ISO 27001 Information Security Management
ISO 27001 information security — risk assessment, Annex A controls, Statement of Applicability, internal audit and certification.
- Estimate Cost
- ₹75,000 – ₹4,00,000
- Typical duration
- 60 days
Service overview
ISO 27001 sets out the requirements for an information security management system (ISMS). It protects the confidentiality, integrity and availability of company and customer data through risk-based controls.
Who needs it? / When is it needed?
- IT, SaaS, fintech, BPO and KPO companies, data centres and healthcare providers.
- When a client contract, RFP or international customer demands proof of information security.
- Businesses handling sensitive personal or financial data
What to expect from the WCP Professionals
- Gap analysis against ISO/IEC 27001:2022.
- Asset inventory, risk assessment and Statement of Applicability (Annex A controls).
- ISMS policies, access control, incident management and business continuity.
- Security awareness training.
- Internal audit and management review.
- Coordination with the certification body for the Stage 1 and Stage 2 audits.
Key deliverables
- Risk assessment and Statement of Applicability.
- ISMS policies and procedures.
- Internal audit report.
- ISO 27001:2022 certificate.
Standard turnaround time
- Gap analysis: 1–2 weeks.
- Implementation: 1–3 months.
- Certification audits: 2–6 weeks, depending on the certification body's schedule.
Government fees, timelines & key outcomes
- No government fee; certification body fees depend on organisation size, sites and audit days.
- Certificates are valid for 3 years, with annual surveillance audits.
- Key outcome: an internationally recognised certificate that improves credibility and business opportunities.
Forms & filings involved
- No government forms are required.
- Application to the certification body.
- Stage 1 and Stage 2 audit reports.
- Corrective action reports.
Documents required
- Company registration documents and organisation chart.
- Process details, scope and site list.
- IT asset list, network diagrams and existing security policies.
- Vendor and cloud service details.
What we need from you
- Top management commitment.
- An assigned internal coordinator.
- Staff availability for training and audits.
- Implementation of documented processes.
Important conditions
- Certification is granted by an independent certification body, not by WCP.
- Choose an accredited certification body (e.g. NABCB, IAS or UKAS).
- Non-conformities must be closed before the certificate is issued.
- Technical controls such as firewalls and backups may need IT or security vendor support.
Additional information
- Pairs well with GDPR and DPDP compliance and SOC 2.
- Related services: Data Privacy & GDPR Compliance, ISO 9001.
The estimated cost covers indicative professional fees only. Government fees, stamp duty and taxes are payable at actuals.
How it works
- 1. Raise a service enquiry describing your requirement.
- 2. A Relationship Manager reviews it and opens it for bidding.
- 3. Pay into escrow and assign the professional you select.
- 4. Track progress to completion, then accept and release payment.
Frequently asked questions
What is ISO 27001?
The international standard for information security management systems, covering people, processes and technology.
What is the current version?
ISO/IEC 27001:2022, with 93 controls in Annex A.
Who needs ISO 27001?
IT and SaaS companies, BPOs, fintechs and any business handling sensitive customer data, especially for enterprise clients.
Does ISO 27001 help with the DPDP Act?
It supports the reasonable security safeguards the DPDP Act requires, though privacy obligations go further.