Unified Startup Enablement & Growth Platform

ISO 27001 — Information Security Management System Certification

ISO/IEC 27001:2022 is the global standard for Information Security Management Systems (ISMS). It's the world's most recognised cybersecurity certification — and for Indian startups selling to enterprise, government, or global markets, it's increasingly a mandatory procurement requirement rather than a differentiator.

Corpfy guides startups through the complete ISO 27001:2022 journey: scoping the ISMS, implementing all 93 Annex A controls, achieving Stage 1 and Stage 2 audits, and maintaining continuous surveillance audit readiness.

Current version: ISO/IEC 27001:2022 (supersedes 2013 — transition deadline October 2025)
Controls: 93 Annex A controls across 4 themes (Organisational, People, Physical, Technological)
Certification timeline: 3–9 months depending on current maturity
Surveillance audits: Annual; full recertification every 3 years

ISO 27001 vs SOC 2 — Which Do You Need?

Side-by-Side Comparison

Both are security certifications — the right one depends on your customer geography and sales motion

Dimension	ISO 27001	SOC 2
Origin / audience	International — EU, UK, Middle East, India, APAC	American — US enterprise buyers
Framework	ISMS (management system) + 93 Annex A controls	Trust Service Criteria (TSC) — 5 categories
Certification body	Accredited CB: BSI, Bureau Veritas, TÜV SÜD	AICPA-licensed CPA firm
Output	Certificate valid 3 years (annual surveillance)	Audit report — Type I (point-in-time) or Type II (6–12 months)
Government tenders in India	✅ Required by many MeitY/CERT-In empanelment criteria	❌ Not typically recognised
Enterprise SaaS in India	✅ Primary requirement	Secondary / for US-facing products
Typical cost (India)	₹8–20 lakh for implementation + ₹3–8 lakh for audit	₹15–40 lakh for Type II (US auditor rates)
Ongoing overhead	Annual surveillance audit + ISMS reviews	Annual re-audit for Type II renewal

            Corpfy's Recommendation for Indian Startups
            Selling to Indian enterprises or government → ISO 27001 first
Selling to US enterprise customers → SOC 2 Type II first
Targeting global scale (Series B+) → Both, starting with ISO 27001 since controls overlap ~70%

        

ISO 27001:2022 — 4 Control Themes, 93 Controls

Organisational Controls (37)

Policies, roles, supplier relationships, incident management, business continuity, legal compliance. Includes threat intelligence, information security in project management, and cloud service use.

Clause 5 Clause 6 Annex A.5

People Controls (8)

Screening, terms of employment, awareness training, disciplinary process, remote working, confidentiality agreements, and reporting security events.

Annex A.6

Physical Controls (14)

Secure areas, physical entry, office/desk security, equipment maintenance, secure disposal, clear desk policy, CCTV, and physical media handling.

Annex A.7

Technological Controls (34)

Access control, authentication, encryption, logging, vulnerability management, web filtering, SIEM, DLP, data masking, secure coding, penetration testing, configuration management.

Annex A.8

Ready to book the certification audit?

Once your ISMS and Statement of Applicability are in place, head to ISO 27001 Audit for certification body selection, the Stage 1/Stage 2 process, audit costs, and gap-analysis tooling that reads live from this control register.

ISO 27001:2022 Clause Coverage

10 Mandatory Clauses — Corpfy's Implementation

Clauses 4–10 are mandatory; Annex A controls are selected via Statement of Applicability

Clause	Requirement	Corpfy Deliverable	Evidence
4 — Context	Internal/external issues, interested parties, ISMS scope	Scope document, stakeholder register	Template
5 — Leadership	Top management commitment, policy, roles & responsibilities	ISMS Policy, CISO charter, management review minutes	Template
6 — Planning	Risk assessment, risk treatment plan, SoA, objectives	Risk register (ISO 27005), SoA, treatment plan	Tool + Template
7 — Support	Resources, competence, awareness, communication, documentation	Training programme, competence matrix, doc management SOP	Template
8 — Operation	Operational planning, risk treatment execution, change management	Change management policy, treatment evidence artefacts	Template
9 — Performance	Monitoring, measurement, internal audit, management review	KPI dashboard, internal audit checklist, management review agenda	Tool + Template
10 — Improvement	Non-conformity, corrective action, continual improvement	NCR tracker, CAR templates, improvement register	Tool + Template
Annex A (93 controls)	Selected controls based on risk treatment decisions, documented in SoA	Policy library, evidence templates for all applicable controls	93-control library

✅ New in ISO 27001:2022 — 11 New Controls Corpfy Addresses

A.5.7 Threat Intelligence — systematic collection and analysis of cyber threat data
A.5.23 Cloud Services Security — acquisition, use, and management of cloud services
A.5.30 ICT Readiness for Business Continuity — ICT continuity planning and testing
A.7.4 Physical Security Monitoring — CCTV and physical monitoring of secure areas
A.8.9 Configuration Management — secure configuration of hardware, software, networks
A.8.10 Information Deletion — secure deletion when no longer required
A.8.11 Data Masking — masking of PII and sensitive data in non-prod environments
A.8.12 Data Leakage Prevention — DLP tools and policies
A.8.16 Monitoring Activities — anomaly detection and SIEM
A.8.23 Web Filtering — controls on access to external websites
A.8.28 Secure Coding — secure development principles and code review

What Corpfy Delivers

Deliverables & Artefacts

Everything from gap analysis to certificate — managed by Corpfy

Deliverable	Description	Format
Gap Analysis Report	Current vs required posture across all 93 controls; prioritised remediation roadmap	PDF + Excel
ISMS Scope Document	Formal scope statement defining boundaries of the management system	PDF
Risk Register (ISO 27005)	Asset-based risk assessment with likelihood × impact scoring and treatment decisions	Excel + Tool
Statement of Applicability (SoA)	All 93 controls with inclusion/exclusion justification — required for Stage 1 audit	Excel + PDF
Policy Library (30+ policies)	ISMS Policy, Access Control, Incident Management, BCP, Supplier, BYOD, and more	DOCX templates
Control Evidence Templates	Pre-built evidence artefacts for all applicable Annex A controls	DOCX + Excel
Internal Audit Checklist	Full clause-by-clause internal audit questionnaire	Excel
Management Review Pack	Agenda, minutes template, KPI dashboard for management review meeting	PPTX + Excel
Certification Body Liaison	Corpfy manages Stage 1 and Stage 2 audit scheduling, NDA, and response to auditor queries	Managed Service
Corrective Action Tracker	Track and close non-conformities raised during Stage 1 and Stage 2 audits	Excel + Tool

⚠️ What You Lose Without ISO 27001

Enterprise deals in India blocked — most RFPs from banks, insurance, large corporates now require ISO 27001 as a vendor pre-qualification
Government empanelment refused — MeitY, NIC, and state IT departments require ISO 27001 for software empanelment
Series A/B investor concerns — security posture is now a standard diligence item; absence of ISO 27001 is flagged
DPDPA overlap missed — 30+ ISO 27001 controls directly address DPDPA technical safeguards; implementing both together costs 40% less than sequentially
CERT-In overlap missed — ISO 27001 A.5.24–A.5.28 incident management controls satisfy much of the CERT-In IRP requirement

Frequently Asked Questions

How long does ISO 27001 certification take for a startup?+

3 to 9 months depending on current security maturity. A startup with no documented policies typically needs 6–9 months. One with existing access control policies and an incident response plan can achieve certification in 3–5 months.

The fastest path: run the gap analysis in week 1, implement controls in parallel, and book Stage 1 as soon as the SoA is ready. Stage 1 takes 1–2 days; Stage 2 takes 2–5 days for a startup-sized scope. Certificate is typically issued 2–4 weeks after Stage 2 if no major non-conformities.

What is a Statement of Applicability (SoA) and why does it matter?+

The SoA lists all 93 Annex A controls and states for each: (1) whether it is applicable, (2) whether it is implemented, and (3) the justification for inclusion or exclusion.

Why it matters: the certification body auditor's first action in Stage 1 is to review your SoA. A poorly justified SoA is the most common cause of Stage 1 failures. Corpfy produces the SoA in the format expected by all five major accredited certification bodies in India, with pre-populated justifications for common startup exclusions.

What is the difference between ISO 27001:2013 and ISO 27001:2022?+

ISO 27001:2022 was published in October 2022 and all 2013 certificates must transition by October 2025. Key changes:

Controls reduced from 114 to 93 — through merging, not removal of requirements
4 control themes replace the old 14 domains (Organisational, People, Physical, Technological)
11 entirely new controls — cloud security, threat intelligence, web filtering, data masking, DLP, secure coding, configuration management
Clause 6.3 — new requirement to plan ISMS changes in a structured way

If starting ISO 27001 now, implement 27001:2022 directly. Corpfy manages transition gap analysis for existing 2013 certificate holders.

How does ISO 27001 relate to DPDPA and CERT-In compliance?+

There is significant overlap — implementing all three together is far more efficient than doing them sequentially:

DPDPA overlap: controls A.5.34 (privacy), A.8.11 (data masking), A.8.10 (deletion), A.5.33 (data protection) directly address DPDPA technical safeguard obligations. Joint implementation saves 35–40%.
CERT-In overlap: ISO 27001 incident management controls A.5.24–A.5.28 address the CERT-In IRP requirement. Log management A.8.15 addresses 180-day retention. NTP synchronisation is addressed under A.8.17.

Corpfy designs implementation in a unified control framework mapped to all applicable standards simultaneously.

Key Takeaways — ISO 27001 Certification for Indian Startups

ISO 27001 is now a procurement gate, not a differentiator, in Indian enterprise sales:

Enterprise customers — banks, insurance companies, large Indian corporates, and central government departments — have moved from "nice to have" to mandatory in their vendor qualification criteria. RFPs from BFSI companies routinely require an ISO 27001 certificate as a pass/fail criterion before technical evaluation. Starting certification 6–9 months before your first major enterprise deal is the minimum viable timeline.

The Statement of Applicability is the most important document in your ISMS:

Every certification auditor starts with the SoA. A well-prepared SoA with clear, business-justified inclusion and exclusion decisions for all 93 controls is the difference between a smooth Stage 1 audit and multiple major non-conformities that delay your certification by months. Treat the SoA as a strategic document, not a checkbox.

Transition to ISO 27001:2022 before October 2025 is mandatory:

All ISO 27001:2013 certificates must be transitioned to the 2022 version by October 2025. The 11 new controls — particularly cloud security (A.5.23), threat intelligence (A.5.7), data masking (A.8.11), and DLP (A.8.12) — require real implementation work. If you are planning certification now, target 27001:2022 directly.

Only use IAF-accredited certification bodies — unaccredited certificates are rejected:

Enterprise procurement and government tender evaluation teams verify whether your certification body is accredited by an IAF member (UKAS, DAkkS, NABCB). Low-cost unaccredited certificates will not pass scrutiny and cannot be used in RFP submissions.

ISO 27001 and DPDPA controls overlap by 35–40% — implement both together:

DPDPA's technical safeguard obligations map directly to ISO 27001 Annex A controls in domains A.5 and A.8. Implementing both frameworks simultaneously — using a single unified control framework mapped to both standards — is 35–40% more cost-efficient than sequential implementation.

Inside Corpfy ISO 27001 Readiness

Corpfy's ISO 27001 Readiness dashboard tracks all 93 Annex A controls from ISO 27001:2022, organised across four themes: Organisational, People, Physical, and Technological. Each control has a status, SoA justification, evidence attachment, and owner — the live control register the ISO 27001 Audit page's gap analysis reads from.

Capability	What it does	Output
93-Control Annex A Register	Full ISO 27001:2022 control list with status, owner, and justification	Statement of Applicability (SoA) ready for Stage 1 audit
ISMS Scope Builder	Define which assets, processes, and locations are in scope	Scope document in ISO-expected format
Risk Register	Asset-level risk assessment with likelihood × impact scoring	Risk Treatment Plan accepted by BSI, TÜV SÜD, Bureau Veritas
Internal Audit Tracker	Schedule and log internal audits per Clause 9.2	Internal audit programme evidence for surveillance audits
2022 Transition Gap Analysis	Maps 11 new controls against your existing 2013 register	Transition readiness report for October 2025 deadline

Everything you need is natively built in Corpfy — no third-party tools required. Control evidence tickets are managed inside Corpfy Product Management, the Jira-equivalent task and issue tracker built directly into the platform. Policy documentation is handled by Corpfy Policy Management with version control, employee acknowledgement, and audit-ready export — no Confluence needed. All evidence, signed policies, and audit artefacts are stored in Corpfy Vault, the secure document store available across every compliance module.

Integrations are also supported for teams already invested in external tools. If your engineering team works in Jira, your compliance team uses Confluence, or your organisation runs on Google Workspace — Corpfy connects to these so evidence raised externally can be linked to your control register without duplicating work. Third-party integrations are optional; the full compliance workflow runs natively without them.