Find out exactly how far you are from ISO/IEC 27001:2022 certification, and what to fix first.
Customers, enterprise clients and tenders increasingly ask for ISO 27001. Many small and mid-sized businesses don’t know where they stand or where to start. An ISO 27001 readiness assessment gives you a clear, honest picture of your current information security practices measured against ISO/IEC 27001:2022, plus a practical plan to close the gaps before you book a certification audit.
Not ready to talk to anyone yet? Score yourself first with the free 30-question ISO 27001 self-assessment (PDF report, nothing leaves your browser) or the ISO 27001:2022 readiness checklist. Both cover the same clauses and controls we check in the assessment.
Who this is for
- SMBs and startups whose customers or partners are asking for ISO 27001
- IT/ITeS companies, SaaS providers and agencies bidding for enterprise or government contracts
- Organisations that started an ISMS but stalled, or want an independent check before the Stage 1 audit
- Companies that still hold documents written for ISO 27001:2013 (those certificates were withdrawn after 31 October 2025) and need to move to the 2022 controls
- Vendors to SEBI-regulated entities, banks and insurers whose clients now pass their own cybersecurity obligations down the supply chain
What’s included
- Scoping workshop: agree the ISMS scope, locations, systems and teams in scope
- Clause 4–10 review: context, leadership, risk management, support, operation, performance evaluation and improvement
- Annex A control review: assessment against the 93 controls of ISO/IEC 27001:2022 (organisational, people, physical and technological)
- Document review: existing policies, procedures, asset inventory, risk register and records
- Interviews and walkthroughs with key staff (IT, HR, management)
- Technical spot checks of key controls such as access management, backups, patching, logging and endpoint security
- Regulatory cross-check: where your DPDP Rules (Rule 6 safeguards), CERT-In (6-hour reporting, 180-day logs) and, if relevant, SEBI CSCRF obligations overlap with the controls, so one set of evidence serves all of them
What you get
- Gap analysis report: control-by-control status (in place / partial / missing) with evidence notes
- Prioritised remediation roadmap: quick wins, medium-term work and items needing budget or tooling
- Draft Statement of Applicability (SoA) outline, based on your scope
- List of mandatory documents and records still needed for certification
- Management debrief call to walk through findings and answer questions
- A pointer to the templates you will need next: the ISO 27001:2022 Starter Kit has the risk register, SoA and policy templates that match the roadmap
How it works
- Discovery call: a free call to understand your business, drivers and timeline
- Scope and quote: a fixed-price proposal based on company size, locations and scope
- Assessment: document review, interviews and technical checks, done remotely or on-site
- Report and debrief: findings, roadmap and next steps
A typical readiness assessment for a small organisation takes 1–3 weeks from kickoff to report, depending on scope and how quickly documents and people are available.
How long certification takes and what it costs
After the assessment, a company of 20 to 100 people with one office usually needs three to five months to close the gaps, run the ISMS long enough to have records (certification bodies want to see about three months, with an internal audit and a management review done), and pass the Stage 1 and Stage 2 audits. The certificate is valid for three years, with a shorter surveillance audit at the end of years one and two and a full recertification audit in year three.
For budgeting, the 2026 guides published by Indian consultancies put year one at roughly ₹1.7 to 3 lakh for a 10 to 50 person company (₹1 to 2 lakh consulting and implementation, ₹0.7 to 1 lakh certification body fees), surveillance audits at ₹60,000 to 80,000 a year, and the three-year cycle at ₹4 to 6.5 lakh. Those are vendor figures and exclude tooling and your own staff time. The certification body’s fee is set by audit days, which depend on the number of people and sites in scope, so keeping the scope tight saves money.
What we usually find
The pattern repeats across companies of very different sizes: policies that exist on paper with no record that anyone follows them, a risk register copied from a template that never mentions the company’s real systems, a Statement of Applicability nobody who owns a control has read, backups that have never been restored, logs nobody reviews, and admin accounts without MFA. The first week of the roadmap is usually spent producing that evidence.
Why work with us
Every engagement is delivered personally by Bhaskar Soni, a hands-on Linux, DevOps and security practitioner based in Ahmedabad. The work is not outsourced to a junior team. We work with small and mid-sized businesses, startups, agencies and IT teams across India and internationally, both remotely and on-site in Gujarat. We do not sell certification and have no commercial arrangement with any certification body, so the advice on scope, body selection and audit days is ours alone.
Frequently asked questions
No. Certification can only be granted by an accredited certification body. This is an independent pre-assessment that tells you what needs to be in place before you engage one, so the actual audit goes smoothly.
The assessment takes one to three weeks from kickoff to report, depending on scope and how quickly documents and people are available. After that, a company of 20 to 100 people usually needs three to five months to close the gaps, run the ISMS, hold the internal audit and management review, and pass Stage 1 and Stage 2.
The assessment is a fixed price quoted after a free discovery call. The quote depends on the number of employees, locations and systems in scope and how mature your current practices are. For the certification itself, Indian guides published in 2026 put year one at about ₹1.7 to 3 lakh for a 10 to 50 person company, including certification body fees, with surveillance audits at ₹60,000 to 80,000 a year.
Yes. After the assessment, we can help write policies and procedures, set up the risk register and Statement of Applicability, and implement technical controls on Linux servers, networks and cloud. This is quoted separately.
One accredited for ISMS by NABCB or another IAF member, or STQC. We do not resell certification and have no commercial tie to any body, so we can help you compare quotes and audit-day estimates. Avoid unaccredited certificates: they are cheap and customers often reject them.
Not always. If someone on your team has read the standard and can give it a day or two a week for a few months, you can do it yourself with our free checklist, the self-assessment and the Starter Kit templates. A readiness assessment pays for itself when you want an independent view before spending on the certification body, or when nobody has the time.
Yes. We are happy to sign your NDA before any documents or system access are shared.
Yes. Document review, interviews and most technical checks are done remotely for clients across India and abroad. On-site visits are available in Gujarat.
Request a quote
Tell us a little about your environment and goals. Choose ISO 27001 Readiness Assessment in the form below, and we will reply within 1–2 business days with questions about scope and a fixed quote. There is no obligation.
Prefer email? Write to contact@youngstercompany.com. Related reading: the 93 Annex A controls explained and an introduction to ISO/IEC 27001.