End-to-end ISMS implementation, gap assessment, internal audit, and certification body coordination from a team that is ISO 27001 certified itself. Get audit-ready with structured processes, not just documentation.
Trusted by India's leading enterprises
Where it actually binds
ISO 27001 is sold in India as the thing that satisfies everybody. It is worth knowing which instrument names it, which names something else, and which never had an opinion.
| Instrument | What it says about ISO 27001 | Reference |
|---|---|---|
| SEBI CSCRF | Names the standard directly, and the position moved. The master circular of 20 August 2024 made ISO 27001 certification mandatory under PR.IP.S16 for both Market Infrastructure Institutions and Qualified REs, to be obtained within a year. The technical clarifications of 28 August 2025 then restated it for Qualified REs alone, who are now in SEBI’s words "encouraged and recommended" to certify. MIIs are unchanged. A Qualified RE still carrying this as a regulatory deadline is carrying a commercial decision instead. | PR.IP.S16 · clarified 28 Aug 2025 |
| RBI Directions, 2026 | The six entity-specific Directions that replaced the 2016 Framework on 31 July 2026 name ISO 22301, the business continuity standard, at para 163, as a best practice the BCP and DR policy should adopt. The board-approved information security policy and the VA/PT cadence at para 151 are stated as obligations in the Directions’ own terms. An ISO 27001 ISMS is a common way to evidence them, and that is a mapping we make, not a mapping the text makes. | Directions, 2026 · paras 151, 163 |
| CERT-In | Governs who is permitted to perform the audit, not which standard you certify against. Empanelment attaches to the auditing firm and is the precondition every Indian regulator applies to the assessment itself. | Empanelment |
| DPDP Act, 2023 | Section 8(4) obliges a data fiduciary to take reasonable security safeguards. It describes an outcome and leaves the means open, which is precisely why a certified ISMS is useful here: it is documentary evidence of a chosen, audited method instead of an assertion that safeguards were reasonable. | Section 8(4) · Rules notified 2025 |
| Enterprise procurement | In practice this is what moves ISO 27001 up the priority list in India. Vendor security questionnaires, global customer onboarding, investor diligence ahead of a raise or a listing, and a large share of public tenders treat the certificate as a gate. Commercially it behaves like a requirement whatever its regulatory standing. | Buyer-driven |
SEBI CSCRF
RBI Directions, 2026
CERT-In
DPDP Act, 2023
Enterprise procurement
What you are buying
The reason ISO 27001 engagements go wrong is almost never the controls. It is that the organisation buys a document set when the standard is describing a management system: something with a scope, a risk assessment that gets revisited, owners who make decisions, evidence that accumulates, and a review cycle that runs whether or not an auditor is coming. Annex A of the 2022 edition carries 93 controls across four themes, organisational, people, physical and technological, and a registrar will test a sample of them. But the clauses that fail an audit are the management-system ones: a risk assessment methodology that was written once and never applied, a Statement of Applicability whose exclusions have no justification behind them, an internal audit programme that exists as a calendar invitation, a management review with no minutes. Those are the findings that turn into major non-conformities, because they say the system is not operating. Our engagements are built so that the ISMS is running before Stage 1 and not assembled for it, and because our team tests controls technically as well as documenting them, the evidence a registrar samples was produced by something that actually happened.
The commitment
Most budgets cover year one. The certificate is conditional throughout its life, and the cycle below is the one to plan against.
Where audits are won
It records a decision for every one of the 93 Annex A controls. The decisions below are the ones that draw questions, and the reason is the same in each case: the justification is missing, not wrong.
| State | What it means | What follows |
|---|---|---|
| Excluded, with a reason | A control is recorded as not applicable and the justification names the specific fact that makes it so: no in-house development, no physical data centre, no payment card data in scope. | This is the healthy case and it is entirely legitimate. Exclusions are expected; what a registrar tests is whether the stated reason survives contact with the scope. |
| Excluded, because it was difficult | A control is marked not applicable but the scope plainly includes the thing it governs. Cryptography excluded by an organisation handling customer data; supplier security excluded by one running on four SaaS platforms. | The most reliable way to fail Stage 2. It is also the easiest finding for an auditor to reach, because it is visible from the document alone before anybody is interviewed. |
| Included, implemented on paper | A control is marked applicable and implemented, and the evidence is the policy that describes it, and not a record of it operating. | Survives Stage 1 and rarely survives Stage 2. A policy demonstrates intent; an access review with dates, names and outcomes demonstrates a control. |
| Included, evidenced by testing | A technical control is marked applicable and the evidence includes results from assessment work: vulnerability management, secure development, network security, logging. | The strongest position, and usually the cheapest. Penetration testing and vulnerability assessment you already buy generate ISMS evidence directly; when the testing programme and the certification programme are procured separately, the same assurance is paid for twice. |
Two separate fee streams, a three-year cycle, and the seven things that move the number
Most quotes are hard to compare because they bundle two different things. Certification body fees are paid to an accredited registrar for the audit itself, and they are broadly standardised by auditor-days. Consulting fees are paid for getting the ISMS built and the evidence ready, and they vary enormously with how much of it already exists. A quote that does not separate the two cannot be compared with one that does. The other thing buyers routinely miss is that certification is a three-year commitment, not a one-off: a Stage 1 readiness review and a Stage 2 certification audit in year one, then surveillance audits in years two and three, then recertification. Budgeting only for year one understates the real cost by a wide margin.
Stage 1 reviews documentation and readiness; Stage 2 is the certification audit proper, testing whether the ISMS actually operates. A Stage 1 that surfaces gaps is doing its job, but a failed Stage 2 means paying for the audit twice.
The certificate runs three years and is conditional. Surveillance audits check the ISMS is still operating, and recertification at year three is a fuller exercise. Budget the cycle, not the first audit.
The number of locations, legal entities, employees in scope and systems inside the ISMS boundary drives auditor-days more than anything else. A tightly drawn, defensible scope is the cheapest decision available, and it is made before anyone quotes.
An organisation with documented policies, a working risk register and existing access reviews needs a fraction of the implementation support of one starting from nothing. This is where quotes diverge most, and where an honest gap assessment pays for itself.
A certificate from a body accredited by a recognised authority is what enterprise procurement and global customers actually check. An unaccredited certificate is cheaper and can fail the due diligence it was bought to pass.
Access control, change management, risk assessment, vendor management and incident response do double duty across ISO 27001 and the SOC 2 Trust Services Criteria, and SEBI CSCRF evidence maps onto the same ISMS. Sequencing them as one programme rather than two avoids paying twice for the same evidence.
Penetration testing and vulnerability assessment results feed the ISMS evidence base directly. If your testing programme and your certification programme are procured separately with no shared evidence, you are paying for the same assurance twice.
Methodology
Every engagement follows this process through Lemon, our proprietary audit management platform.
Security Brigade delivers ISO 27001 consulting through a structured, phased methodology that covers every requirement of the standard. Unlike documentation-only consultants, our technical team performs actual controls testing and evidence validation. Our proprietary platform Lemon manages the entire compliance lifecycle, generating evidence packages, tracking control implementation, and ensuring nothing falls through the cracks between assessment and certification.
Define the ISMS scope, identify applicable Annex A controls, assess current security posture against every ISO 27001 requirement, and produce a prioritised gap analysis report with clear remediation roadmap.
Conduct formal information security risk assessment using a methodology aligned to ISO 27001 Clause 6.1. Identify threats, vulnerabilities, and impacts. Develop the risk treatment plan mapping each risk to specific controls.
Develop the complete suite of ISMS policies, procedures, and documentation required by the standard, including the Statement of Applicability, information security policy, access control policy, incident management procedures, and asset management documentation.
Implement and configure technical security controls across network, application, endpoint, and cloud environments. Our security team validates that controls are operational and effective, not just documented on paper.
Conduct security awareness training for staff and specialised training for ISMS roles including risk owners, asset owners, and internal auditors. Ensure the organisation can operate and maintain the ISMS independently.
Execute a formal internal audit covering all ISMS processes and Annex A controls. Identify non-conformities, observations, and opportunities for improvement. Produce audit reports that meet certification body expectations.
Facilitate the management review meeting with organisational leadership, presenting ISMS performance metrics, risk treatment status, internal audit findings, and continuous improvement actions required by Clause 9.3.
Coordinate with the selected certification body through Stage 1 documentation review and Stage 2 certification audit. Manage the entire interaction including evidence submission, auditor queries, non-conformity resolution, and certificate issuance.
"We have SAP, SCADA, 200+ web apps, and factories running legacy systems. Most security firms understand IT or OT — not both. Security Brigade tested our corporate network, our plant floor, our SAP interfaces, and our cloud migration path in one engagement with one methodology. The OT findings alone justified the engagement, but the real value was having everything in a single risk register."
Continuous Compliance with ShadowMap
An annual audit proves your posture at a single point in time. Between audits, attack surfaces drift, credentials leak, sub-domains get added, vendors get breached. ShadowMap watches the boundary continuously so the next audit isn't a surprise.
Continuous discovery of internet-facing assets: sub-domains, APIs, cloud resources, open ports, SSL certificates, technology stack.
Audits are point-in-time. ShadowMap watches your boundary daily.
Explore on ShadowMap12B+ breach records indexed; monitors Telegram, paste sites, criminal forums, and ransomware leak sites for credentials, leaked data, and threat actor mentions.
Find leaked data before regulators do.
Explore on ShadowMapThe platform underneath
An auditor asks what evidence exists for the Annex A controls that involve testing, and how recent it is. A platform that runs continuously changes the second half of that question more than the first.
FAQ
The questions that decide scope, budget and timing. Talk to our team for the ones that depend on your estate.
Contact usTalk to our compliance team for a scoping consultation and detailed project plan tailored to your organisation.
Typically responds within 1 business day · No commitment required
