Question 1

What is ISO 27001 and why do Indian IT companies need it?

Accepted Answer

ISO/IEC 27001 is the international standard for Information Security Management Systems (ISMS). It specifies the requirements to establish, implement, maintain, and continually improve a system for managing information security risks. For Indian IT, software, BPO, and fintech companies, ISO 27001 certification is increasingly demanded by international clients — especially in the US, UK, EU, and the Middle East — as evidence that client data is protected to a recognised global standard. Without it, Indian companies often cannot pass vendor security assessments run by global enterprises.

Question 2

What is the Statement of Applicability (SoA) in ISO 27001?

Accepted Answer

The Statement of Applicability (SoA) is a mandatory document under ISO 27001 that lists all controls from Annex A of the standard (93 controls in the 2022 edition) and specifies, for each control, whether it is applicable to the organisation, whether it has been implemented, and the justification for inclusion or exclusion. The SoA links the results of the risk assessment to the controls the organisation has selected to treat those risks. It is one of the first documents a certification body auditor will review and is considered the core deliverable of the ISO 27001 risk treatment process.

Question 3

How is ISO 27001:2022 different from the 2013 version?

Accepted Answer

ISO/IEC 27001:2022 (published in October 2022) updated the Annex A control set from 114 controls across 14 domains to 93 controls in four themes: Organisational, People, Physical, and Technological. Eleven new controls were added covering threat intelligence, cloud services, ICT readiness for business continuity, data masking, web filtering, secure coding, and data leakage prevention. Organisations certified to the 2013 version must transition to the 2022 edition by October 2025 — the transition deadline set by the International Accreditation Forum (IAF). New certifications issued after the publication date should be to the 2022 edition.

Question 4

Does ISO 27001 certification mean a company has never been hacked?

Accepted Answer

No. ISO 27001 certification means the organisation has implemented a systematic, risk-based approach to managing information security — it does not guarantee that no breach will ever occur. The standard requires organisations to identify risks, implement controls proportionate to those risks, monitor effectiveness, and respond to security incidents. A certified organisation that experiences a breach is expected to follow its incident response procedures, investigate root cause, and improve controls. Certification demonstrates security maturity and process discipline, which reduces risk — but no standard or certification eliminates all security risk.

Question 5

How long does ISO 27001 certification take for a mid-sized IT company?

Accepted Answer

For a mid-sized IT or software company with 50–500 employees, the implementation and certification process typically takes 4 to 8 months depending on the organisation's current security maturity, the complexity of its information assets and systems, and the speed at which staff can adopt new controls and procedures. The process involves: defining the ISMS scope, conducting an information asset inventory and risk assessment, selecting and implementing controls, writing policies, running a full internal audit, and then the certification body's Stage 1 (document review) and Stage 2 (implementation audit) assessments. Fusion Certification compresses this timeline by providing ready-to-adapt documentation and templates.

ISO 27001:2022

What is ISO 27001:2022?

Who Needs It?

How Fusion Helps

Frequently Asked Questions

Enquire Now