Governance, Risk & Compliance
An ISO 27001 certificate is worth exactly as much as the management system behind it. We build that system with you — scope, risk treatment, Statement of Applicability, internal audit — and get you through Stage 1 and Stage 2 at a fixed price. The certificate itself comes from an accredited certification body you appoint, not from us. Anyone telling you otherwise is selling you a worthless piece of paper.
ISO/IEC 27001:2022 does not certify that your systems are secure. It certifies that you run an Information Security Management System — that you have decided what your controls are, assigned them to owners, assessed the risks they address, and can demonstrate that the whole thing operates and improves. That distinction matters, because it explains why the auditor spends more time on your risk register and your management review minutes than on your firewall rules.
This is also why the certificate is the easy part and the second year is hard. Enough templates and enough overtime in the month before Stage 2 will get most organisations through a first audit. The surveillance audit twelve months later is where programmes fall over, because the same evidence has to be produced again by people who were not there the first time, from a shared drive full of undated screenshots.
We build for the surveillance audit rather than the certification audit. Controls should produce their own evidence as a by-product of operating — access reviews that log themselves, vulnerability scans with their own history, change approvals that live where changes actually happen. And because our testing feeds the same risk register, a penetration test finding and a control failure are one object rather than two teams’ separate problems.
Coverage
The 2022 edition replaced the 2013 edition’s fourteen domains with 93 controls across four themes. Your Statement of Applicability — which controls apply, which do not, and why — is the first document any certification auditor opens.
Policies, roles and responsibilities, supplier and cloud-service relationships, incident management, business continuity, threat intelligence and the legal and regulatory register. The largest theme by count, and the one most often under-documented.
Screening, terms of employment, awareness and training, the disciplinary process, remote working and confidentiality agreements. Small in number, disproportionately common as a nonconformity.
Secure areas, equipment siting and protection, clear desk and clear screen, secure disposal and media handling. Routinely skipped by cloud-only teams, and still assessed — a co-working desk and an unlocked laptop are in scope.
Access control, cryptography, logging and monitoring, malware protection, data leakage prevention and secure development (A.8.25–A.8.29). This is where independent testing evidence goes straight into the file rather than being asserted.
The management-system requirements that are not in Annex A at all: context, leadership, planning, support, operation, performance evaluation and improvement. Certification is failed here more often than on a technical control.
Which entities, sites, systems and services are being certified, and what is legitimately excluded. This single decision is the largest lever on both cost and audit duration, and it is the first thing we settle.
Approach
A first certification typically takes four to nine months, driven by starting position and scope rather than by headcount. The certification body also needs Stage 1 and Stage 2 booked with a gap between them, which is calendar time you cannot compress.
What is being certified, and where you stand against all 93 controls and clauses 4–10. Every gap is costed in effort with an owner, so the programme can be planned rather than discovered.
A risk register your management team can actually discuss, using a documented and repeatable methodology, fed by real findings from testing rather than a hypothetical threat list.
The SoA justified control by control, plus the policy set — written for how your organisation works, not a renamed template pack with someone else’s company name still in the footer.
Controls built and actually run: access reviews performed, logs reviewed, suppliers assessed, incidents exercised. Evidence collection automated wherever the platform can carry it.
Both are mandatory under clause 9 before you can go external. We run them as a genuine dry run, so nonconformities surface with us rather than with your auditor.
We support Stage 1 and Stage 2 and answer the technical questions in the room. Then continuous monitoring, so year two is a review rather than a rebuild.
Cost
Every ISO 27001 budget is made of the same lines. Who you pay for each, and what makes it bigger or smaller, is the part most quotes leave out. We quote our line as one fixed number after a scoping call.
| Cost line | Who you pay | When | What drives it |
|---|---|---|---|
| Gap assessment and implementation support | A consultant (us, or your own team) | One-off, before Stage 1 | Scope, starting position, and how much of the work your team absorbs |
| Your team’s time | Nobody — it is internal, and usually the largest cost | Throughout | Whether there is one owner with real time, and how many control owners are involved |
| Remediation | Varies: engineering time, a tool, a supplier | Before Stage 2 | The gaps the assessment finds — this is why we cost every gap with an owner |
| Stage 1 and Stage 2 certification audit | An accredited certification body, directly | One-off per three-year cycle | Auditor-days, set by the certification body from headcount in scope, sites and complexity |
| Surveillance audits | The same certification body | Years two and three | A share of the initial audit time, every year |
| Recertification audit | The certification body | Every three years | Same drivers as the initial audit, usually shorter |
| Penetration testing and evidence | A tester, and any evidence tooling you use | At least yearly | Systems in scope; whether evidence is collected continuously or rebuilt each year |
The full breakdown, with how to compare certification-body quotes like for like: ISO 27001 certification cost in India.
Timeline
Four to nine months for most first certifications. The ranges below are what we plan with; the right-hand column is what moves you to either end.
| Stage | Typical duration | What decides it |
|---|---|---|
| Scope and gap assessment | 2–3 weeks | How quickly the scope is agreed, and access to system owners |
| Risk assessment and Statement of Applicability | 3–6 weeks | Whether an asset inventory already exists |
| Implement and operate controls | 2–4 months | The size of the gap list, and owner time |
| Internal audit and management review | 2–3 weeks | Mandatory before Stage 1; runs once controls have operated long enough to show evidence |
| Stage 1 audit (documentation) | 1–3 days on site or remote | Booked with the certification body, often weeks ahead |
| Stage 2 audit (operation) | Scheduled after Stage 1 findings are closed | How fast Stage 1 findings are fixed, and certification-body availability |
Calendar time you cannot compress: the gap between Stage 1 and Stage 2, and controls needing to run for long enough to produce evidence.
ISO 27001:2022
ISO/IEC 27001:2022 was published on 25 October 2022 and the transition from the 2013 edition closed on 31 October 2025. If your documents were written for 2013, these are the parts that need rework.
Annex A went from 114 controls in 14 domains to 93 controls in four themes — organisational, people, physical and technological. Your Statement of Applicability has to be rebuilt against the new list, not renumbered.
Threat intelligence, information security for cloud services, ICT readiness for business continuity, physical security monitoring, configuration management, information deletion, data masking, data leakage prevention, monitoring activities, web filtering and secure coding.
A new clause: changes to the ISMS must be carried out in a planned way. Auditors look for evidence that a reorganisation or a new system went through the ISMS, not around it.
A new item asks which of your interested parties’ requirements the ISMS will address — customers’ contract clauses, regulators, the DPDP Act — written down rather than implied.
A 2024 amendment asks you to consider whether climate change is a relevant issue for the ISMS in clauses 4.1 and 4.2. For most organisations a reasoned line in the context analysis is enough; a missing one is a finding.
Each control in ISO/IEC 27002:2022 carries attributes — control type, security properties, cybersecurity concepts (identify, protect, detect, respond, recover) and more — so the same controls can be sorted the way a NIST CSF reader expects. Useful when one customer asks for ISO 27001 and another for something else.
Get a fixed quote
A person reads it and replies within one business day to arrange a 30-minute scoping call. You then get a written scope — what is in, what is out, what we need from you — and one fixed price for our part of the work. The certification body quotes you separately and is paid directly.
Your enquiry has reached us. A member of the SemperWise team will get back to you within 24 business hours.
If it is urgent, call +91-95851-60363.
In the platform
Not a claim about coverage in the abstract — this is the clause library and the evidence collection that ship today.
Each one carried as a control with its own state, owner, test date and evidence — not a checklist item.
Gathered on a cycle and filed against the clauses they evidence, with a collection date and an expiry.
Of the 29 subjects our unified control model defines. This is what makes a second framework cheaper than the first.
Each artefact carries a collection date and an expiry, because evidence that is two years old is not evidence — it is history. When one lapses, everything resting on it is flagged rather than left quietly asserting something that stopped being true.
Deliverables
The report is the product. If it cannot be acted on by a developer and understood by a director, we have not finished.
Every gap against all 93 controls and clauses 4–10, with an effort estimate and a named owner — an honest baseline, not an inflated readiness percentage.
Live, owned and reviewable. The document auditors examine most closely and that clients maintain worst.
Justified control by control, with inclusions and exclusions defensible on their own terms and mapped to the evidence that supports them.
Access, incident, continuity, supplier, cryptography, development and HR security — in language your staff will actually follow.
Run properly and documented properly, in the form certification bodies accept.
We are in the room for Stage 1 and Stage 2, and we take the technical questions so your team does not have to.
Is this for you?
If none of them are, say so on the call and we will tell you honestly whether this is the right piece of work — or point you at the one that is.
Book a scoping callHow we work
The same engagement model applies to every piece of work we take on, so you always know what happens next.
A 30-minute call, then a written scope: what is in, what is out, what we need from you and what it costs. Nothing starts before you sign it.
Rules of engagement, testing windows, escalation contacts and a signed authorisation. Out-of-hours windows where production cannot take the load.
Automated coverage first, then manual testing where judgement is required. Critical findings are reported the day we confirm them, not at the end.
One report a developer can act on and an executive can read, with evidence, reproduction steps, business impact and a fix for every finding.
A walkthrough call with your engineers. We answer questions on the fix, not just the finding.
A free retest cycle to confirm the fixes hold, and a clean summary you can hand to a customer, auditor or board.
Questions
The questions clients actually ask during scoping. If yours is not here, ask it directly.
No, and no consultancy legitimately can. The certification audit must be performed by an accredited certification body that is independent of whoever implemented the management system. We implement the ISMS, run your internal audit and support you through the external audit — but the certificate is issued by the certification body on their own judgement. Any firm offering to both implement and certify is offering you something an informed customer will not accept.
Four to nine months for most organisations, driven by starting position and scope rather than company size. An organisation with reasonable IT discipline, a tight scope and an internal owner who can give it real time can be audit-ready in about four months. Starting from nothing, with a broad scope and no dedicated owner, plan for nine. Stage 1 and Stage 2 also have to be booked with a gap between them, which adds calendar time regardless of how fast you work.
It was withdrawn, and under the accreditation transition rules (IAF MD 26) certificates issued against it had to be transitioned by 31 October 2025. Only the 2022 edition — 93 Annex A controls across four themes — is current. If anyone offers you a 2013-edition certification today, that is a reason to walk away rather than a shortcut.
The document that lists all 93 Annex A controls and records, for each one, whether it applies to your organisation and why. Inclusions have to be justified and so do exclusions. It is the first document a certification auditor reads, because it defines what they are auditing you against, and a weak SoA makes every subsequent conversation harder.
Two separate costs, and a third most quotes leave out. The certification body charges its own audit fee — set by the auditor-days it needs for your scope and headcount — paid directly to them; we do not mark it up. Our implementation fee depends on how much of the work you absorb internally. The cost nobody quotes is your own team’s time, which is often the largest. We scope properly and quote one fixed price rather than a day rate that grows. Our ISO 27001 cost guide breaks every line down.
It usually depends on who is asking. European, Indian and Middle Eastern enterprise buyers, and most tender processes, ask for ISO 27001. North American technology buyers ask for SOC 2. If you sell to both, start with ISO 27001 — it is a management system, so it gives you the structure — then add SOC 2, which is materially cheaper in that order than the reverse.
Not by statute for most sectors. It is increasingly mandatory commercially, which amounts to the same thing when a contract depends on it. It also gives you a defensible base for DPDP Act obligations around security safeguards and breach response, because the controls substantially overlap even though the legal duties are separate.
No. It makes you consistent, and consistency is a precondition for security rather than a substitute for it. A certified organisation has decided what its controls are and can show they operate. Whether those controls stop a competent attacker is a different question, and it is the one testing answers — which is why our findings feed the same risk register the ISMS runs on.
Next step
A 30-minute call, then a scope document with what is in, what is out and what it costs. No obligation, and no charge for the conversation.
