ISO 27001 — GRC RADAR
Published: 30 May 2026 · 16 min read · Category: ISO 27001
Introduction
If you run an Indian IT services firm, a SaaS company, a BPO, a fintech, or any enterprise-services business that touches global customer data, ISO 27001 is no longer a credential question — it is an access-to-market question. Enterprise procurement at Fortune 1000 buyers, government tenders, banking and insurance vendor onboarding, and EU/UK data processing engagements increasingly treat a current ISO 27001 certificate as table stakes. The certificate has shifted from a differentiator to a license to participate.
The standard you certify against is ISO/IEC 27001:2022, published on 25 October 2022 and amended in February 2024 to add climate change considerations. The earlier 2013 version is dead — the transition window closed on 31 October 2025, and any organisation still showing a 2013 certificate after that date is operating with an expired credential.
This ISO 27001 implementation guide India SME is written for the people who actually have to deliver it: founders and CISOs at 25-to-500 employee firms, compliance leads juggling DPDP and CSCRF alongside ISMS work, and IT heads who have been told “get us ISO 27001 by end of FY” without a budget calibrated to that ambition. We will cover what the 2022 standard is, what the 2024 climate amendment changes, how the 93-control Annex A actually breaks down, how ISO 27001 lands in the Indian regulatory stack (DPDP, SEBI CSCRF, CERT-In, RBI), the implementation runbook clause by clause, what certification really costs and takes in India, and where SMEs most commonly fail.
What ISO/IEC 27001:2022 Is — and What It Replaced
ISO/IEC 27001:2022 is the international standard that specifies the requirements for an Information Security Management System (ISMS). Its full title is “Information security, cybersecurity and privacy protection — Information security management systems — Requirements”. Two things matter about this title. First, the scope is explicitly cybersecurity and privacy — a deliberate broadening that aligns the standard with DPDP and GDPR-style obligations. Second, it remains a management-system standard, not a controls catalogue. Certification audits assess your governance and your risk-treatment process at least as rigorously as they assess specific technical controls.
The standard is structured in two halves. Clauses 4 through 10 are the mandatory ISMS requirements covering context, leadership, planning, support, operation, performance evaluation, and improvement. Annex A is a reference set of 93 controls drawn from ISO/IEC 27002:2022 (published 15 February 2022) that organisations must consider when selecting risk-treatment options. Annex A is referential, not prescriptive — you do not have to implement every control, but you do have to justify which ones you chose to apply and which ones you did not, in a Statement of Applicability (SoA).
The 2022 version superseded ISO/IEC 27001:2013. The two big practical differences: the controls were consolidated from 114 controls in 14 domains down to 93 controls in 4 themes, and 11 net-new controls were added covering threats and technologies that did not exist in their current form when the 2013 version was written.
The 31 October 2025 Transition — Now Past
The International Accreditation Forum’s Mandatory Document MD 26 (MD 26:2023, Issue 2) set 31 October 2025 as the cut-off date for transitioning existing ISO 27001:2013 certificates to the 2022 version. Certification bodies stopped issuing or renewing 2013 certificates well before that date and have not been able to conduct 2013-version audits since. As of today, an organisation showing an ISO 27001:2013 certificate is showing an expired credential. Any enterprise procurement, banking vendor onboarding, or SEBI/RBI/IRDAI registered-entity assessment that has not migrated its vendor-evidence template to the 2022 designation is itself behind.
For Indian SMEs that were on a 2013 certificate, the practical impact has played out one of three ways. Companies that planned the transition through their 2024 surveillance audit are now operating on 2022 certificates and on track. Companies that pushed it to the 2025 recertification cycle squeezed through. Companies that ignored the deadline lost certification and are now starting an effectively fresh certification cycle from scratch — typically 6 to 12 months of work — to win it back.
Amendment 1:2024 — Climate Change Considerations
On 23 February 2024, ISO published ISO/IEC 27001:2022/Amd 1:2024, a short but mandatory amendment. The amendment changes two pieces of the standard. Clause 4.1 (understanding the organisation and its context) now requires organisations to determine whether climate change is a relevant issue for the ISMS. Clause 4.2 (interested parties) carries a new note that relevant interested parties can have requirements related to climate change.
Two practical points. First, there is no separate transition period for the amendment — it applies from the date of publication, and certification bodies started checking for conformance at the next available surveillance or recertification audit through 2024 and 2025. If you are recertifying in 2026, your auditor will expect to see climate change addressed in your context analysis. Second, this is a context requirement, not a new Annex A control. The expected evidence is a documented assessment, in your context analysis or risk register, of whether climate-change-related risks (extreme heat affecting data centre cooling, monsoon flooding affecting facilities, cyclone-driven power outages, supplier-side climate disruption) are relevant to your ISMS scope. If you determine they are, treatment flows through your normal risk management process. If you determine they are not, you must document the reasoning. “Not applicable” is an acceptable conclusion if it is justified.
The 93 Controls and Four Themes — Annex A Structure
The Annex A structure in ISO 27001:2022 is the most visible change from 2013. The 93 controls are organised under four themes:
- A.5 Organizational controls (37 controls) — policies for information security, roles and responsibilities, segregation of duties, contact with authorities, threat intelligence, project management, asset management, classification, access control policy, supplier relationships, incident management, compliance, and the management system framework that wraps around them. This is where the standard lives — most SME implementation effort goes here.
- A.6 People controls (8 controls) — screening, terms and conditions of employment, awareness and training, disciplinary process, post-employment responsibilities, confidentiality agreements, remote working, and information security event reporting. Small in number, but high in audit attention because the evidence is human-readable and visible to non-technical auditors.
- A.7 Physical controls (14 controls) — perimeter security, secure areas, equipment placement, supporting utilities, cabling security, equipment maintenance, secure disposal, clear desk and screen, off-premises asset handling, and storage media management. Often heavily reduced in scope for fully cloud-native SMEs, but cannot be skipped entirely — even a remote-first company has employee laptops, home offices, and the question of how to destroy a returning laptop.
- A.8 Technological controls (34 controls) — user endpoint devices, privileged access rights, identity management, authentication, capacity management, malware protection, vulnerability management, network security, cryptography, secure development, change management, test data, application security, and information backup. The widest block by content, and the area where SaaS-tooling-heavy SMEs already have most of the substance but have not necessarily documented it.
The 11 new controls introduced in ISO 27002:2022 are worth memorising because they are the ones an auditor will probe most: threat intelligence, information security for use of cloud services, ICT readiness for business continuity, physical security monitoring, configuration management, information deletion, data masking, data leakage prevention, monitoring activities, web filtering, and secure coding. A 2013-era implementation that has not deliberately addressed these eleven is the implementation most likely to surface non-conformities at first surveillance.
The Indian Regulatory Context — BIS, NABCB, and What “Accredited” Means
The Bureau of Indian Standards has adopted ISO/IEC 27001:2022 as IS/ISO/IEC 27001:2022 under Technical Committee LITD 17, the Information Systems Security and Privacy Sectional Committee. The Indian Standard is identical to the international ISO/IEC version. For practical purposes, an organisation can pursue certification against either designation — the technical requirements are the same.
What matters more than the IS-vs-ISO designation is who is auditing you. In India, the National Accreditation Board for Certification Bodies (NABCB), operating under the Quality Council of India, accredits certification bodies for ISMS. NABCB is an IAF Multilateral Recognition Arrangement (MLA) signatory, which means a NABCB-accredited certificate is recognised globally by every other IAF-MLA accreditation body. The list of NABCB-accredited ISMS CBs is public at nabcb.qci.org.in.
When you choose a certification body, the only question that matters for GRC framework India compliance purposes is whether the CB is accredited by an IAF-MLA signatory — NABCB in India, UKAS in the UK, ANAB in the US, JAB in Japan, and so on. A certificate from an unaccredited CB will not be recognised by enterprise procurement, will not satisfy SEBI CSCRF for MIIs or Qualified REs, and will not be accepted as DPDP-relevant evidence by sophisticated counterparties. Cheap “ISO 27001 certificates” from unaccredited bodies are a recurring trap for first-time Indian SMEs and are routinely rejected at vendor due diligence.
Where ISO 27001 Lands in the Indian Regulatory Stack
ISO 27001 sits at the centre of a converging Indian compliance picture. Read in conjunction:
Digital Personal Data Protection Act, 2023. Section 8(5) requires Data Fiduciaries to take “reasonable security safeguards” to prevent personal data breaches. ISO 27001 certification is not legally mandated by the DPDP Act or the DPDP Rules 2025 (notified 13 November 2025 — Rule 6 lists security safeguards generically and does not name ISO 27001), but it is the most defensible single piece of evidence that a Data Fiduciary can produce to demonstrate reasonableness. For Indian SMEs handling personal data — and that is most of them — ISO 27001 is the closest thing to a safe-harbour signal that the statute allows.
SEBI CSCRF. Per the technical clarifications dated 28 August 2025 (Para 6.11), ISO 27001 certification is mandatory for Market Infrastructure Institutions (MIIs) but recommended — not mandatory — for Qualified Regulated Entities (QREs) (the clarifications expressly downgraded the Qualified-RE position from the base circular to “encouraged and recommended”). For Mid-size, Small-size, and Self-Certification REs it is voluntary. If you are an MII, ISO 27001 is effectively compulsory; if you are a Qualified RE it is strongly recommended but not compelled.
CERT-In. The 28 April 2022 Directions do not name ISO 27001 — nor do they use the phrases “industry standards” or “appropriate security controls”. They cover NTP time synchronisation, 6-hour incident reporting, 180-day log retention, and KYC/data-retention duties. ISO 27001 alignment is industry best practice, not a CERT-In Directions requirement — though CERT-In-empanelled auditors routinely package ISO 27001 readiness with their VAPT and compliance audits.
RBI Master Direction on IT Governance (RBI/2023-24/107, 7 November 2023). The Master Direction is framework-agnostic but draws its architecture from COBIT and ISO 27001. For Middle Layer NBFCs and smaller banks pursuing the RBI’s IT governance obligations, ISO 27001 is the natural underlying ISMS to host the controls the Master Direction expects.
The composite picture for Indian SMEs: ISO 27001 is statutorily mandatory for only a narrow slice of regulated entities (MIIs, QREs), but commercially mandatory across enterprise procurement, government tenders, and cross-border data engagements. Treating it as voluntary because it is not in the statute is the wrong frame.
The Implementation Runbook — Clauses 4 Through 10
The mandatory clauses are where audit findings cluster. A practitioner walk-through for a 50-to-300 employee Indian SME:
Clause 4 — Context. Document the internal and external issues relevant to the ISMS (now including the Amendment 1:2024 climate change question), the interested parties and their requirements (customers, regulators, employees, suppliers), and the precise scope of the ISMS. Scope-setting is the most common first-cycle failure: SMEs declare an over-broad scope to look impressive, then cannot evidence the scope they declared.
Clause 5 — Leadership. Top management must demonstrate commitment, approve the information security policy, and assign roles and responsibilities. The information security policy template India market is full of free templates — most are usable as a starting point but require adaptation to actually reflect your business. A policy lifted verbatim from a template and signed by a director who has not read it is a guaranteed non-conformity.
Clause 6 — Planning. This is where information security risk assessment and risk treatment live. You must establish a risk assessment methodology, conduct the risk assessment, define risk treatment options against the Annex A reference, and produce the Statement of Applicability — the single most-scrutinised document in your audit.
Clause 7 — Support. Resources, competence, awareness, communication, and documented information. Competence evidence — training records, role descriptions, certifications — is where SMEs underinvest.
Clause 8 — Operation. Operational planning and control, risk assessment performed at planned intervals, risk treatment implemented. This is the “do” of the management system.
Clause 9 — Performance evaluation. Monitoring, measurement, analysis, and evaluation; internal audit; management review. The ISO 27001 internal audit checklist India is not a separate artefact — it is a programme. You need an annual internal audit covering the ISMS and Annex A controls in your SoA, performed by someone independent of the area being audited, with documented findings and management response.
Clause 10 — Improvement. Nonconformity, corrective action, continual improvement. The audit looks for evidence of corrective action — a register of nonconformities raised internally, the root-cause analysis, the action taken, and the verification of effectiveness.
A working ISO 27001 checklist for small business maps to a minimum-credible documentation set for a first-cycle SME: information security policy, ISMS scope statement, risk assessment methodology and current assessment, Statement of Applicability, ISO 27001 ISMS policy template suite covering access control, acceptable use, supplier security, cryptography, secure development, incident response, business continuity, backup, and asset management, internal audit programme and reports, management review minutes, and a nonconformity register. Roughly 25–35 documents for a 100-person company, half that for a 25-person company.
Certification Process and Timeline
The certification journey for an Indian SME with no prior ISMS:
- Months 0–2 — Gap analysis against ISO 27001:2022. Most SMEs run this internally with a checklist or engage a CERT-In-empanelled or independent consultant.
- Months 2–5 — ISMS build. Policies, risk assessment, SoA, control implementation where gaps exist, training rollout.
- Months 5–7 — Operational evidence accumulation. The audit needs three months of operating evidence, including at least one internal audit cycle and one management review.
- Months 7–8 — Stage 1 audit (documentation review). The CB checks that the ISMS is designed correctly.
- Months 8–10 — Stage 2 audit (implementation audit). The CB tests whether what is documented is actually happening.
- Certificate issued — 3-year validity.
- Year 1, end — Surveillance audit (sampling-based).
- Year 2, end — Second surveillance audit.
- Year 3, before expiry — Recertification audit, similar in depth to Stage 2.
The honest answer to how long does ISO 27001 certification take for an Indian SME starting from a low base is 6 to 12 months. The 6-month timeline assumes a focused team, prior security maturity, and a small clean scope. The 12-month timeline is realistic for an SME with a sprawling estate, no prior ISMS work, and a part-time owner. Anyone promising a 3-month timeline is either selling you something or planning a thin implementation that will struggle at first surveillance.
ISO 27001 Certification Cost India — Realistic Ranges
The ISO 27001 certification cost India picture has three components that need to be sized separately. Certification body audit fees scale by scope size and the CB’s pricing tier. International CBs (BSI, Bureau Veritas, DNV, TÜV SÜD) sit at the premium end; NABCB-accredited Indian CBs sit a clear notch lower and the certificate is recognised identically.
Blended estimates for a first three-year cycle (consulting, internal effort opportunity cost, and CB audit fees combined):
- Small SME (under 50 employees, cloud-native, narrow scope): ₹2L–₹3L (CB audit fees alone typically run ₹1.5L–₹5L; the sub-₹2L end is realistic only for a very small, single-site, cloud-native scope)
- Mid-size SME (50–500 employees, mixed estate): ₹3L–₹8L
- Larger enterprise (500+, multi-location, multi-product): ₹10L+ scaling with scope
The wasted money in Indian implementations clusters around three patterns: paying premium fees to international CBs when a NABCB CB is fit for purpose, hiring a heavy consultancy to write generic templates when a senior internal hire would build a stronger ISMS, and buying ISMS automation tooling before the ISMS exists. The right sequence is build the ISMS, then automate the parts that recur.
ISO 27001 vs SOC 2 in the Indian Context
The ISO 27001 vs SOC 2 India comparison is mostly a question of who your buyers are. SOC 2 (an AICPA standard) is the dominant SaaS vendor-trust signal for US-headquartered enterprise buyers; ISO 27001 is the dominant signal for European, Indian enterprise, government, and global Fortune 500 procurement. Indian SMEs selling primarily to US tech buyers often pursue SOC 2 Type II first; SMEs selling to EU/UK/Indian/Japanese/Australian buyers go ISO 27001 first. Many mature SaaS companies eventually carry both. The technical overlap is substantial — a well-built ISO 27001 ISMS gets you 70-80% of the way to SOC 2 Type II evidence, but the audit form, opinion language, and renewal cadence differ.
Common SME Failure Modes
The pattern of first-cycle failures in Indian SME implementations:
- Scope sprawl. Declaring a scope larger than the team can evidence, then failing the Stage 2 audit on scope coverage.
- Statement of Applicability as a fill-in-the-blank exercise. Marking every control “applicable” without justification or evidence, instead of making real risk-driven choices.
- Document set without operating evidence. Policies signed in week 4, audit in week 16, with no surveillance-grade evidence of policies actually operating.
- Internal audit skipped or performed by the same people who built the ISMS. Independence is non-negotiable; the internal audit is a Clause 9.2 requirement.
- Management review treated as a calendar event. A 20-minute meeting with no documented inputs, outputs, decisions, or actions will not satisfy Clause 9.3.
- Choosing an unaccredited CB. A cheap certificate from an unaccredited body will fail commercial scrutiny within a year.
Closing — The Substance Is the Management System
ISO 27001 is unforgiving in the same way most management-system standards are unforgiving: it rewards the institutions that operate the system and frustrates the ones that produce documents. The 93 Annex A controls matter, but the audit attention will fall on whether your context analysis is real, your risk assessment is current, your Statement of Applicability is defensible, your internal audit is independent, and your management review actually drives decisions.
For Indian SMEs the strategic call is simple. Either ISO 27001 is on your roadmap because your buyers, regulators, or growth ambition require it — in which case treat it as a 9-month structured programme, not a 3-month rush — or it is not on your roadmap, in which case do not start. The half-built ISMS is the worst of the three states: you carry the cost of compliance work without the credential that makes that cost recoverable.
If the answer is “start”, start with scope. Then context (including the climate question). Then the risk assessment. Then the Statement of Applicability. Then the controls. Then evidence. Then audit. The order matters, and the institutions that respect the order are the ones who pass the first surveillance audit cleanly.