ISO/IEC 27001:2022
Information security management system: scope, risk assessment and treatment, Statement of Applicability against the 93 Annex A controls, internal audit, management review, continual improvement.
Readiness from US$12,000certification body fees separate
Issued byCertificate issued by an accredited certification body after stage 1 and stage 2 audits; three-year cycle with surveillance audits.
Evidencekept in the Trust Workspace
We preparethey certify
Readiness items we start from
- ISMS scope and policy defined
- Risk assessment and treatment plan
- Statement of Applicability against Annex A
- Asset inventory and classification
- Supplier security requirements
- Internal audit completed
- Management review held
- Corrective actions tracked
The framework's own criteria or clauses govern; this list is where most companies have gaps.
Timeline and cost, honestly
Readiness two to four months for a company with basic controls in place. Certification involves a stage 1 and a stage 2 audit, then surveillance audits in a three-year cycle. Auditor and certification-body fees vary by scope and are paid to them; ask for quotes from more than one. Our readiness fee covers preparation, the readiness review and the auditor introduction.
Start with ISO/IEC 27001:2022
Tell us the buyer who is asking and what you already have.