The international standard for information security management. ISO 27001 certification demonstrates to customers, partners, and regulators that your organisation takes information security seriously.
What is ISO 27001?
ISO/IEC 27001 is the world's leading information security management system (ISMS) standard, published by the International Organisation for Standardisation (ISO) and the International Electrotechnical Commission (IEC). The current version, ISO 27001:2022, was updated to reflect modern threats and cloud-based environments.
Certification requires organisations to establish, implement, maintain, and continually improve an ISMS, a systematic approach to managing sensitive company information so that it remains secure. It encompasses people, processes, and technology.
ISO 27001 is recognised globally and is often a contractual requirement for enterprise customers, government contracts, and regulated industries.
Compliance requirements
ISO 27001 is structured around 10 clauses (4-10 are mandatory) and 93 Annex A controls across four themes. Clauses 4 to 10 follow Annex SL, the common structure ISO uses across its management system standards, which is why an organisation already certified to ISO 9001 or ISO 22301 starts with a large part of the management system, the internal audit programme and the management review already in place.
Understanding internal and external issues, interested parties, and the scope of the Information Security Management System (ISMS).
Top management must demonstrate commitment to the ISMS, establish an information security policy, and assign roles and responsibilities.
Identify information security risks, assess likelihood and impact, and implement appropriate controls from Annex A to treat those risks.
ISO 27001:2022 contains 93 controls across four themes: Organisational, People, Physical, and Technological, selected based on your risk treatment plan.
A formal document listing all Annex A controls, whether each is applicable, and justification for inclusions and exclusions.
Regular internal audits and management reviews to ensure the ISMS remains effective, appropriate, and aligned with business objectives.
Audit process
Netru manages the complete ISO 27001 certification journey, from initial assessment through to certification body liaison.
We assess your current security posture against ISO 27001:2022 requirements, producing a prioritised remediation roadmap.
Your compliance manager designs the ISMS scope, policy framework, and risk methodology tailored to your organisation.
We implement the required Annex A controls, draft all required documentation, and build your evidence library.
A formal internal audit is conducted to verify the ISMS is operating effectively before the external certification audit.
The certification body reviews your ISMS documentation and confirms readiness for the Stage 2 audit.
The certification body conducts an on-site (or remote) assessment of your ISMS in practice. Netru manages the entire process.
Upon successful completion, you receive ISO 27001 certification, valid for three years with annual surveillance audits.
How Netru delivers it
Our team holds ISO 27001 lead auditor certifications. We design your ISMS, implement controls, conduct your internal audit, and manage the certification body relationship, so you can focus on your business.
Talk to our teamBefore you talk to anyone