What ISO 27001 certification is
ISO/IEC 27001 is the international standard for an information security management system, usually shortened to ISMS. It sets out how you identify information risks, choose controls to treat them, and keep checking that those controls work. The current edition is ISO/IEC 27001:2022, amended in 2024 to ask organizations to consider whether climate change is a relevant issue.
Certification means an accredited certification body has audited your ISMS against the standard and found it conforms. You receive a certificate that enterprise buyers, government tenders and larger partners often ask for before they share data with you. BookMyLLC is a consultant, not a certification body. The certificate itself is issued by an independent, accredited certification body after its own audit.
The 2022 edition reorganized Annex A into 93 controls grouped into four themes: organizational, people, physical and technological. Certificates issued against the older 2013 edition had to move to the 2022 edition by 31 October 2025, so any new certificate today is issued against 2022.
Who this is for
- SaaS, software and IT service companies whose customers send security questionnaires before signing.
- Outsourcing, BPO, KPO and support teams in India, the Philippines or elsewhere that handle client data for US, UK or EU customers.
- Fintech, health-tech and HR-tech startups that store personal or financial records.
- Consulting, legal, accounting and marketing agencies that hold client files and credentials.
ISO 27001 is not limited to technology firms. Any organization that holds information worth protecting can build an ISMS, and the scope can be as narrow as one product or one office.
What BookMyLLC handles
We act as your implementation partner. We do the groundwork with your team so that when the certification body arrives, the evidence is already in place.
- Scoping: deciding which products, locations, teams and systems sit inside the ISMS.
- Asset inventory and risk assessment using a method you can repeat each year.
- Risk treatment plan and Statement of Applicability covering all 93 Annex A controls, with reasons for any exclusions.
- Core documents: information security policy, access control, supplier security, incident management, backup and business continuity procedures.
- Awareness training for staff and internal auditor training for the person who will own the ISMS.
- An internal audit and management review before the external audit.
- Help selecting an accredited certification body and preparing for Stage 1 and Stage 2.
Step-by-step process
- Gap assessment. We compare what you already do against the clauses and controls, and give you a list of gaps with owners.
- Scope and context. You confirm the ISMS boundary, interested parties and legal requirements such as data protection laws that apply to you.
- Risk assessment. Assets, threats and vulnerabilities are listed and scored, and each risk gets a treatment decision.
- Controls and documentation. Policies and procedures are written to match how you actually work, not copied from a template nobody follows.
- Operate and collect evidence. The ISMS runs for a period so there are records to audit: access reviews, training logs, incident tickets, supplier checks.
- Internal audit and management review. Both are mandatory before certification.
- Stage 1 audit. The certification body reviews your documentation and readiness.
- Stage 2 audit. The auditor tests whether controls operate in practice. Any nonconformities must be closed before the certificate is issued.
Documents and information you need
- A list of the products, services and locations you want certified.
- An organization chart and the names of people who own IT, HR and operations.
- Your current IT setup: cloud providers, laptops and devices, identity provider, code repositories.
- Existing policies, contracts with key suppliers and any past security incidents.
- Customer security requirements or questionnaires you have received.
Timeline
For a small team starting from scratch, implementation typically takes three to six months before the external audit, and larger or multi-site scopes often take longer. The main variable is how quickly your team can produce operating evidence. After certification, the certificate is normally valid for three years, with surveillance audits by the certification body in the years between recertification.
Common mistakes to avoid
- Scoping too wide at the start. Certify the product customers ask about first, then expand.
- Buying a policy pack and stopping there. Auditors test whether you follow the documents, not whether they exist.
- Skipping the internal audit. It is a required clause, and a missing one is a common nonconformity.
- Treating it as an IT project. HR onboarding, supplier contracts and physical security are all in scope.
- Letting it lapse after year one. Surveillance audits check that the ISMS is still running.
ISO 27001 supports, but does not replace, legal duties such as GDPR or India's data protection law. Ask a lawyer which specific laws apply to your data.
Costs that sit outside the implementation work
Your budget has three parts. The first is implementation support, which is what we provide. The second is the certification body's audit fee, which you pay directly to the certifier and which depends on headcount, sites and scope. The third is any tooling you decide to add, such as device management, a password manager or logging, which many small teams already have in some form.
Ask certification bodies for quotes early. Their audit day calculations follow accreditation rules, so two quotes for the same scope should be close, and a quote that is far lower deserves a question about accreditation.
Choosing a certification body
Pick a certifier that is accredited for ISO/IEC 27001 by a recognised accreditation body, and check that the accreditation covers your industry. Buyers in the US, UK and EU generally accept certificates from bodies accredited by members of the International Accreditation Forum. We can shortlist options, but the contract is between you and the certifier so that the audit stays independent.
Related services
If you are building a company around this work, see our ISO 9001 quality management support, our IT services for the technical controls, and an IT business consultation to plan your security roadmap. Project costs depend on scope, so see current pricing or book a call for a quote.
ISO 27001 at a glance
| Question | Short answer |
|---|---|
| What it covers | An information security management system (ISMS). |
| Core activity | Risk assessment, then controls chosen to treat the risks. |
| Who certifies | An accredited certification body. |
| Validity | Three years, with surveillance audits between. |
| Who asks for it | Enterprise customers, regulated industries and security questionnaires. |
The certification path
| Stage | What happens |
|---|---|
| Gap analysis | Compare what you do today with the standard |
| Build the system | Write the documents and processes the standard requires |
| Run it | Operate the system long enough to produce records |
| Internal audit and management review | Check the system yourself before the auditor does |
| Stage 1 audit | The certification body reviews your documents and readiness |
| Stage 2 audit | The certification body audits how the system works in practice |
| Certificate | Issued for three years, with surveillance audits between |
What you will need to show
| Item | What it is |
|---|---|
| Scope statement | What the ISMS covers and what it excludes |
| Risk assessment | The risks you found and how you treat them |
| Statement of Applicability | Which controls you use and why |
| Policies and procedures | The rules your people follow |
| Evidence of operation | Access reviews, incident logs, training records |
| Internal audit and management review | Proof you check yourself |
Certification costs go beyond implementation: audit fees, tooling and staff time. See IT services for the technical side.
