ISO 27001: The Complete Guide for IT Companies

If you run a software, SaaS or IT services company, sooner or later a prospective client will send a security questionnaire with one question near the top: "Are you ISO 27001 certified?" This guide explains what ISO/IEC 27001 actually requires, how the 2022 edition and its 93 Annex A controls work, and how a small or mid-sized IT company can get certified without building a paperwork factory.

What is ISO 27001?

ISO/IEC 27001 is published jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). Its full title is Information security, cybersecurity and privacy protection: Information security management systems: Requirements. It specifies what an organisation must do to establish, implement, maintain and continually improve an ISMS.

Full form and definition

"ISO" is not an acronym for the standard; it refers to the standards body. "IEC" is the co-publisher. "27001" is the standard's number within the ISO/IEC 27000 family of information security standards. An ISMS is the set of policies, processes, roles, risk decisions and controls an organisation uses to manage information security in a systematic way.

What the standard is, and what it is not

• It is a management system standard. Clauses 4 to 10 describe how to govern security: context, leadership, planning, support, operation, performance evaluation and improvement. These clauses are mandatory for certification.
• It is risk-based. You decide which controls are needed based on your own risk assessment, and justify inclusions and exclusions in a Statement of Applicability.
• It is not a technical checklist. It does not say "use AES-256" or "patch within 14 days". It requires you to decide, document and evidence what is appropriate for your risks.
• It is not a law. Nobody fines you for not having it. But clients, tenders and some regulators treat it as a condition of doing business.

History and background of ISO 27001

ISO 27001 grew out of the British Standard BS 7799, first published by the UK's Department of Trade and Industry and BSI in 1995. Part 2 of BS 7799, which described a certifiable management system, became ISO/IEC 27001:2005. The control catalogue from BS 7799 Part 1 became ISO/IEC 17799 and later ISO/IEC 27002.

The standard was revised in 2013 to adopt ISO's common high-level structure for management systems (the same clause layout as ISO 9001 and ISO 22301) and to reduce Annex A to 114 controls. The current edition, ISO/IEC 27001:2022, was published in October 2022. It restructured Annex A into 93 controls grouped in four themes and added 11 new controls covering topics such as threat intelligence, cloud services and secure coding. In February 2024, Amendment 1 added a requirement to consider whether climate change is a relevant issue when determining the organisation's context (clauses 4.1 and 4.2).

Why was ISO 27001 introduced?

Before a common standard existed, every customer and partner asked different security questions and accepted different evidence. Businesses needed a shared, internationally recognised way to show that information security was managed deliberately, not by accident. A management system approach was chosen because technology changes faster than standards can: requiring a working risk process and continual improvement keeps the system relevant as threats change.

The 2013 to 2022 transition is over

The accreditation community gave certified organisations three years to move to the 2022 edition. The transition ended on 31 October 2025. Any certificate still issued against ISO/IEC 27001:2013 after that date is not valid, so if a supplier shows you a 2013 certificate today, ask questions.

Main objectives and purpose

ISO 27001 protects three properties of information, often called the CIA triad:

• Confidentiality: information is available only to authorised people and systems.
• Integrity: information is accurate and complete and is not altered without authorisation.
• Availability: information and systems are accessible when needed.

Beyond that, the standard aims to make security repeatable and accountable: risks are identified and owned, controls are chosen for a reason, top management is involved, and performance is measured and improved.

Who needs ISO 27001?

No law requires ISO 27001 certification in most countries. Organisations pursue it because someone they want to work with asks for it, or because it is the most efficient way to prove good security. In practice it is most common among:

• IT services, outsourcing and BPO companies handling client data or systems, especially those serving banks, insurers, healthcare and government.
• Software and SaaS vendors selling to enterprises in Europe, India, the Middle East and Asia, where ISO 27001 is often preferred over SOC 2.
• Cloud, hosting and data centre providers.
• Fintech and payment companies, where it complements PCI DSS and regulatory requirements.
• Companies bidding for government work, where tenders often list ISO 27001 as a qualification.

Which industries and businesses does it apply to?

It applies to organisations of any size, sector or country. A 15-person development agency can certify a narrow scope (for example "development and support of client web applications from our Pune office"), while a multinational can certify every site and service. The standard is equally used by service companies and product companies.

Geographical applicability and jurisdiction

ISO 27001 is international. Certificates issued by a certification body accredited by a member of the international accreditation arrangements (now coordinated by Global ACI, formed in January 2026 from IAF and ILAC) are recognised across member countries. In India, look for certification bodies accredited by NABCB or another recognised accreditation body. In some sectors, regulators reference it directly: for example, India's SPDI Rules 2011 under the IT Act name ISO/IEC 27001 as one way to show "reasonable security practices".

Key requirements: clauses 4 to 10

The mandatory part of ISO 27001 sits in clauses 4 to 10. Here is what each requires in practice for an IT company.

Clause 4: Context of the organisation

Identify internal and external issues that affect your ability to achieve the ISMS's intended outcomes (for example reliance on cloud providers, client contract terms, regulatory change, staff turnover, and, since 2024, whether climate change is relevant). Identify interested parties and their requirements (clients, regulators, staff, investors). Define the scope of the ISMS: which locations, services, teams and systems are in and which interfaces with out-of-scope parts exist.

Clause 5: Leadership

Top management must demonstrate commitment: approve an information security policy, assign roles and responsibilities, provide resources and make sure the ISMS is integrated into business processes. Auditors will interview leadership, not just the security lead.

Clause 6: Planning

This is the heart of the standard. You must:

• Define a risk assessment methodology with criteria for likelihood, impact and risk acceptance.
• Identify risks to confidentiality, integrity and availability, assign risk owners, analyse and evaluate them.
• Choose risk treatment options (modify, avoid, share, retain) and the controls needed, then compare them against Annex A to make sure nothing necessary was missed.
• Produce a Statement of Applicability (SoA) listing every Annex A control, whether it applies, whether it is implemented, and why.
• Write a risk treatment plan and get risk owners to approve it and accept residual risks.
• Set measurable information security objectives, and (since 2022) plan changes to the ISMS in a controlled way (clause 6.3).

Clause 7: Support

Provide resources, make sure people are competent for their roles, run awareness so staff know the policy and their responsibilities, define internal and external communication, and control documented information (versioning, approval, access and retention).

Clause 8: Operation

Run the processes you planned: perform risk assessments at planned intervals or when significant changes occur, implement the risk treatment plan, and control externally provided processes, products and services that are relevant to the ISMS (for example your cloud provider and outsourced developers).

Clause 9: Performance evaluation

Decide what to monitor and measure (for example patch compliance, phishing simulation click rates, access review completion), run an internal audit programme covering the whole ISMS, and hold management reviews with defined inputs and outputs.

Clause 10: Improvement

Handle nonconformities with corrective action that addresses root causes, and continually improve the suitability, adequacy and effectiveness of the ISMS.

Annex A controls explained

Annex A of ISO 27001:2022 lists 93 controls in four themes. ISO/IEC 27002:2022 gives implementation guidance for each one. Annex A is a reference list: you must consider every control, but you only implement those your risk assessment needs, and you justify exclusions in the SoA.

ISO/IEC 27001:2022 Annex A themes

Theme	Controls	Examples relevant to IT companies
A.5 Organisational	37	Policies, roles, threat intelligence (5.7), asset inventory, access control, supplier security, cloud services (5.23), incident management, ICT readiness for business continuity (5.30), legal and contractual requirements, privacy and PII protection
A.6 People	8	Screening, terms of employment, awareness and training, disciplinary process, confidentiality agreements, remote working, event reporting
A.7 Physical	14	Secure areas, physical entry, clear desk and screen, equipment siting, storage media, secure disposal, physical security monitoring (7.4)
A.8 Technological	34	Endpoint devices, privileged access, authentication, malware protection, vulnerability management, configuration management (8.9), information deletion (8.10), data masking (8.11), data leakage prevention (8.12), backup, logging, monitoring activities (8.16), web filtering (8.23), secure development lifecycle, secure coding (8.28), security testing, change management

The 11 controls new in 2022

Auditors focus on these because they did not exist in the 2013 edition: threat intelligence (5.7), information security for use of cloud services (5.23), ICT readiness for business continuity (5.30), physical security monitoring (7.4), configuration management (8.9), information deletion (8.10), data masking (8.11), data leakage prevention (8.12), monitoring activities (8.16), web filtering (8.23) and secure coding (8.28). For software companies, 8.25 to 8.29 (secure development lifecycle, application security requirements, secure architecture, secure coding and security testing) are usually the most scrutinised.

Control attributes

ISO 27002:2022 tags each control with attributes such as control type (preventive, detective, corrective), security properties, cybersecurity concepts aligned with the NIST CSF (identify, protect, detect, respond, recover) and operational capabilities. These are optional but useful for mapping ISO 27001 to the NIST Cybersecurity Framework or SOC 2.

How to implement ISO 27001: step by step

This sequence works for most IT companies with 20 to 500 people. Adjust the depth to your size.

1. Get leadership commitment and a sponsor. Agree why you are doing it (which clients or tenders), the budget and who owns it.
2. Define the scope. Start with the services clients ask about. A focused scope is faster to certify and can be extended later. Document boundaries and interfaces, including cloud platforms.
3. Run a gap assessment against clauses 4 to 10 and Annex A to see what already exists (most companies have more than they think: MFA, backups, code review).
4. Build an asset and information inventory: systems, repositories, cloud accounts, data types, and owners.
5. Define the risk methodology and run the risk assessment. Keep the method simple enough to repeat: a 5 by 5 likelihood and impact matrix is common.
6. Create the risk treatment plan and Statement of Applicability.
7. Write the policies and procedures you actually need (see the documentation list below). Prefer short, practical documents over long templates.
8. Implement and evidence the controls: access reviews, onboarding and offboarding checklists, vulnerability scanning, logging, secure development practices, supplier assessments, backup tests, incident drills.
9. Train everyone on the policy and their responsibilities, and keep records.
10. Operate the ISMS for at least a few months so you generate evidence: tickets, review records, scan reports, meeting minutes.
11. Run a full internal audit by someone independent of the work audited (an internal colleague from another team or an external auditor).
12. Hold a management review covering the required inputs, and record decisions.
13. Choose an accredited certification body and book Stage 1 and Stage 2 audits.
14. Close any nonconformities raised and receive the certificate.

Documentation and policies required

ISO 27001 lists mandatory documented information in its clauses. Annex A controls you choose add more. A typical set for an IT company:

Commonly required ISO 27001 documents and records

Mandatory by the clauses

Usually needed for Annex A controls

ISMS scope (4.3) Information security policy (5.2) Risk assessment process (6.1.2) Risk treatment process (6.1.3) Statement of Applicability (6.1.3 d) Information security objectives (6.2) Evidence of competence (7.2) Operational planning and control records (8.1) Risk assessment results (8.2) and treatment results (8.3) Monitoring and measurement results (9.1) Internal audit programme and results (9.2) Management review results (9.3) Nonconformities and corrective actions (10.2)

Asset inventory and acceptable use rules Access control policy and access review records Supplier security policy and supplier assessments Incident management procedure and incident log Business continuity and ICT readiness plans Legal, regulatory and contractual requirements register Secure development policy and secure coding standard Change management procedure Backup policy and restore test records Logging and monitoring standard Cryptography policy and key management HR security: screening, NDA, disciplinary process

Audit and assessment requirements

ISO 27001 requires two kinds of audit:

• Internal audits (clause 9.2) at planned intervals, covering the whole ISMS over the audit cycle, by auditors who are objective and impartial. Most small companies audit everything once a year.
• External certification audits by an accredited certification body, if you want a certificate.

Certification process

1. Stage 1 audit (documentation and readiness): the auditor reviews your scope, risk assessment, SoA, policies and whether you are ready for Stage 2. Often done remotely, one to two days for a small company.
2. Stage 2 audit (implementation): the auditor tests whether the ISMS operates as documented through interviews, sampling records and observing controls. Duration depends on headcount and complexity, following accreditation rules (IAF MD 5 historically).
3. Nonconformities: major nonconformities must be corrected before certification; minor ones need an accepted corrective action plan.
4. Certificate issued for three years.
5. Surveillance audits in years one and two after certification.
6. Recertification audit before the three years end.

Estimated implementation timeline

Typical ISO 27001 timelines (estimates)

Company profile	Preparation	Certification audits
10 to 50 staff, single office, cloud-hosted product	4 to 6 months	Stage 1 and 2 within 1 to 2 months
50 to 250 staff, a few sites, client-facing services	6 to 9 months	1 to 2 months
250+ staff, multiple sites or data centres	9 to 15 months	2 to 3 months

The fastest projects have an engaged sponsor, a narrow first scope and existing good practices to document. The slowest stall on risk assessment workshops and waiting for evidence to accumulate.

Cost considerations and factors affecting cost

There is no fixed price. Costs fall into four buckets:

• Certification body fees, driven by headcount in scope, number of sites and complexity. Expect Stage 1 and Stage 2 audit days plus surveillance and recertification days over the three-year cycle.
• Consulting or internal effort for gap assessment, risk assessment, documentation and internal audit. Many small companies use a consultant for part of the work and an internal owner for the rest.
• Tools: compliance automation platforms, policy management, vulnerability scanners, MDM, SIEM or log management, password managers.
• Control remediation: closing gaps such as missing MFA, endpoint protection, backups or penetration tests.

As a rough market indication only, small IT companies in India often report total first-year budgets in the low lakhs of rupees when much of the work is done internally, and US or European SaaS companies often report five-figure US dollar budgets once tools and consultants are included. Get at least three quotes from accredited certification bodies and ask consultants for a fixed scope.

Benefits of achieving ISO 27001

• Win and keep contracts: one certificate answers many security questionnaire sections and tender qualifications.
• Fewer incidents: systematic risk management, access reviews and patching reduce the chance and impact of breaches.
• Regulatory alignment: supports GDPR, DPDP Act, HIPAA and sector requirements that expect "appropriate" or "reasonable" security.
• Clear accountability: risk owners and management review make security a business process, not one person's job.
• Foundation for other standards: ISO 27701, ISO 22301 and ISO 42001 share the same structure.

Risks and consequences of non-compliance

Because ISO 27001 is voluntary, "non-compliance" means either not having it when clients expect it, or losing certification. Consequences include failed vendor assessments, lost tenders, contractual breaches if a client contract requires certification, and suspension or withdrawal of your certificate if major nonconformities are not corrected. Behind that sits the real risk the standard addresses: security incidents, data breaches and the fines and liabilities that follow under laws like the GDPR or India's DPDP Act.

Common implementation mistakes

• Buying a template pack and changing the logo. Auditors quickly spot policies that do not match how you work.
• Scoping too broadly at first, which multiplies evidence and audit days.
• Treating the risk assessment as a one-off spreadsheet rather than a living register.
• Excluding Annex A controls without justification in the SoA.
• No evidence of operation: controls exist on paper but tickets, logs and review records are missing.
• Leaving out suppliers and cloud services, although 5.19 to 5.23 explicitly cover them.
• Internal audits done by the person who built the ISMS, which fails the independence requirement.

Compliance challenges for IT companies

• Client environments: developers often work in clients' systems. Define where your responsibility starts and ends in contracts and in the scope.
• Remote and hybrid teams: endpoint management, secure remote access and clear-desk rules must work for home offices (control 6.7).
• Fast release cycles: change management and secure development controls need to fit CI/CD, for example approvals through pull requests and automated tests.
• Sub-contractors and freelancers: they need NDAs, onboarding, access control and offboarding like employees.
• Multi-cloud sprawl: keeping an accurate asset inventory across AWS, Azure, GCP and SaaS tools.

Best practices and recommendations

• Map controls to tools you already use (Git, Jira, Google Workspace or Microsoft 365, your cloud console) and collect evidence from them automatically where possible.
• Keep policies short and specific, written for your engineers.
• Build one control set that maps to ISO 27001, SOC 2 and the laws you face.
• Schedule recurring tasks (quarterly access reviews, annual risk assessment, backup restore tests) in a ticketing system so evidence is created automatically.
• Run a tabletop incident exercise before Stage 2.
• Choose an accredited certification body with experience in software and SaaS.

Tools and technologies that help

• Compliance automation / GRC platforms that track controls, policies, evidence and audits.
• Identity and access management: SSO, MFA, privileged access management.
• Endpoint management and EDR for laptops and servers.
• Vulnerability scanning and dependency scanning (SCA), plus SAST/DAST in pipelines.
• Logging and monitoring: centralised logs, SIEM or managed detection and response.
• Backup and disaster recovery with tested restores.
• Security awareness training and phishing simulation platforms. An LMS can deliver and track mandatory training records for auditors.

Relationship with other compliance frameworks

How ISO 27001 compares with related frameworks

Framework	Type	Relationship to ISO 27001
SOC 2	Attestation report (US CPA)	Large control overlap; SOC 2 tests operating effectiveness over a period and is preferred by US buyers. Many SaaS companies hold both.
ISO 27701	Certifiable privacy standard	Adds privacy management; since 2025 it can be certified standalone, but it is commonly combined with ISO 27001.
NIST CSF 2.0	Voluntary framework	Outcome framework; ISO 27002 attributes map controls to CSF functions.
CIS Controls	Voluntary framework	Prescriptive safeguards that can implement many Annex A technological controls.
ISO 22301	Certifiable continuity standard	Deepens Annex A 5.29 and 5.30; same management system structure.
PCI DSS	Industry standard	More prescriptive for card data; ISO 27001 does not replace PCI DSS validation.
GDPR / DPDP Act	Laws	ISO 27001 helps demonstrate appropriate security measures but is not proof of legal compliance.

Real-world implementation examples

The following scenarios are illustrative composites based on common patterns, not specific named companies.

A 40-person SaaS company selling to European banks

The company scoped its ISMS to "development, hosting and support of the platform", relying on its cloud provider's own certifications for the physical layer and excluding physical controls for data centres it does not operate (with justification). It used SSO and MFA everywhere, pull-request approvals as change management evidence, and quarterly access reviews tracked in its ticketing system. It reached Stage 2 in about seven months, with two minor nonconformities on supplier reviews and backup restore testing.

A 200-person IT services firm in India

Clients in banking required certification for offshore delivery centres. The firm scoped two delivery centres and the corporate IT team, added client-specific controls (segregated ODC networks, clean-room rules, device restrictions) to the risk treatment plan, and aligned incident reporting with the CERT-In six-hour rule. The ISMS also became the base for DPDP Act readiness.

Frequently asked questions

Is ISO 27001 mandatory?

No. It is a voluntary standard. It becomes effectively mandatory when a client contract, tender or regulator requires it.

How many controls are in ISO 27001:2022?

Annex A has 93 controls in four themes: 37 organisational, 8 people, 14 physical and 34 technological.

Do we have to implement all 93 controls?

No. You must consider all of them and justify in the Statement of Applicability why each one is included or excluded, based on your risk assessment and requirements.

How long is an ISO 27001 certificate valid?

Three years, subject to successful surveillance audits in the first and second years and a recertification audit before expiry.

What is the difference between ISO 27001 and ISO 27002?

ISO 27001 contains the certifiable requirements and the Annex A control list. ISO 27002 is guidance on how to implement those controls. You certify to 27001, not 27002.

Is ISO 27001:2013 still valid?

No. The transition to the 2022 edition ended on 31 October 2025, so 2013 certificates are no longer valid.

Can a small company get ISO 27001?

Yes. The standard is designed to scale. Small companies usually keep a narrow scope, simple risk methodology and lightweight documentation.

ISO 27001 or SOC 2: which should we get first?

Choose based on your customers. US enterprise buyers often ask for SOC 2; European, Indian, Middle Eastern and public-sector buyers often ask for ISO 27001. If both are needed, build one control set and certify both.

Does ISO 27001 cover cloud services?

Yes. Control 5.23 covers information security for use of cloud services, and ISO/IEC 27017 adds cloud-specific guidance.

Does ISO 27001 make us GDPR or DPDP compliant?

No. It helps show appropriate security measures, which both laws require, but privacy laws have many other duties such as lawful basis, notices, consent and data subject rights.

Who can perform the internal audit?

Anyone competent and impartial: a trained colleague who did not build or run the audited area, or an external auditor.

What happens if the auditor finds a major nonconformity?

Certification is delayed until you correct it and the certification body verifies the correction, usually within a defined period.

Do we need a penetration test for ISO 27001?

The standard does not explicitly require one, but controls on technical vulnerability management (8.8) and security testing (8.29) are typically evidenced with scans and periodic penetration tests, and auditors expect a risk-based justification.

Conclusion and next steps

ISO 27001 is the most widely recognised security certification in the world because it is flexible: it asks you to understand your risks and prove you manage them, rather than follow a fixed checklist. For an IT company, the practical path is a focused scope, a simple repeatable risk process, short policies that match reality, and evidence collected from the tools your teams already use.

1. List the clients and tenders asking for ISO 27001 and agree the scope that satisfies them.
2. Run a gap assessment against clauses 4 to 10 and Annex A.
3. Complete the risk assessment and Statement of Applicability.
4. Implement, evidence and internally audit for at least two to three months.
5. Book an accredited certification body for Stage 1 and Stage 2.

How we keep this guide up to date

We review this guide at least every six months and whenever ISO, IEC or the accreditation bodies announce changes (for example new amendments, a revision of ISO/IEC 27002, or transition rules). Each review checks the version, control counts, transition dates and links against ISO's official catalogue. The dates at the top and bottom of this page show when it was last reviewed and when the next review is due.