ISO/IEC 27001:2022
ISO 27001 certification, without the audit panic
We build your ISMS, implement the Annex A controls and prepare you for Stage 1 and Stage 2 audits, with every control tracked live in the HostX Compliance Tool.
What is ISO 27001 certification?
ISO/IEC 27001 is the international standard for an Information Security Management System (ISMS). Certification by an accredited body shows customers and regulators that you manage information security risks systematically. The 2022 version has 93 Annex A controls grouped into organisational, people, physical and technological themes.
Why companies pursue ISO 27001
Enterprise customers, tenders and investors increasingly ask for it. ISO 27001 turns scattered security practices into a managed system that an independent auditor can verify, and it answers most security questionnaires in one line.
Win enterprise and government deals that require it
Answer security questionnaires faster
One framework that maps to SOC 2, DPDP and RBI expectations
Why ISO 27001 projects fail
What our ISO 27001 service covers
Gap assessment
Where you stand against every clause and control.
Scope & risk assessment
ISMS scope, asset register and risk treatment plan.
Statement of Applicability
Which of the 93 controls apply, and why.
Policies & procedures
A practical, audit-ready document set.
Control implementation
Technical and process controls, incl. VAPT evidence.
Internal audit & review
Independent internal audit and management review.
Our approach: gap to certificate
Gap assessment
Baseline against ISO 27001:2022.
Scope & risk
Define scope, assess and treat risks.
SoA & policies
Statement of Applicability and policy set.
Implement
Controls rolled out; evidence tracked.
Internal audit
Independent check and management review.
Stage 1 audit
Certification body reviews documentation.
Stage 2 audit
Certification body verifies implementation.
ISO 27001 at a glance
| Item | Detail |
|---|---|
| Current version | ISO/IEC 27001:2022 (transition from the 2013 version ended 31 October 2025) |
| Annex A controls | 93, in 4 themes: Organisational (37), People (8), Physical (14), Technological (34) |
| Certification audits | Stage 1 (documentation) and Stage 2 (implementation) by an accredited certification body |
| Certificate validity | 3 years, with annual surveillance audits |
| Typical timeline | 3–6 months for a focused first scope |
What auditors check
| Area | Evidence they ask for |
|---|---|
| ISMS scope & context | Scope statement, interested parties |
| Risk management | Risk assessment, treatment plan, SoA |
| Policies | Approved policies and awareness records |
| Controls in operation | Access reviews, logs, backups, VAPT reports |
| Internal audit | Audit report and corrective actions |
| Management review | Minutes and decisions |
What you get
Who needs ISO 27001?
SaaS and IT services companies selling to enterprises
Fintech and BFSI vendors
Companies bidding for government tenders
Firms handling customer or health data
Why teams choose HostX for ISO 27001
Live tracking
See readiness per control in the Compliance Tool.
Evidence built in
VAPT and SOC evidence from the same team.
Right-sized
A first scope you can actually pass.
After certification
Surveillance-audit support every year.
Related services
Frequently asked questions
Walk into your ISO audit ready.
Book a consultation and get a free ISO 27001 readiness snapshot.