ISO 27001 Certification and ISMS Consulting

Indicative total: ₹1.5 lakh to ₹8 lakh to reach certification, covering both parts of the bill. The first is our consulting and implementation programme: gap assessment, risk assessment, control documentation, implementation support and internal audit. The second is the accredited certification body's Stage 1 and Stage 2 audit, which you contract and pay directly, and which is priced on organisation size and audit days rather than by us. Where you land between the two ends is scope: how many locations, systems and people sit inside the ISMS boundary, and how much of the groundwork already exists. A single office with one product sits near the bottom of the range; a multi-location operation starting from nothing sits near the top. Budget for a third cost no invoice shows, which is your own people's time producing evidence, running access reviews and sitting in auditor interviews. We scope all three before you commit, and confirm a fixed price once scoping is done, never before.

Four things, mainly. First, scope: how many sites, business units and systems sit inside the ISMS boundary. A single office with one product is a smaller programme than a multi-location operation, and scope is the one lever you fully control. Second, headcount, because awareness training, access reviews and role definitions all scale with people. Third, your starting point: if you already run structured access control, incident handling and vendor reviews, we build on them rather than starting from zero. Fourth, your choice of certification body, since audit fees vary between accredited bodies and rise with organisation size. Scope is worth dwelling on. An ISMS covering one product and one office costs materially less to certify and to sustain than one covering the whole company, and you can widen the boundary at a later surveillance visit once the system is running. We map all four in the scoping call so the quote reflects your situation, not a template.

Most organisations reach certification in three to six months, and our phases add up to that. Scoping and gap assessment takes two to three weeks, risk assessment and treatment another two to three, control design and documentation three to four, implementation support six to twelve, and internal audit and management review two to three, before the certification body runs Stage 1 and Stage 2. What moves the number is how many controls already exist and how quickly your control owners can produce evidence, not the size of the standard. A company already running change management, access reviews and logging is mostly documenting what it does. A company starting from nothing is building habits, and habits take calendar time, because an auditor wants to see them operating rather than written down. We give you a realistic timeline after the gap assessment.

The Statement of Applicability, usually shortened to SoA, is the document that lists every Annex A control, records whether you apply it, and explains the reasoning either way. It is the bridge between your risk assessment and your control set, which is why auditors read it first and keep returning to it. An exclusion is perfectly legitimate when you can justify it, so a company with no physical office can exclude some physical security controls, but it has to say so and say why. What fails an audit is an SoA claiming controls you cannot evidence, or one written once and never revisited after the environment changed. We build yours from the risk treatment plan so every inclusion traces back to a risk you actually identified, and we keep it current across the surveillance cycle.

Stage 1 is a documentation and readiness review. The auditor checks that your ISMS exists on paper: scope, policies, risk assessment, Statement of Applicability, internal audit records and management review minutes. It usually surfaces gaps you still have time to close. Stage 2 is the certification audit proper and it tests whether the controls operate in practice. The auditor samples evidence, interviews control owners, and looks for the distance between what your policy says and what your teams actually do. Findings are raised as minor or major nonconformities, and a major one has to be closed before the certificate issues. The two stages are usually separated by a few weeks so you can respond to Stage 1. We run an internal audit and management review first, which is the dress rehearsal, so Stage 2 holds no surprises.

ISO/IEC 27001:2022 lists 93 controls in Annex A, reorganised into four themes: organisational, people, physical and technological. That is down from the 114 controls across 14 domains in the 2013 version, and eleven of the 93 are new, covering areas such as threat intelligence, information security for cloud services, data masking and secure coding. The count matters less than people expect. You are not required to implement all 93. You are required to consider each one, decide whether it applies to your risks, and record that decision in the Statement of Applicability. The mandatory part sits outside Annex A altogether, in clauses four to ten: context, leadership, planning, support, operation, performance evaluation and improvement. Organisations that treat Annex A as a shopping list and skip the clauses are the ones that struggle at Stage 2.