ISO 27001 Certification Process in India: Step by Step

Quick answer: The ISO 27001 certification process has ten steps: get management backing, define the scope, run a gap assessment, assess risks, write the Statement of Applicability and policies, implement controls, operate the ISMS and collect evidence, run an internal audit and management review, pass the Stage 1 and Stage 2 certification audits, then keep the certificate through yearly surveillance audits.

Many Indian companies are asked for ISO 27001 by a bank, a global client or a government tender, and then lose months. Some buy a pack of template policies that fall apart at the audit. Others keep delaying because the standard looks too big to start. Either way, the contract or tender that needed the certificate is put at risk.

The fix is a clear, step-by-step process: build an information security management system (ISMS) that matches how your business really works, run it for a while, and then have it audited by an accredited certification body. This guide explains the ISO 27001 certification process for companies in Mumbai, Pune and across India.

What ISO 27001 Certification Means

ISO/IEC 27001 is the international standard for an ISMS. The current edition is ISO/IEC 27001:2022, with a 2024 amendment that asks organisations to consider whether climate change is a relevant issue for their ISMS. The standard requires you to identify information security risks, choose controls to treat them and run a cycle of monitoring, audit and improvement.

Annex A of the 2022 edition lists 93 controls in four themes: organisational, people, physical and technological. You do not have to apply every control, but you must justify which ones apply and which do not in a Statement of Applicability.

The transition period for certificates issued against the older 2013 edition ended on 31 October 2025. If a supplier or partner still shows a 2013 certificate, ask for its 2022 certificate.

Why the Process Goes Wrong

Each of these problems is solved by a step in the process below.

• Template-only documentation: policies that do not match real practice are found out quickly by auditors.
• Scope that is too wide or too vague: trying to certify every office and system at once stretches the team and the budget.
• A one-time risk spreadsheet: the risk assessment is done once for the audit and never updated.
• Everything left to IT: HR, legal, facilities and business heads own many controls, and auditors will interview them.
• No evidence of operation: records created in the week before the audit do not show a working ISMS.

The Fix: The ISO 27001 Certification Process, Step by Step

The ISO 27001 certification process in India follows the same international steps as anywhere else. Work through them in this order.

1. Get management commitment: leadership must approve the project, name an owner and provide budget and staff time, because the standard requires top management involvement and auditors check it.
2. Define the scope: decide which locations, business units, processes and systems the ISMS covers, keeping the first scope narrow and clear so it can be expanded later.
3. Carry out a gap assessment: compare current practice with the clauses of the standard and the Annex A controls to see how much work is needed and set a realistic timeline.
4. Run a risk assessment: list information assets, identify threats and weaknesses, rate the risks and decide how to treat each one by reducing, avoiding, transferring or accepting it.
5. Prepare the Statement of Applicability and policies: record which controls apply, why and how they are implemented, and write policies that reflect real practice.
6. Implement the controls: put in place access reviews, multi-factor authentication, patching, logging, secure configuration, backup, supplier checks, awareness training and physical security.
7. Operate the ISMS and collect evidence: run the system for a period so there are real records such as training logs, access reviews, incident reports and change records.
8. Conduct an internal audit and management review: have trained staff or an independent auditor check that the ISMS works, then have management review the results and approve corrective actions.
9. Complete the certification audit: pass Stage 1, which reviews documents and readiness, and Stage 2, which tests whether controls actually operate, closing any major nonconformities before the certificate is issued.
10. Maintain the certificate: keep the ISMS running through surveillance audits in the second and third years and a recertification audit at the end of the three-year cycle.

Stage 1 vs Stage 2 Audit: What Changes

Many teams are surprised by how different the two certification audit stages are. The table below shows the difference.

Point	Stage 1 audit	Stage 2 audit
Purpose	Checks readiness and documentation	Checks that controls work in practice
Main focus	Scope, policies, risk assessment, Statement of Applicability	Evidence, interviews, sampling of records and systems
Who is involved	ISMS owner and core team	Process owners and staff across the scope
Typical outcome	List of gaps to close before Stage 2	Recommendation for certification, or nonconformities to close
Common reason for delay	Missing or generic documents	Controls exist on paper but records do not prove they run

Documents and Evidence Auditors Ask For

Keep these ready and current. Evidence should come from normal operations, not be created just for the audit.

• ISMS scope statement and information security policy.
• Risk assessment method, risk register and risk treatment plan.
• Statement of Applicability.
• Asset inventory covering hardware, software, data and cloud services.
• Access review records and joiner, mover and leaver logs.
• Training and awareness records for staff in scope.
• Incident log and records of how incidents were handled.
• Supplier security assessments and contract clauses.
• Internal audit report, corrective action log and management review minutes.

Technical evidence such as vulnerability scans and penetration test reports also helps. Our guide to VAPT services explains how to scope one.

Choosing a Certification Body

Select a certification body that is accredited for ISO/IEC 27001. In India, NABCB (the National Accreditation Board for Certification Bodies) accredits certification bodies, and bodies accredited by other recognised accreditation bodies are also used. Check that:

• The accreditation covers ISO/IEC 27001 and is current.
• The certificate can be verified on a public register.
• The auditors understand your industry.
• The body does not also offer to implement your ISMS, since that is a conflict of interest.

Be wary of offers of a certificate within days without a proper audit. Informed customers and tender committees often reject them.

Linking ISO 27001 With Indian Rules

An ISMS is a good framework for meeting Indian legal and regulatory needs, although certification alone does not prove compliance. Map these into your risk assessment and controls:

• CERT-In Directions of April 2022: reporting specified cyber incidents within 6 hours, synchronising clocks and keeping ICT logs for 180 days within India. See our CERT-In reporting checklist.
• Digital Personal Data Protection Act, 2023 and the DPDP Rules notified in November 2025: duties for processing personal data, including reasonable security safeguards, with phased timelines. Our DPDP compliance checklist covers the basics.
• Sector regulators: RBI, SEBI and IRDAI set their own cybersecurity requirements for regulated entities.
• Customer contracts: security clauses from clients, often stricter than the law.

Some government work also needs an audit by a CERT-In empanelled auditor, which is different from ISO certification. Our article on CERT-In empanelled security audits explains the difference.

Timeline and Cost Factors

Timelines depend on scope and maturity. A small, well-organised company with a narrow scope can often be ready in a few months, while larger or multi-site organisations take longer. Cost depends on scope size and headcount, the size of the gaps, tools needed such as endpoint protection, logging or backup, whether you use consultants for implementation and internal audit, and the certification body's audit days.

Frequently Asked Questions

How long does the ISO 27001 certification process take?

It depends on scope and current maturity. Small companies with good practices may be ready in a few months, while larger organisations usually need longer. The ISMS must also run for a period before the Stage 2 audit so there is evidence to check.

Is ISO 27001 mandatory in India?

No law makes it mandatory for all companies. Many clients, tenders and regulated sectors ask for it or for equivalent controls, so it is often a commercial requirement.

How long is an ISO 27001 certificate valid?

Usually three years, with surveillance audits during that period and a recertification audit at the end.

What is the difference between ISO 27001:2013 and 2022?

The 2022 edition restructures Annex A into 93 controls in four themes and adds new controls such as threat intelligence and secure coding. The transition period for 2013 certificates ended on 31 October 2025.

Can we get ISO 27001 for only part of the company?

Yes. The scope can cover selected locations, departments or services, as long as it is clearly defined and justified. Many firms start with a narrow scope and expand it later.

How Affix Center Can Help

Affix Center supports Indian companies through each stage of the ISO 27001 certification process, including gap assessment, risk assessment, policy writing, technical control implementation and internal audit readiness. Our cybersecurity and enterprise advisory teams focus on an ISMS your staff can run after the certificate arrives, not just a set of documents.

To plan your certification, speak with our team.