They expertly mapped the overlapping controls between SOC 2 and ISO 27001, which saved us from duplicating work.
Jasreet Kaur B.Silicon Physical Design Engineer · Small-BusinessSOC 2 + ISO 27001 · August 2026
ISO 27001:2022 Resource Hub
Your Complete Guide to
ISO 27001 Certification
Everything you need to achieve ISO 27001:2022 certification — from expert guides and implementation roadmaps to free templates and cost calculators.
Deep-dive guides for all 93 Annex A controls
Clause-by-clause guides to requirements 4–10
Mandatory documents checklist and templates
Cost breakdowns and certification roadmaps
Certified Lead Auditors, Any Accredited Body · 1,000+ Audits Across India, USA, UK, Australia and UAE
93Annex A ControlsEvery one explained
23Mandatory ClausesClause-by-clause guides
1,000+Audits DeliveredIndia, USA, UK, Australia & UAE
300+SOC 2 EngagementsTo date
The Short Answer
What is ISO 27001 and do you need it?
ISO/IEC 27001:2022 is the international standard for an Information Security Management System (ISMS) — the governance system of policies, risk assessments, and controls through which an organization manages information security. Certification is issued by an accredited certification body (CB) after a two-stage audit: Stage 1 reviews your documentation and readiness, and Stage 2 verifies the ISMS is implemented and operating. The 2022 revision restructured Annex A into 93 controls across four themes — organizational, people, physical, and technological — with 11 new controls covering threat intelligence, cloud security, and data leakage prevention.
You need ISO 27001 if buyers, partners, or regulators ask for proof of security governance — typical for IT/ITES companies, SaaS platforms selling outside the US, BFSI vendors, and any organization answering enterprise security questionnaires from European, Asian, or Middle Eastern customers. It is the most widely recognized security certification globally, and in India it is increasingly a tender prerequisite. Unlike SOC 2's attestation report, ISO 27001 yields a certificate that is valid for 3 years, maintained through annual surveillance audits — one audit cycle answers most security questionnaires for the next three years.
New to the standard? Start with what an ISMS is — the management system ISO 27001 certifies. A focused implementation reaches the Stage 2 audit in 3–6 months. In India, budget ₹1–3 lakh for ISO 27001 consulting, with the certification body's audit fee separate and indicative — our cost guide breaks down every line item. TCSA has delivered 1,000+ audits across India, USA, UK, Australia and UAE — review our proof of work or compare the top ISO 27001 consultants in India before selecting a partner.
Key Takeaways
- ISO 27001:2022 certifies your ISMS — an accredited certification body audits in two stages (Stage 1 documentation, Stage 2 implementation) and issues a certificate valid for 3 years with annual surveillance audits.
- Annex A now contains 93 controls in 4 themes (organizational, people, physical, technological), and you justify inclusions and exclusions in the Statement of Applicability.
- A focused implementation reaches Stage 2 in 3–6 months. Consulting in India typically costs ₹1–3 lakh, with certification body audit fees separate and indicative.
- TCSA has delivered 1,000+ audits across India, USA, UK, Australia and UAE to date.
Resource Hub
ISO 27001 Knowledge Center
This comprehensive resource hub brings together everything you need to understand, implement, and achieve ISO 27001:2022 certification. Whether you're just starting your ISMS journey or preparing for your certification audit, you'll find expert guides, practical templates, and detailed breakdowns of all requirements.
Our resources are created by certified Lead Auditors who coordinate with accredited bodies (TÜV SÜD, BSI, DNV) and have delivered 1,000+ audits across India, USA, UK, Australia and UAE to date. Each guide reflects real-world audit experience and methodologies that hold up under Stage 2 scrutiny.
Updated monthly with latest audit insights and control guidance
Core Resources
Essential ISO 27001 Guides
Comprehensive guides covering every aspect of ISO 27001 certification from initial gap analysis to post-certification maintenance.
Control Reference
Annex A Controls (All 93)
Every ISO 27001:2022 control with implementation steps, audit evidence, and practitioner FAQs.
Explore GuideRequirementsClauses 4–10 Explained
The mandatory requirements clause by clause — scope, leadership, risk, SoA, audits, and review.
Explore GuideChecklistMandatory Documents
Every document and record ISO 27001:2022 requires, mapped to its clause, with drafting guidance.
Explore GuideGuideWho Needs ISO 27001?
Not legally mandated — who actually needs certification and what triggers the requirement.
Explore GuideGuideHow Long Does Certification Last?
The 3-year cycle: annual surveillance audits, recertification, and what gets certificates suspended.
Explore GuideComparisonISO 27001 vs ISO 27002
Requirements vs implementation guidance — same 93 controls, one certifiable standard.
Explore GuideGuideIs Penetration Testing Required?
What A.8.8 actually demands, what auditors ask for, and when a pentest is unavoidable.
Explore GuideProcess GuideCertification Guide
What to expect during Stage 1, Stage 2, and surveillance audits.
Explore GuideImplementation GuideISMS Implementation
Step-by-step roadmap for implementing your Information Security Management System.
Explore GuideCost GuideCertification Costs
Breakdown of consulting, audit, and implementation costs for ISO 27001 certification.
Explore GuideResourcesTemplates & Downloads
Free ISO 27001 templates, checklists, and policy frameworks.
Explore GuideISO 27001:2022 Requirements
Core Certification Clauses
Understanding the mandatory requirements of ISO 27001:2022 from context establishment through continual improvement.
4.1Understanding the organization and its context4.2Understanding the needs and expectations of interested parties4.3Determining the scope of the ISMS4.4Information security management system5.1Leadership and commitment5.2Information security policy5.3Organizational roles, responsibilities and authorities6.1Actions to address risks and opportunities6.2Information security objectives and planning to achieve them6.3Planning of changes7.1Resources7.2Competence7.3Awareness7.4Communication7.5Documented information8.1Operational planning and control8.2Information security risk assessment8.3Information security risk treatment9.1Monitoring, measurement, analysis and evaluation9.2Internal audit9.3Management review10.1Continual improvement10.2Nonconformity and corrective action
ISO 27001:2022 Annex A Controls
93 Security Control Objectives
Comprehensive security controls organized into organizational, people, physical, and technological categories.
Organizational Controls (A.5.1 – A.5.37)
37 controls — every one links to a full implementation guide.
A.5.1Policies for information securityA.5.2Information security roles and responsibilitiesA.5.3Segregation of dutiesA.5.4Management responsibilitiesA.5.5Contact with authoritiesA.5.6Contact with special interest groupsA.5.7Threat intelligenceNew in 2022A.5.8Information security in project managementA.5.9Inventory of information and other associated assetsA.5.10Acceptable use of information and other associated assetsA.5.11Return of assetsA.5.12Classification of informationA.5.13Labelling of informationA.5.14Information transferA.5.15Access controlA.5.16Identity managementA.5.17Authentication informationA.5.18Access rightsA.5.19Information security in supplier relationshipsA.5.20Addressing information security within supplier agreementsA.5.21Managing information security in the ICT supply chainA.5.22Monitoring, review and change management of supplier servicesA.5.23Information security for use of cloud servicesNew in 2022A.5.24Information security incident management planning and preparationA.5.25Assessment and decision on information security eventsA.5.26Response to information security incidentsA.5.27Learning from information security incidentsA.5.28Collection of evidenceA.5.29Information security during disruptionA.5.30ICT readiness for business continuityNew in 2022A.5.31Legal, statutory, regulatory and contractual requirementsA.5.32Intellectual property rightsA.5.33Protection of recordsA.5.34Privacy and protection of PIIA.5.35Independent review of information securityA.5.36Compliance with policies, rules and standards for information securityA.5.37Documented operating procedures
People Controls (A.6.1 – A.6.8)
8 controls — every one links to a full implementation guide.
A.6.1ScreeningA.6.2Terms and conditions of employmentA.6.3Information security awareness, education and trainingA.6.4Disciplinary processA.6.5Responsibilities after termination or change of employmentA.6.6Confidentiality or non-disclosure agreementsA.6.7Remote workingA.6.8Information security event reporting
Physical Controls (A.7.1 – A.7.14)
14 controls — every one links to a full implementation guide.
A.7.1Physical security perimetersA.7.2Physical entryA.7.3Securing offices, rooms and facilitiesA.7.4Physical security monitoringNew in 2022A.7.5Protecting against physical and environmental threatsA.7.6Working in secure areasA.7.7Clear desk and clear screenA.7.8Equipment siting and protectionA.7.9Security of assets off-premisesA.7.10Storage mediaA.7.11Supporting utilitiesA.7.12Cabling securityA.7.13Equipment maintenanceA.7.14Secure disposal or re-use of equipment
Technological Controls (A.8.1 – A.8.34)
34 controls — every one links to a full implementation guide.
A.8.1User endpoint devicesA.8.2Privileged access rightsA.8.3Information access restrictionA.8.4Access to source codeA.8.5Secure authenticationA.8.6Capacity managementA.8.7Protection against malwareA.8.8Management of technical vulnerabilitiesA.8.9Configuration managementNew in 2022A.8.10Information deletionNew in 2022A.8.11Data maskingNew in 2022A.8.12Data leakage preventionNew in 2022A.8.13Information backupA.8.14Redundancy of information processing facilitiesA.8.15LoggingA.8.16Monitoring activitiesNew in 2022A.8.17Clock synchronizationA.8.18Use of privileged utility programsA.8.19Installation of software on operational systemsA.8.20Networks securityA.8.21Security of network servicesA.8.22Segregation of networksA.8.23Web filteringNew in 2022A.8.24Use of cryptographyA.8.25Secure development life cycleA.8.26Application security requirementsA.8.27Secure system architecture and engineering principlesA.8.28Secure codingNew in 2022A.8.29Security testing in development and acceptanceA.8.30Outsourced developmentA.8.31Separation of development, test and production environmentsA.8.32Change managementA.8.33Test informationA.8.34Protection of information systems during audit testing
Best of the Blog
Expert Insights & Guides
In-depth articles covering ISO 27001 implementation, cost analysis, and strategic security management.
Article
What is an ISMS and Why Every Business Should Have One
Understanding the fundamentals of Information Security Management Systems from an auditor's perspective
Read the articleArticleUnpacking the Cost vs ROI of Achieving ISO 27001 Certification
A comprehensive breakdown of certification costs and the tangible and intangible returns organizations can expect
Read the articleArticleInformation Security Management: Roadmap to Growth
Strategic approach to building security foundations
Read the articleISO 27001 by Industry
Tailored Compliance Solutions
Industry-specific guidance for implementing ISO 27001 in your sector with relevant examples and best practices.
ISO 27001 in India
How India’s regulators treat ISO 27001.
SEBI’s CSCRF requires ISO 27001 for some entities. For RBI, IRDAI, CERT-In and the DPDP Act it counts as evidence, and each asks for more than an ISMS shows. Start with the map, then read the crosswalk for your regulator.
The map
Which Indian regulators expect ISO 27001
SEBI, RBI, IRDAI, CERT-In, DPDP and UIDAI in one table: where ISO 27001 is a mandate, evidence or adjacent.
Read the guideRBIISO 27001 for RBI-regulated entities
How an ISMS maps to RBI’s cyber security directions for banks and NBFCs, and what it cannot evidence.
Read the guideSEBIISO 27001 for SEBI CSCRF
Who must certify under CSCRF and what the certificate’s scope has to cover.
Read the guideIRDAIISO 27001 under IRDAI’s 2026 guidelines
What the 2026 guidelines ask of insurers and intermediaries, and the audit waiver for vendors whose ISO 27001 certificate covers the service.
Read the guideCERT-InCERT-In directions and ISO 27001
Six-hour incident reporting, 180-day log retention and clock sync, mapped to ISO 27001 controls.
Read the guideDPDP ActDoes ISO 27001 cover the DPDP Act?
What your ISMS already evidences under the DPDP Act, and the duties it does not cover.
Read the guideProof
In their words.
Quotes verbatim from G2. Company names added where the client confirmed them.
Instead of simply providing generic templates or checklists, their team took the time to understand our environment and requirements.
Anand .Market Risk Analyst · Mid-MarketCompliance readiness · September 2026
The team’s willingness to work with us and ease of communication.
sam v.CEO · Small-BusinessSOC 2 Type I + ISO 27001 · August 2026
They delivered the project with speed, accuracy, and cost-effectiveness.
Maneet P.Mid-MarketSOC 2 · August 2026
My only regret is that we didn’t engage them sooner in our compliance journey, which would have saved us even more time.
Mahesh Raju C. · XonarSmall-BusinessSOC 2 · GRC · August 2026
They were always responsive and willing to go the extra mile whenever we had questions or needed guidance.
Chandan J. · DsiderSmall-BusinessSOC 2 Type I · August 2026
Managing the auditor relationship on our behalf was especially valuable — it took a lot of pressure off our internal team.
Achyut B.Senior Software Engineer · Small-BusinessSOC 2 + ISO 27001 · September 2026
Their focus on ensuring that we were genuinely audit-ready rather than simply completing documentation.
Ravi V.Founder & CEO · Mid-MarketSOC 2 Type II · August 2026
The guidance was not generic or simply based on a standard checklist — they suggested practical approaches that made sense for our business.
Verified UserInternational Trade and Development · Small-BusinessSOC 2 + ISO 27001 · September 2026
What I like best is the hands-on support and clear guidance throughout the SOC 1 and SOC 2 process.
Sai Sudha S. · ExcersSmall-BusinessSOC 1 + SOC 2 · September 2026
ISO 27001 Frequently Asked Questions
Direct answers from certified lead auditors who have delivered 1,000+ audits.
How much does ISO 27001 certification cost in India?
ISO 27001 consulting typically costs ₹1–3 lakh in India, depending on company size, scope, and existing security maturity. The certification body’s fees for Stage 1, Stage 2, and annual surveillance audits are separate and indicative — they scale with headcount and the number of sites. Budget the full three-year certificate cycle, not just year one.
How long does ISO 27001 certification take?
Most organizations reach the Stage 2 certification audit in 3–6 months: gap assessment (1–2 weeks), risk assessment and ISMS documentation (4–8 weeks), control implementation and evidence build-up (6–10 weeks), then an internal audit and management review before the certification body audits. Companies with mature controls can compress this, while complex multi-site scopes take longer.
What changed in ISO 27001:2022?
Annex A was restructured from 114 controls in 14 domains to 93 controls in 4 themes — organizational, people, physical, and technological — with 11 new controls including threat intelligence (A.5.7), cloud services security (A.5.23), and data leakage prevention (A.8.12). All new certificates are issued against the 2022 revision. The transition window for older 2013 certificates closed on 31 October 2025.
Do I need a consultant for ISO 27001?
It is not mandatory, but first-time implementations benefit heavily. The standard requires a risk assessment, a Statement of Applicability across all 93 Annex A controls, and an internal audit before certification — slow work to learn from scratch, and the source of most Stage 2 nonconformities. Note that accredited certification bodies cannot consult and certify the same client, so the consulting and certification roles are always separate.
How long is an ISO 27001 certificate valid?
Three years. The certification body conducts surveillance audits in years 1 and 2, and a full recertification audit in year 3. Missing a surveillance audit can suspend the certificate, so internal audits, management reviews, and risk-assessment updates become an annual rhythm.
What happens in Stage 1 vs Stage 2 of the audit?
Stage 1 is a documentation and readiness review: the auditor checks your ISMS scope, policies, risk assessment, and Statement of Applicability, and flags gaps to fix. Stage 2, usually a few weeks later, is the implementation audit — evidence sampling, staff interviews, and control walkthroughs. Clear Stage 2 with no major nonconformities and the certification body issues your certificate.
Get Started Today
Ready to Achieve ISO 27001 Certification?
Work with certified lead auditors who coordinate with accredited bodies (TÜV SÜD, BSI, DNV). 1,000+ audits delivered across India, USA, UK, Australia and UAE.
- Free initial consultation and gap analysis
- Custom implementation roadmap for your organization
- Transparent pricing with no hidden costs
What You'll Get
Gap Analysis Report
Detailed assessment of current state
ISMS Documentation
Complete policies and procedures
Dedicated Consultant
Expert guidance throughout
Certification Support
Stage 1 & 2 audit preparation
Keep Exploring
Related Reading.
ISO 27001
ISO 27001 Overview
The ISMS standard — the baseline certificate global buyers ask for.
Read moreISO 27001
ISO 27001 Controls Library
Browse all 93 Annex A controls with implementation guidance.
Read moreISO 27001
ISO 27001 Clauses (4–10)
All 23 ISMS clauses explained — from context to continual improvement.
Read moreISO 27001
ISO 27001 Certification Guide
The step-by-step path from gap assessment to certificate.
Read moreISO 27001
Annex A Controls Overview
All 93 controls across organizational, people, physical and tech domains.
Read moreISO 27001
ISO 27001 Templates
ISMS policy templates, SoA workbook, risk register, and audit checklists.
Read more