Delhi NCR
ISO 27001 Consultant in Delhi NCR
SecureRoot Risk Advisory LLP runs ISO 27001 programmes for companies across Noida, Gurugram, Delhi, Faridabad and Ghaziabad from its branch office in Greater Noida West. One team scopes the ISMS, builds it with you and sits in the audit. SecureRoot is not an accredited ISO certification body: your certificate comes from the body you contract, and its fee is its own line.
The short answer
ISO 27001 consulting for Delhi NCR, delivered from Greater Noida West
SecureRoot Risk Advisory LLP takes a Noida, Gurugram, Delhi, Faridabad or Ghaziabad company from gap assessment to an ISO/IEC 27001:2022 certificate, usually in 4 to 7 months. The total to certificate sits in a published band of ₹1.5 lakh to ₹8 lakh, which counts our programme and the certification body’s audit together. Our own fee is fixed in writing after one scoping call. Workshops, the internal audit and Stage 2 happen at your office; the rest runs remotely, in your working hours.
The standard itself and our six-phase method are on the ISO 27001 certification service page; every service we run in the region is on our Delhi NCR overview.
On the ground
Which days happen in your office, and which run remotely?
Most ISMS work is desk work, done from our branch. Four kinds of day need a consultant in your building, and the scoping call books them in advance.
- The gap workshop. Half a day to a day with IT, HR, admin, engineering and contracts. We also walk the floor for the A.7 physical controls: the server room, the visitor log, clear desks and media disposal.
- The risk workshop. Clause 6.1.2 asks you to identify risks to information, not to tick controls. That goes faster with the people who know where the data actually sits.
- The internal audit. Clause 9.2 interviews and evidence sampling across each function in scope, usually one to two days.
- Stage 2. The certification body's auditor interviews your control owners. We sit beside you and fetch the evidence when it is asked for.
A-608, Tower-4, NX ONE, Plot No. 17,
Tech Zone IV, Amrapali Dream Valley, Sector 4,
Greater Noida West (Noida Extension), Greater Noida,
Gautam Buddha Nagar, Uttar Pradesh 201318, IN
Noida and Ghaziabad are short trips from the branch. Delhi, Gurugram and Faridabad are a planned drive, so a day there is a full working session rather than a drop-in. Those days are named in the written scope and sit inside the fixed price, whichever city you are in. We keep no office in Delhi, Gurugram, Faridabad or Ghaziabad, and this page does not pretend otherwise.
Across the region
Who asks for ISO 27001 in Delhi NCR, and what it changes in scope
| Area | Typical buyer | What usually starts it | What it changes in the ISMS |
|---|---|---|---|
| Noida and Greater Noida | IT services, SaaS, BPO and KPO exporters | A customer contract or RFP names the standard; a client audits the delivery centre | A clean scope boundary (clause 4.3) on shared, multi-client floors; A.7 physical controls; A.5.19 to A.5.23 for subcontractors |
| Gurugram | Fintechs, NBFCs, lenders and captive centres of global firms | RBI or SEBI expectations; a parent company's security review | Logging (A.8.15) and clock synchronisation (A.8.17) evidence; incident controls A.5.24 to A.5.28 set to a six-hour reporting clock |
| Delhi | Government and PSU suppliers, institutions, hospitals | A tender qualification; a DPDP Act programme that needs a security system underneath | Older estates in scope; network segregation (A.8.22) and configuration review before any documentation |
| Faridabad and Ghaziabad | Manufacturers with plant networks, logistics, auto-component suppliers | An OEM customer's supplier security requirement | Whether the plant network is inside the boundary; A.8.22 and A.7 carry most of the weight |
Regulators
What CERT-In, the RBI and SEBI ask, and what a certificate answers
The CERT-In Directions of 28 April 2022 require listed incidents to be reported within six hours and logs kept for 180 days. Incident controls A.5.24 to A.5.28 and logging control A.8.15 are where that evidence lives in an ISMS.
For NBFCs, the RBI’s Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions, 2026 (RBI/DoS/2026-27/461, 31 July 2026) took effect on issue and repeal the earlier IT governance instructions. Chapter V reaches the Middle, Upper and Top layers, excluding Core Investment Companies. A proposal that cites only the 2023 Master Direction on IT governance (RBI/2023-24/107) was written before them. Neither text names ISO 27001; both expect governed controls that a certified ISMS helps you show.
SEBI’s CSCRF (SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113, 20 August 2024) refers to ISO 27001 for some categories of regulated entity. Later clarifications, including the technical clarifications of 28 August 2025, decide whether yours must certify.
Under the DPDP Rules, 2025, the reasonable security safeguards in rule 6 apply from 13 May 2027. None of these instruments is satisfied by a certificate alone: the certificate shows the management system exists, and the clause is answered by the controls it governs.
The programme
How a Delhi NCR programme runs, and which phases need you in the room
| Phase | Weeks | What you hold at the end | Where it happens |
|---|---|---|---|
| 1. Scoping and gap assessment | 2 to 3 | Scope statement and gap assessment report | A workshop and walk-round at your site, then remote |
| 2. Risk assessment and treatment | 2 to 3 | Risk register, risk treatment plan, Statement of Applicability | One risk workshop at your site; the rest remote |
| 3. Control design and documentation | 3 to 4 | Policies and procedures, with a named owner for every control | Remote |
| 4. Implementation support | 6 to 12 | Controls running, with an evidence trail and training records | Remote, with working sessions beside your engineers |
| 5. Internal audit and management review | 2 to 3 | Internal audit report, review minutes, corrective actions | On-site interviews and sampling |
| 6. Certification | The body's calendar | Your ISO/IEC 27001:2022 certificate, issued by the certification body | Stage 1 may be remote, at the body's choice; Stage 2 at your site, with us present |
Phases overlap. Phases 1 to 5 add up to 15 to 25 weeks before the body's two stages; end to end, 4 to 7 months to a first certificate.
More on the phases
Our week-by-week certification timeline walks through each phase, and the clause-by-clause ISO 27001 checklist lists the evidence an auditor samples at each one.
What it costs
How much does an ISO 27001 consultant cost in Delhi NCR?
| Cost line | Who invoices it | What sets it | Figure |
|---|---|---|---|
| Our programme plus the body's Stage 1 and Stage 2 audit | Two invoices: SecureRoot for the programme, the accredited body for its audit | The ISMS boundary: sites, systems and people in scope, and how much already runs | Total budget, not our fee alone: ₹1.5 lakh to ₹8 lakh (band supplied 18 September 2026; $1,600 to $8,300 as of 2 October 2026), our programme plus the certification body's audit |
| Our fee on its own | SecureRoot | The same scope, plus the on-site days the scoping call names | Quoted in writing after scoping, and fixed for that scope |
| Surveillance audits, years two and three | The certification body | Its own audit days for a shorter visit | Quoted by the certification body |
| Our surveillance support | SecureRoot | Evidence upkeep between visits | Scoped, then quoted in writing |
| Recertification, at the end of year three | The certification body | The scope as it stands by then | Quoted by the certification body |
| Penetration test as A.8.8 evidence | SecureRoot, when we run it | The surfaces in scope and their size | ₹50,000 to ₹4 lakh per surface, retest included |
| Your own team's time | Nobody | How many controls already operate | No invoice; set by how many controls already operate |
You contract the certification body and it invoices you directly; we never collect or mark up its fee.
How the price is set
The price is fixed after scoping, never before, and the retest on any test we run is inside it. Our ISO 27001 cost breakdown for Indian companies goes further into what moves each line.
The certification body
Choosing a certification body: accreditation, edition, independence
- Check accreditation first. In India, NABCB, a constituent board of the Quality Council of India, accredits certification bodies. It is a signatory to the international recognition arrangement, formerly the IAF MLA. IAF ceased operations on 1 January 2026 and Global Accreditation Cooperation Incorporated took over its work, with existing recognition carried across. A body accredited by another signatory is equally acceptable.
- Insist on the 2022 edition. IAF MD 26 set 31 October 2025 as the end of the transition, after which ISO/IEC 27001:2013 certificates were to expire or be withdrawn. A certificate issued now should name ISO/IEC 27001:2022.
- Keep the body independent. ISO/IEC 17021-1 bars an accredited body from consulting on a system it certifies. SecureRoot is not an accredited ISO certification body and does not issue certificates; the body you contract does. We can introduce bodies; you sign with one directly.
- Verify before you sign. Find the body on NABCB’s directory with ISMS in its scope, then look up a certificate it has issued on IAF CertSearch. The body sets its audit days under ISO/IEC 27006-1 from your headcount and complexity, which is why its fee is quoted apart from ours.
Shortlisting consultants as well? Our guide on how to choose an ISO 27001 consultant lists the questions to ask and the red flags to walk away from.
Testing inside the ISMS
Control A.8.8 and the test evidence auditors look for
Control A.8.8 asks you to manage technical vulnerabilities, and a penetration test scoped to your Statement of Applicability is evidence an auditor can sample against it. We scope it on the same call as the programme, so it lands before Stage 2 and feeds the risk register. Critical findings reach you within three hours of discovery, each finding carries a proof of concept and a fix, and the retest is inside the price. For testing on its own, see penetration testing in Noida.
SecureRoot is not CERT-In empanelled. Where an empanelled auditor's signature is required on a VAPT report, that auditor signs. We test earlier, so the controls already work when that auditor looks.
What you receive
What you hold when the programme ends
- A scope statement and gap assessment report, with the on-site day plan for your NCR sites
- A risk register, risk treatment plan and Statement of Applicability
- An ISMS policy and procedure set, with a named owner for every control
- Controls operating with an evidence trail the auditor can follow
- An internal audit report and management review record
- Support at Stage 1 and Stage 2, in person for Stage 2
A redacted sample report is available on request before anything is signed; it is not published. Our case studies include a SaaS platform that reached SOC 2 Type II with zero audit exceptions, sixteen weeks to audit-ready. That is one engagement, not a quote, and a different framework. SecureRoot is not a CPA firm. If your customers also want SOC 2, a licensed CPA firm issues that report. Which to start with is set out in ISO 27001 against SOC 2.
Questions
What Delhi NCR buyers ask about ISO 27001
- How much does an ISO 27001 consultant cost in Delhi NCR?
- SecureRoot publishes one ISO 27001 figure: ₹1.5 lakh to ₹8 lakh in total to reach certification, a band supplied on 18 September 2026. It counts two things together. One is our programme, from gap assessment to audit support. The other is the accredited certification body's Stage 1 and Stage 2 audit, which you contract and pay directly. We do not publish our fee on its own; it is quoted in writing after scoping and fixed for that scope. A single-office Noida software company with some controls already running sits near the bottom. A Gurugram group with several sites and nothing documented sits near the top. Surveillance audits in years two and three are quoted by the certification body and sit outside the band. There is no NCR premium: on-site days anywhere in the region are named in the scope, not billed later.
- Do you have an office in Delhi, Gurugram or Noida?
- Our office in the region is the branch in Greater Noida West, with the full address printed on this page and on our contact page. Our registered office is in Kanpur. We do not have an office in Delhi, Gurugram, Faridabad or Ghaziabad, and we will not list one. Every Delhi NCR ISO 27001 programme runs from the branch. Noida and Ghaziabad are short trips from it. Delhi, Gurugram and Faridabad are a planned drive, so a workshop or audit day there is booked as a full working session. The scoping call settles which days need a person in your building, usually the gap workshop, the risk workshop, the internal audit and Stage 2. Policy drafting, evidence review and risk-register sessions run remotely, in your working hours.
- How long does ISO 27001 certification take for a company in Noida or Gurugram?
- Usually 4 to 7 months to a first certificate, and your city is not what moves it. Our first five phases add up to 15 to 25 weeks; the sixth is the certification body's audit. Implementation support is the long one, six to twelve weeks, because access reviews, logging, supplier contracts and training have to produce evidence before an auditor can sample it. The certification body then runs Stage 1 and Stage 2 on its own calendar, so book its dates early. What stretches a Delhi NCR programme is practical. A shared delivery floor in Noida needs a clean scope boundary before anything else. A Gurugram lender may need its change process rebuilt before it can be audited. What shortens it is one named owner per control area, and evidence collected as each control runs rather than in the week before the audit.
- Who issues the ISO 27001 certificate, and can SecureRoot certify us?
- An accredited certification body issues it, after its own Stage 1 and Stage 2 audits, and it must stay independent of whoever built your management system. SecureRoot is not an accredited ISO certification body and cannot certify you. A consultant that built your controls and then certified them would be auditing its own work, which ISO/IEC 17021-1 forbids an accredited body from doing. Our part is the readiness work and the audit support: scoping, the gap assessment, the risk register, the Statement of Applicability, policies, implementation help, the internal audit and a seat beside you on audit days. We can introduce bodies accredited by NABCB or by another signatory to the international recognition arrangement, formerly the IAF MLA, and you contract with one directly. Check the body's accreditation before you compare fees.
- Will ISO 27001 satisfy RBI, SEBI or a government tender?
- It depends on which clause is asking, so read it before you buy. For NBFCs, the RBI's Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions, 2026 took effect on 31 July 2026. They expect governed security controls and do not name ISO 27001, so a certified ISMS is good evidence rather than the answer itself. SEBI's CSCRF refers to ISO 27001 for some categories of regulated entity, and later clarifications decide whether yours must certify, so check your category against the current text. If a Delhi tender lists ISO 27001 as a qualification, see whether the clause demands an accredited body or a particular scope. The CERT-In Directions of 28 April 2022 apply whether you are certified or not. Bring the clause to the scoping call and we will say what a certificate answers and what it does not.
Primary Sources
Where the Figures on This Page Come From
The regulator, accreditation and standards statements above come from these documents. Prices come from our own published bands, not from any of them.
- ISO/IEC 27001:2022 - Information security management systems (catalogue entry, Annex A and clauses 4 to 10)
International Organization for Standardization · Link checked 2026-10-16
- Directions under section 70B(6) of the IT Act, 2000, No. 20(3)/2022-CERT-In, 28 April 2022
Indian Computer Emergency Response Team (CERT-In), MeitY · Link checked 2026-11-10
- Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions, 2026 (NBFCs), RBI/DoS/2026-27/461, 31 July 2026
Reserve Bank of India · Link checked 2026-11-11
- Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices, RBI/2023-24/107, 7 November 2023
Reserve Bank of India · Link checked 2026-11-11
- Cybersecurity and Cyber Resilience Framework (CSCRF), SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113, 20 August 2024
Securities and Exchange Board of India · Link checked 2026-11-11
- Technical Clarifications to CSCRF, SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2025/119, 28 August 2025
Securities and Exchange Board of India · Link checked 2026-11-11
- Digital Personal Data Protection Rules, 2025: rule 6 and its commencement
Ministry of Electronics and Information Technology, Gazette of India · Link checked 2026-11-10
- Global Accreditation Cooperation Incorporated launch: IAF ceased operations on 1 January 2026, existing recognition carried over
International Accreditation Forum (archive site) · Link checked 2026-11-11
- IAF MD 26:2023, transition requirements for ISO/IEC 27001:2022 (2013 certificates expire or are withdrawn by 31 October 2025)
International Accreditation Forum · Link checked 2026-11-11
- Search accredited bodies
National Accreditation Board for Certification Bodies (NABCB) · Link checked 2026-11-10
- IAF CertSearch, the global database of accredited certifications
International Accreditation Forum · Link checked 2026-11-10
Tell us which clause, customer or tender started the search
You leave the scoping call with a written scope, the certification body’s fee as its own line, the on-site days named, and a fixed price for our part.