ISO/IEC 27001:2022 certification in India: the management system, Annex A, the audit stages and what auditors ask for

ISO/IEC 27001:2022 is the international standard for an information security management system, or ISMS. ISO publishes it as edition 3, issued in October 2022, and describes it as the world’s best-known standard for information security management systems. It sets out the requirements an ISMS must meet, and any organisation, of any size, can use it. Certification is optional: it is one way to show customers and regulators that an independent body has audited how you manage information security.

If you hold a certificate to the 2013 edition, it is no longer current. This guide covers what the 2022 edition asks, how Annex A and the Statement of Applicability work, how certification audits run in India, and what auditors ask for.

What is ISO/IEC 27001:2022?

The standard defines requirements for establishing, implementing, maintaining and continually improving an ISMS. It does not prescribe a list of technologies. The organisation decides its scope, assesses its information security risks, chooses controls to treat them, and then runs the system so that it keeps working.

Three related documents are worth knowing apart:

• ISO/IEC 27001:2022 contains the requirements an organisation is audited against. A short amendment, ISO/IEC 27001:2022/Amd 1:2024, carries the title "Climate action changes".
• ISO/IEC 27002:2022 is guidance on the controls, published in February 2022. It is not a certification standard.
• ISO/IEC 27006-1:2024 sets requirements for the bodies that audit and certify an ISMS, so that certification is issued competently, consistently and impartially.

ISO asks that the full reference be used, for example "certified to ISO/IEC 27001:2022", and not just "certified to ISO 27001".

What the management system has to show

The standard’s text is not public, so we describe the requirements by topic and not by clause number. For the clause-by-clause view, see the ISO 27001:2022 requirements page. A certification body’s published procedure shows what it reviews at Stage 1: the information security policy, objectives, risk assessment and treatment, the Statement of Applicability, internal audit and management review.

In plain terms, you are expected to have:

• A defined scope for the ISMS, including its boundaries and interfaces with activities outside it
• A policy and objectives that leadership owns
• A repeatable risk assessment and a risk treatment plan
• A Statement of Applicability tied to that treatment
• Controls that operate, with records showing they do
• Internal audit and management review at planned intervals
• Corrective action when something does not conform

How do the 93 Annex A controls work?

ISO/IEC 27002:2022 contains 93 controls, down from 114 in the previous edition, and the same controls appear as Annex A of ISO/IEC 27001:2022. The SC 27 committee’s journal records that 24 current controls came from merging earlier ones and that 11 are new. The controls fall into four themes:

You do not implement all 93 by default. The organisation compares its risk treatment with Annex A and produces a Statement of Applicability. The ISO 27001:2022 security controls page goes through the controls in more detail.

What is the Statement of Applicability?

It is the document that links risk to controls. For each Annex A control it records whether you apply it, why, and, if you do not, the reason. Certification bodies ask for it with the application, and one published Indian procedure checks at Stage 1 that there is at least one Statement of Applicability per certification scope, and that it reflects the scope and the risk treatment.

How does certification work, step by step?

ISO does not run certification. Independent certification bodies do, and in India those that are accredited are accredited by NABCB. The stages below follow the published ISMS assessment procedure of an Indian certification body, so other bodies may vary in detail.

1. 1Application. You submit your policy documents, Statement of Applicability and scope.
2. 2Stage 1. The auditor reviews the ISMS documentation and your readiness for Stage 2. At least one complete cycle of internal audit and management review must be done by this point. In that procedure, Stage 1 usually takes place on your premises and lasts one to four days depending on size. Nonconformities must be corrected before Stage 2.
3. 3Stage 2. The auditor checks that you follow your own policies and that the ISMS conforms to the standard and is effective. The assessment is based on sampling.
4. 4Nonconformities. A major nonconformity is the absence or failure of a required element. A minor one is a single lapse. Root cause and corrective action evidence is requested, and if corrections are not verified within six months of Stage 2, another Stage 2 is needed.
5. 5Decision. The reports go to the certification body’s committee for the certification decision.
6. 6Surveillance and recertification. The body keeps a three-year audit programme for each client. Ask for its surveillance schedule when you contract.

What changed with the 2022 transition?

IAF MD 26 (Issue 2, 15 February 2023) set the rules for accredited certification bodies. Initial certification and recertification to the 2022 edition had to begin by 30 April 2024. Transitions of certified clients had to be completed by 31 October 2025, and certifications to the 2013 edition were to expire or be withdrawn at the end of that period. A transition audit covers the gap analysis, an updated Statement of Applicability and risk treatment plan where needed, and how new or changed controls are implemented and working. It cannot rely only on document review.

What do auditors ask for?

A readiness checklist

Where the work usually gets stuck

Policies exist but the evidence of operation is thin. Risk assessments are done once. Internal audit skips parts of the standard. Management review minutes miss required inputs. Exclusions in the Statement of Applicability are not tied to a risk. Evidence sits in email and shared drives when the auditor arrives.

How this is run as owned work in Netra

Netra loads ISO/IEC 27001:2022 as requirements, tasks and policies. Each requirement and control becomes a task with an owner, due date and recurrence, and evidence is attached once and reused where the same work serves another framework, such as SOC 2. Status is derived from completed work and evidence rather than typed in. The Audit Centre supports internal audit, findings and corrective actions, and the dashboard supports management review reporting.

Netra supports implementation and audit preparation. Certification is assessed and issued by an independent certification body. For a wider view of preparation, see the audit readiness checklist.

This article is a summary for general information. The standard is a copyrighted ISO publication, and this article does not reproduce it. Obtain the standard and confirm requirements with your certification body.