Use this checklist to judge how ready your organisation is for ISO/IEC 27001:2022 certification. It follows the structure of the standard: the management-system clauses (4 to 10) that every certified organisation must meet, then the 93 Annex A controls grouped into the four 2022 themes. Tick an item only when you have evidence (a document, record or screenshot) that an auditor could see.
Three ways to use it: work through the list below on your own; take the free 30-question ISO 27001 self-assessment, which scores the same clauses and controls and gives you a PDF gap report; or book an ISO 27001 readiness assessment, where we check the evidence with you and write the remediation roadmap. The ISO 27001:2022 Starter Kit (₹1,999) has the risk register, Statement of Applicability and policy templates the list keeps asking for.
Why Indian SMBs are being asked for ISO 27001
Most small Indian companies do not go looking for ISO 27001. A customer asks for it. An enterprise client’s vendor questionnaire wants a certificate or a date, a government or PSU tender lists it as a qualifying criterion, or a foreign client’s security team will not sign without it. Since 2025 three Indian rules have added to that pressure, and ISO 27001 is the structure most companies use to meet them in an auditable way:
- DPDP Rules, 2025, Rule 6 lists the minimum “reasonable security safeguards” every Data Fiduciary must have: encryption, masking or tokenisation; access control; access logs that are monitored and reviewed; backups that keep processing going after loss or damage; logs and personal data retained for one year unless another law says otherwise; security terms in every processor contract; and technical and organisational measures to make sure all of this actually happens. Those map directly onto Annex A controls A.5.15, A.5.20, A.8.13, A.8.15, A.8.24 and others. Most duties under the Rules start on 13 May 2027. (Our DPDP compliance checklist covers the rest.)
- CERT-In directions of 28 April 2022 require service providers, intermediaries, data centres and body corporates to report cyber incidents within 6 hours and keep ICT logs for 180 days inside India. An ISMS gives you the incident procedure (A.5.24 to A.5.28) and the logging control (A.8.15) that make this routine instead of a scramble.
- SEBI’s Cybersecurity and Cyber Resilience Framework (20 August 2024) applies to 19 types of regulated entities from 1 January or 1 April 2025, and its services table makes ISO 27001 certification mandatory for market infrastructure institutions and qualified regulated entities. Smaller brokers and advisers are not required to certify, but their vendors increasingly are.
What changed in the 2022 version
ISO/IEC 27001:2022 was published in October 2022. Annex A went from 114 controls in 14 domains to 93 controls in four themes: organisational (37), people (8), physical (14) and technological (34). Eleven controls are new, among them threat intelligence (A.5.7), cloud services security (A.5.23), ICT readiness for business continuity (A.5.30), configuration management (A.8.9), information deletion (A.8.10), data masking (A.8.11), data leakage prevention (A.8.12), monitoring activities (A.8.16), web filtering (A.8.23) and secure coding (A.8.28). Amendment 1 of February 2024 added one line to clause 4.1: the organisation must decide whether climate change is a relevant issue for its ISMS. Under IAF MD 26 every certificate issued against the 2013 version expired or was withdrawn after 31 October 2025, so a “2013” certificate a supplier shows you today is no longer valid.
How to score yourself
- In place: documented, implemented and evidence exists (2 points)
- Partial: done informally or inconsistently, or no evidence (1 point)
- Missing: not done (0 points)
- Below 50%: start with Clauses 4 to 6 and the ★ controls. 50 to 80%: typical of organisations 3 to 6 months from Stage 1. Above 80%: book your certification audit.
Clause 4 – Context of the organisation
- Internal and external issues affecting information security are identified and reviewed (since Amendment 1, this includes a decision on whether climate change is relevant)
- Interested parties (customers, regulators, staff, suppliers) and their requirements are listed
- ISMS scope is documented: locations, business units, systems, exclusions and justification ★
Clause 5 – Leadership
- An Information Security Policy is approved by top management, communicated and available ★
- Roles and responsibilities for information security are assigned (e.g. ISMS owner, risk owners, asset owners)
- Management can show involvement: steering meetings, resource allocation, sign-offs
Clause 6 – Planning
- A risk assessment methodology is defined: criteria, likelihood/impact scales, acceptance levels ★
- A risk register exists with identified risks, owners, scores and treatment decisions ★
- A Statement of Applicability (SoA) lists all 93 Annex A controls, whether applicable, justification and implementation status ★
- A risk treatment plan with actions, owners and deadlines is approved by risk owners
- Measurable information security objectives are set and tracked
Clause 7 – Support
- Resources (people, budget, tools) for the ISMS are provided
- Competence is defined and records of training/qualifications are kept
- Staff are aware of the policy, their role and consequences of non-compliance (awareness training records)
- Internal and external communication about security is planned (who, what, when, how)
- Documented information is controlled: versioning, approval, access, retention
Clause 8 – Operation
- Processes to meet security requirements are planned and controlled, including outsourced processes
- Risk assessments are performed at planned intervals and on significant change
- The risk treatment plan is implemented and results recorded
Clause 9 – Performance evaluation
- Security metrics are defined and measured (e.g. patch SLA, incident counts, training completion)
- Internal audit programme exists; at least one full internal audit completed with report and findings ★
- Management review held with required inputs (audit results, incidents, risks, objectives) and minuted outputs ★
Clause 10 – Improvement
- Non-conformities are logged with root cause and corrective action
- Evidence of continual improvement (closed actions, updated controls)
Annex A.5 – Organisational controls (37)
- Topic-specific policies: access control, acceptable use, classification, backup, supplier security, secure development
- Asset inventory with owners; acceptable use and return of assets
- Information classification and labelling scheme in use
- Access control policy; identity lifecycle (joiners/movers/leavers); privileged access reviewed quarterly ★
- Supplier security: contracts with security clauses, supplier risk assessment, cloud service agreements (A.5.23)
- Incident management: reporting channel, response procedure, lessons learned, evidence collection ★
- Business continuity / ICT readiness: BIA, recovery plans, tested at least annually
- Legal and regulatory register (IT Act, DPDP Act 2023, contractual obligations); privacy and PII protection (A.5.34)
- Threat intelligence is collected and acted on (A.5.7, new)
- Independent review of information security (A.5.35)
Annex A.6 – People controls (8)
- Background verification before hiring, proportionate to the role
- Employment contracts include security responsibilities and confidentiality/NDA
- Security awareness training at induction and annually, with records ★
- Disciplinary process is documented
- Termination/role-change checklist: access removed within 24 hours, assets returned
- Remote working policy covering devices, networks and physical environment
- Event reporting: staff know how and what to report
Annex A.7 – Physical controls (14)
- Physical security perimeter and entry controls for offices/server rooms (badge logs, visitor register)
- Clear desk and clear screen policy
- Equipment siting, protection, maintenance and secure disposal/re-use (data wiping records)
- Protection against environmental threats and supporting utilities (UPS, fire detection)
- Secure cabling; off-premises equipment and storage media handled under policy
Annex A.8 – Technological controls (34)
- Endpoint protection: EDR/antivirus, disk encryption, screen lock on all user devices ★
- Privileged access management; MFA for admin, remote and cloud consoles ★
- Secure authentication; password policy enforced technically
- Capacity management and malware protection in place
- Vulnerability management: scanning, patch SLAs (critical ≤ 14 days), tracked evidence ★
- Configuration management / hardening baselines (CIS) for servers and network devices (A.8.9, new)
- Information deletion and data masking procedures (A.8.10, A.8.11, new)
- Data leakage prevention measures proportionate to classification (A.8.12, new)
- Backups taken, protected and restore-tested with records ★
- Redundancy of processing facilities where availability requirements demand it
- Logging and monitoring: central logs, clock sync, review, alerting; monitoring activities (A.8.16, new) ★
- Installation of software restricted; approved software list
- Network segregation, firewall rules reviewed; web filtering (A.8.23, new)
- Cryptography policy and key management
- Secure development lifecycle: requirements, secure coding, security testing, separation of environments, change management
- Test data protected; outsourced development controlled
- Web application security tested (ties in with VAPT)
Mandatory documents checklist
- ISMS scope (4.3)
- Information security policy (5.2)
- Risk assessment and treatment methodology (6.1.2, 6.1.3)
- Statement of Applicability (6.1.3 d)
- Risk treatment plan (6.1.3 e, 6.2)
- Information security objectives (6.2)
- Evidence of competence (7.2)
- Operational planning and control records (8.1)
- Risk assessment results and risk treatment results (8.2, 8.3)
- Monitoring and measurement results (9.1)
- Internal audit programme and results (9.2)
- Management review results (9.3)
- Non-conformities and corrective actions (10.2)
How long certification takes and what it costs in India
Certification is a three-year cycle run by an accredited certification body. In India, look for a body accredited by NABCB (the Quality Council of India’s accreditation board, which applies ISO/IEC 27006 to certification bodies) or by another IAF member; STQC, under MeitY, also certifies. The body sets the number of audit days from the number of people and sites in scope, which is the main driver of its fee.
| Phase | What happens | Typical time for a 20–100 person company |
|---|---|---|
| Gap analysis | Score this checklist, agree the scope, list what is missing | 1–3 weeks |
| Risk assessment and documents | Risk register, SoA, policies, procedures, objectives | 4–8 weeks |
| Implementation | Fix the technical and people controls: MFA, backups, logging, patching, training, supplier contracts | 6–12 weeks, in parallel with the documents |
| Run the ISMS | Collect records, hold the internal audit and the management review. Certification bodies expect to see the system running, usually for about three months, before Stage 2 | 3 months |
| Stage 1 audit | Document review and readiness check; improvement requests to close before Stage 2 | 1 day, remote or on-site |
| Stage 2 audit | Effectiveness audit; majors must be closed before certification is recommended, minors before the certificate is issued | Usually 6–8 weeks after Stage 1; 2–4 days |
| Surveillance audits | Shorter audits at the end of year 1 and year 2 | 1–2 days each |
| Recertification | Full audit in year 3; a new three-year cycle starts | Like Stage 2 |
Realistically that is four to six months from a standing start to the Stage 2 audit for a company with one office and a small IT team, and longer when the people who own the controls also run the business. Consultancies advertise 12 to 16 weeks; that pace assumes someone is free to work on it most days.
On cost, the published 2026 guides from Indian consultancies put year one for a 10 to 50 person company at roughly ₹1.7 to 3 lakh (₹1 to 2 lakh consulting and implementation, ₹0.7 to 1 lakh certification body fees), surveillance audits at ₹60,000 to 80,000 a year, and the full three-year cycle at ₹4 to 6.5 lakh. Another guide gives ₹1.5 to 4 lakh all-in for companies up to 50 staff and ₹4 to 8 lakh for 50 to 200. Treat these as indicative: they come from firms selling the service, and they leave out the tooling you may need (MFA, endpoint protection, backups, log retention) and the staff time, which is usually the largest cost of all.
Where small companies usually fail the first check
- Policies exist but nothing proves they are followed: no access review records, no training attendance, no restore test, no change tickets. Auditors certify what they can see.
- The risk register is a template filled with generic risks. It does not mention the company’s actual systems, suppliers or the last incident it had.
- The Statement of Applicability says a control is implemented, and the person who owns it has never seen the SoA.
- No internal audit and no management review before Stage 1. Both are mandatory, and both need records.
- Backups run, but nobody has restored one. Logs exist, but nobody reads them and they are overwritten in a week, which also breaks the CERT-In 180-day rule.
- Admin and cloud consoles without MFA, shared accounts, and ex-employees whose access was never removed.
ISO 27001 readiness: frequently asked questions
93, grouped into four themes: 37 organisational, 8 people, 14 physical and 34 technological. The 2013 version had 114 controls in 14 domains. Eleven controls are new in 2022, including threat intelligence, cloud services security, configuration management, data masking, data leakage prevention, monitoring activities, web filtering and secure coding.
No. The standard is risk-based. Your Statement of Applicability lists every control, says whether it applies and why, and records its status. You can exclude a control when your risk assessment and scope justify it, for example some secure-development controls if you write no software. Auditors read the justification, so each exclusion needs a written reason.
Plan for four to six months from a standing start to the Stage 2 audit for a company of 20 to 100 people with one office. The certification body wants to see the ISMS running for about three months, with an internal audit and a management review done, before Stage 2. Consultancies advertise 12 to 16 weeks, which works only when someone can give it most of their week.
Published 2026 guides from Indian consultancies put year one at roughly ₹1.7 to 3 lakh for a 10 to 50 person company (₹1 to 2 lakh consulting and implementation plus ₹0.7 to 1 lakh in certification body fees), surveillance audits at ₹60,000 to 80,000 a year, and the three-year cycle at ₹4 to 6.5 lakh. These are vendor figures and leave out tooling and your own staff time, which is usually the biggest cost.
There is no general law that requires it. SEBI’s Cybersecurity and Cyber Resilience Framework makes certification mandatory for market infrastructure institutions and qualified regulated entities. The DPDP Rules (Rule 6) and the CERT-In directions of 2022 set security, logging and incident-reporting duties that an ISMS is the usual way to meet. For most SMBs the pressure comes from customers, vendor questionnaires and tenders.
A readiness assessment is a gap analysis done before you book the certification body. It tells you which clauses and controls are in place, partial or missing, and what to fix first. A certification audit is run by an accredited certification body in two stages (document review, then effectiveness audit) and ends in a certificate that is valid for three years with annual surveillance audits.
No. Under IAF MD 26 every certificate issued against the 2013 version expired or was withdrawn after 31 October 2025. A valid certificate today must reference ISO/IEC 27001:2022. If a supplier shows you a 2013 certificate, ask for the 2022 one.
The standard names about a dozen: the ISMS scope, the information security policy, the risk assessment and treatment methodology, the Statement of Applicability, the risk treatment plan, security objectives, evidence of competence, operational planning records, risk assessment and treatment results, monitoring results, the internal audit programme and results, management review results, and records of non-conformities and corrective actions. Most Annex A controls add their own topic-specific policies.
Any certification body accredited for ISMS by NABCB (the Quality Council of India’s accreditation board) or another IAF member body; STQC, under MeitY, also certifies. Check the accreditation mark on the certificate. Certificates from unaccredited bodies are cheaper and are often rejected by enterprise customers and tenders.
Sources
- ISO/IEC 27001:2022 and ISO/IEC 27002:2022 (ISO); ISO/IEC 27001:2022/Amd 1:2024 (climate action changes)
- IAF MD 26:2022 transition requirements, summarised by DQS (2013 certificates withdrawn after 31 October 2025)
- NABCB BCB 125, Accreditation criteria for ISMS certification bodies (January 2026)
- ISOQAR: the ISO 27001 audit process (Stage 1, Stage 2, surveillance, recertification)
- Digital Personal Data Protection Rules, 2025, Rule 6
- CERT-In directions of 28 April 2022 (6-hour reporting, 180-day logs)
- SEBI Cybersecurity and Cyber Resilience Framework, 20 August 2024, summarised by KPMG and Ampcus Cyber
- Indian cost guides (vendor figures, 2026): TCSA, DataOps
This checklist is a free summary for self-assessment and is not a substitute for the standard, which must be purchased from ISO or BIS. Last updated 5 November 2026.
Next step: take the free ISO 27001 self-assessment for a scored PDF report, or ask for an ISO 27001 readiness assessment and we will turn this list into a gap analysis with a remediation roadmap. The ISO 27001:2022 Starter Kit (₹1,999) includes the risk register, Statement of Applicability and policy templates.