ISO 27001 Certification
ISO/IEC 27001:2022 information security certification, set up so it also covers the DPDP Act's security safeguards.
Quick answer
ISO/IEC 27001:2022 is the international standard for an information security management system (ISMS). A business is certified by an accredited certification body after a two-stage audit, and the certificate is valid for 3 years with yearly surveillance audits. CorpBridge prepares your ISMS (scope, risk assessment, Statement of Applicability, policies and records) and coordinates the audit, from ₹24,999 plus the certification body's fee, and maps it to the DPDP Act's security safeguards so one programme serves both.
| Professional fee | ₹24,999 + 18% GST |
|---|---|
| Government charges | Certification body audit fee |
| Time taken | Usually 2–4 months to certification |
| Form / portal | ISO/IEC 27001:2022 (ISMS) |
| Documents | 5 items (listed below) |
| Done | 100% online |
What is ISO 27001 Certification?
Enterprise customers, banks, government tenders and foreign clients increasingly ask for an ISO 27001 certificate before they share data with you. From 13 May 2027, the DPDP Act also requires every business that handles personal data to take reasonable security safeguards, with penalties up to ₹250 crore for failing to do so.
We build your ISMS so that it meets ISO 27001 and, at the same time, the minimum safeguards in the DPDP Rules, 2025: encryption or masking, access control, logs, backups and contracts with vendors. One set of policies and evidence, two requirements covered.
- Standard
- ISO/IEC 27001:2022
- Annex A controls
- 93
- Certificate validity
- 3 years
What's included in our ISO 27001 Certification service?
- Scope definition and gap assessment against ISO/IEC 27001:2022
- Information asset register and risk assessment
- Risk treatment plan and Statement of Applicability (93 Annex A controls)
- Information security policy and the procedures the standard requires
- Mapping of your controls to DPDP Act security safeguards and breach reporting
- Incident response plan covering the 72-hour DPDP Board report and CERT-In reporting
- Staff awareness session
- Internal audit and management review before the external audit
- Coordination with an accredited certification body for Stage 1 and Stage 2 audits
- Reminders and support for yearly surveillance audits
Who is eligible for ISO 27001 Certification?
- IT, SaaS and software companies
- BPO, KPO and service providers handling client data
- Fintech, healthtech and edtech businesses
- Any business asked for ISO 27001 by a customer or tender
What documents are required for ISO 27001 Certification?
- Company registration and a short description of your services
- List of offices, cloud services and key systems
- Organisation chart and number of staff
- Existing IT and security policies, if any
- Key vendor contracts
What is the process for ISO 27001 Certification?
Gap assessment
We agree the scope and compare your current practices with ISO 27001 and the DPDP security safeguards.
Risk assessment
Assets, risks and controls are recorded, and the Statement of Applicability is prepared.
Policies and implementation
Policies, procedures and records are put in place, and staff are trained.
Internal audit
We audit the ISMS and hold a management review, so the external audit has no surprises.
Certification audit
An accredited certification body runs the Stage 1 (documents) and Stage 2 (implementation) audits.
Certificate and upkeep
Certificate issued for 3 years, with surveillance audits in years 2 and 3.
How much does ISO 27001 Certification cost?
| Component | Amount | Paid to |
|---|---|---|
| CorpBridge professional fee | ₹24,999 | CorpBridge |
| GST on professional fee | ₹4,500 | Government (via CorpBridge) |
| Government fee / stamp duty | certification body audit fee | Government, at actuals |
Your expert confirms the exact government charges for your case before you pay. Build a full package estimate →
Frequently asked questions about ISO 27001 Certification
Is ISO 27001 mandatory in India?
No law makes ISO 27001 mandatory for private businesses. Many customers, banks, government tenders and foreign clients require it, and it is strong evidence of the reasonable security safeguards the DPDP Act requires.
Does ISO 27001 make my business DPDP compliant?
Not by itself. ISO 27001 covers information security, which supports the DPDP Act's security safeguards. DPDP compliance also needs privacy notices, consent, data principal rights, breach reporting to the Data Protection Board and retention rules. We can cover both together.
How long does ISO 27001 certification take?
For most small and mid-sized businesses, 2 to 4 months from the gap assessment to the certificate, depending on scope and how many controls are already in place.
How much does ISO 27001 certification cost?
CorpBridge's consultancy starts at ₹24,999. The accredited certification body charges its own audit fee, which depends on your scope, staff numbers and sites; we share quotes before you commit.
How long is an ISO 27001 certificate valid?
3 years, with surveillance audits in the second and third years. A recertification audit renews it for another 3 years.
What is the difference between ISO 27001:2013 and 2022?
The 2022 version reorganised Annex A into 93 controls in four themes (organisational, people, physical and technological) and added controls such as threat intelligence, cloud security and data masking. New certifications are issued against the 2022 version.
What documents are required for ISO 27001 Certification?
Company registration and a short description of your services; List of offices, cloud services and key systems; Organisation chart and number of staff; Existing IT and security policies, if any; Key vendor contracts.
Often taken together
Annual ROC Filing for Companies
AOC-4 / MGT-7Financial statements and annual return for Private Limited companies, with board and AGM minutes.
LLP Annual Filing
Form 8 / 11Statement of Accounts (Form 8) and Annual Return (Form 11) for LLPs.
DPDP Act Compliance
DPDP Act, 2023 & Rules, 2025Get your business ready for the Digital Personal Data Protection Act before the 13 May 2027 deadline.
Not sure what to protect first?
Book a free 15-minute call. An IP expert will tell you which trademarks, patents or designs your business needs.