard providing global recognition and ISMS framework. SOC 2 is an attestation primarily for US service providers. Many organizations pursue both — they share ~70% control overlap.
Which certification body should I choose?
Choose accredited bodies like TÜV SÜD, BSI, DNV, or INTERCERT based on industry recognition, geographic presence, and cost. All UKAS/ANAB-accredited certificates carry equal validity. Tranquility coordinates with all major certification bodies.
How long is the ISO 27001 certificate valid?
Certificates are valid for 3 years, subject to annual surveillance audits (typically 1 day). After 3 years, a recertification audit is required. Surveillance audits verify ongoing ISMS operation and compliance.
What happens if we fail the Stage 2 audit?
Minor nonconformities allow certificate issuance with corrective action required within 90 days. Major nonconformities prevent certification until remediated and re-audited. Tranquility preparation has supported 1,000+ audits to date.
Keep Exploring
Related Reading.
ISO 27001
Who Needs ISO 27001?
No law mandates it universally — who actually needs certification, and what triggers it.
Read moreISO 27001
ISO 27001 Knowledge Hub
All 93 Annex A controls, all clauses, every guide in the cluster.
Read moreISO 27001
ISO 27001 Clauses (4–10)
All 23 ISMS clauses explained — from context to continual improvement.
Read moreISO 27001
ISO 27001 Controls Library
Browse all 93 Annex A controls with implementation guidance.
Read moreISO 27001
ISO 27001 Certification Guide
The step-by-step path from gap assessment to certificate.
Read moreISO 27001
ISO 27001 Cost Guide
What certification actually costs in India, by company size.
Read moreService
ISO 27001 Consulting in India
Fixed-fee, lead-auditor-run certification programs.
Read moreSOC 2
SOC 2 vs ISO 27001
The decision guide for US-bound vs global-bound trust evidence.
Read moreISO 22301
ISO 22301 vs ISO 27001
Continuity vs security — which to build first, and how to run both.
Read more