ISO/IEC 27001:2022 is the international standard for information security management systems. It requires an organisation to assess information security risks, select and implement controls from the 93 controls in Annex A, run them, measure them and improve. It is the certification most often demanded by enterprise customers, BFSI clients and public-sector buyers of IT, BPO, SaaS and data-handling services, and the practical foundation for compliance with the Digital Personal Data Protection Act, 2023 and CERT-In directions.
Legal basis: ISO/IEC 27001:2022 (voluntary international standard) with ISO/IEC 27002:2022 controls; supports obligations under the Digital Personal Data Protection Act, 2023, Section 43A of the IT Act, 2000 (reasonable security practices), the CERT-In directions of April 2022 and sector frameworks such as SEBI's CSCRF and RBI's cyber security guidelines
Who needs it
- IT services, software, SaaS and cloud companies whose customers and investors require certified security
- BPO, KPO and shared-service centres handling client or personal data
- Fintech, NBFC, insurance and healthcare organisations under RBI, IRDAI and SEBI cyber security expectations
- Manufacturers and exporters whose OEM customers now audit supplier information security
- Any organisation processing personal data at scale that must show reasonable security safeguards under the DPDP Act
- Companies whose ISO/IEC 27001:2013 certificates expired with the transition deadline of 31 October 2025
Documents required
- 1Organisation chart, business processes and list of information assets, systems and locations in scope
- 2Network architecture, cloud and hosting arrangements and list of critical applications
- 3Existing information security policies, procedures and access control documentation
- 4Risk assessment and risk treatment records, if any, and previous audit or penetration test reports
- 5Vendor and cloud service contracts and data processing agreements
- 6Incident records, business continuity plans and backup / DR test evidence
- 7HR security records: background checks, confidentiality agreements and awareness training
- 8Customer security requirements, questionnaires and regulatory correspondence
Missing something? We help you obtain or regularise supporting documents before filing.
How we get it done
- 1
Scoping and asset inventory
Day 1–10We define the ISMS scope, inventory information assets and systems, and review existing controls against the 2022 edition.
- 2
Risk assessment and Statement of Applicability
Day 7–30Threats and vulnerabilities are assessed per asset, risks are rated and treated, and the Statement of Applicability selects and justifies Annex A controls.
- 3
Policies, controls and implementation
Day 25–70Security policies, access, cryptography, supplier, incident, continuity and technical controls are documented and implemented with your IT team.
- 4
Monitoring, internal audit and management review
Day 65–95Controls operate and are measured, awareness training runs, and our auditor conducts the internal audit and management review.
- 5
Certification audit
Day 90–120We attend the Stage 1 and Stage 2 audits, close findings and the ISO/IEC 27001:2022 certificate is issued with surveillance dates in your calendar.
If you skip certification
ISO 27001 is voluntary, but the laws it helps satisfy carry real penalties: the DPDP Act, 2023 provides for penalties of up to ₹250 crore for failing to take reasonable security safeguards, Section 43A of the IT Act creates compensation liability for negligent handling of sensitive data, and CERT-In requires incident reporting within six hours. Commercially, uncertified providers fail customer security reviews, lose BFSI and government tenders that specify ISO 27001 and face far higher costs after a breach.
Why MYDA Group
Specialists, not generalists
Environmental compliance is our only practice, so your file is handled by people who do this every day.
Fixed fee, written scope
You know the professional fee and the statutory fees before we start. No surprise add-ons.
Inspection and audit-ready
We prepare your site and team for the board visit or certification audit and attend it with you.
Lifetime reminders
Every condition, return and renewal goes into your compliance calendar with alerts.
Frequently asked questions
What changed in the 2022 version?
Annex A was restructured from 114 controls in 14 domains to 93 controls in four themes (organisational, people, physical, technological), with 11 new controls covering cloud services, threat intelligence, data masking, monitoring and secure coding. Certificates to the 2013 version expired on 31 October 2025, so all new implementations are to the 2022 edition.
How does ISO 27001 relate to the DPDP Act?
The DPDP Act requires data fiduciaries to implement reasonable security safeguards and to notify breaches. It does not name ISO 27001, but a certified ISMS is the most widely accepted evidence of reasonable safeguards and gives you the incident process the Act and CERT-In require.
Is ISO 27001 only for IT companies?
No. Any organisation with confidential, personal or customer data benefits, and manufacturers increasingly face OEM supplier security audits. The scope can be limited to specific business units or systems.
Should we also get SOC 2?
If your customers are predominantly in the United States they may ask for a SOC 2 report, which is an attestation rather than a certification. The control set overlaps heavily with ISO 27001; we design the ISMS so that a SOC 2 readiness project reuses the same evidence.