- +91 80768 85539
- info@expertvuw.com
- Pan-India service available.
Home / ISO Certifications / ISO 27001 Certification
Last updated: 2 October 2026
ISO/IEC 27001 is the international standard for managing information security, often required by enterprise clients and overseas customers. Expertvuw’s team runs the risk assessment, prepares the Statement of Applicability and policies, and gets you ready for audit by an accredited certification body.
ISO/IEC 27001 sets requirements for an information security management system (ISMS). The organisation defines its scope, assesses information security risks, selects controls to treat them and documents the choices in a Statement of Applicability. The current version is ISO/IEC 27001:2022, whose Annex A has 93 controls grouped under organisational, people, physical and technological themes.
The transition from the 2013 version ended on 31 October 2025, so certificates to ISO/IEC 27001:2013 are no longer valid. All certifications now need to be to the 2022 version.
In India, an ISMS also helps demonstrate reasonable security practices under the Digital Personal Data Protection Act, 2023 and its Rules, and supports incident reporting duties under CERT-In directions.
Basis: ISO/IEC 27001:2022 (with Amendment 1:2024) and ISO/IEC 27002:2022; IAF transition guidance (2013 certificates invalid after 31 October 2025); Digital Personal Data Protection Act, 2023; CERT-In Directions, 2022. Last updated: 27 September 2026.
ISO/IEC 27001:2022 is the current version.
Certificates to the 2013 version became invalid after 31 October 2025.
Annex A lists 93 controls in four themes.
Controls are selected based on your risk assessment.
An ISMS supports security safeguards expected under the DPDP Act, 2023.
Cyber incidents must be reported to CERT-In within the prescribed time.
Most gaps are in evidence, not in policies.
o
i
e
ISO 27001 connects with these services.
Trust services report for SaaS and service companies.
Privacy policy aligned with data protection law.
EU data protection compliance.
Quality management system.
Define ISMS scope and context.
Identify assets, threats and risks.
Select controls and prepare the SoA.
Put controls and policies into practice.
Audit and management review.
Support during Stage 1 and Stage 2 audits.
Information security needs continuous attention.
n
e
n
n
Share your query and our team will reply during business hours.
No. Certificates to the 2013 version became invalid after 31 October 2025. Certification now needs to be to ISO/IEC 27001:2022.
Annex A has 93 controls in four themes: organisational, people, physical and technological.
It supports security safeguards, but DPDP compliance also needs consent, notice, rights and other requirements.
Independent certification bodies; choose one accredited by NABCB or another IAF member.
ISO 27001 is a certifiable management system standard; SOC 2 is an attestation report by a CPA firm under AICPA criteria.
ACS – Director, Expertvuw Management Pvt Ltd
Gap analysis, documentation and audit readiness are handled by Expertvuw’s team. Certificates are issued only by independent certification bodies after their own audit; we recommend bodies accredited by NABCB or another IAF member accreditation body.