ISO 27001:2022 for Indian Startups: How to Get Certified

ISO 27001:2022 is the international standard for Information Security Management Systems (ISMS). For Indian startups, it is no longer a nice-to-have — enterprise customers, government tenders, and DPDP Act compliance all increasingly expect it. The 2022 revision reduced the control count from 114 to 93, reorganised them into four themes, and added 11 new controls targeting modern threats: cloud security, threat intelligence, data masking, and more. This guide explains what changed, what the certification journey looks like, and what it realistically costs a startup in time and effort.

What Changed in the 2022 Revision

The International Organization for Standardization published ISO/IEC 27001:2022 in October 2022. The previous version (ISO 27001:2013) had 114 controls across 14 clauses. The 2022 revision restructured Annex A into four themes and trimmed overlapping controls. No controls were deleted entirely — most were merged or consolidated.

The Four Control Themes

The 11 New Controls

These are brand-new additions with no direct 2013 equivalent:

Why Indian Startups Need It Now

Enterprise Sales Gating

Large Indian enterprises — banks, insurance companies, PSUs, large tech firms — now include ISO 27001 certification as a mandatory vendor checkbox in procurement. Without it, your startup is filtered out before a demo.

DPDP Act 2023 Alignment

India's Digital Personal Data Protection Act 2023 mandates that Data Fiduciaries implement "reasonable security safeguards." ISO 27001's ISMS framework is widely accepted as the de facto evidence of such safeguards. The standard's new data masking (8.11) and information deletion (8.10) controls map directly to DPDP's data minimisation and erasure principles. For a deeper look at DPDP obligations, see our DPDP compliance guide.

Government Tenders and CERT-In Alignment

Central and state government tenders for IT services increasingly reference ISO 27001. CERT-In's empanelment criteria for security auditors also treat ISO 27001 as a prerequisite capability signal.

The Certification Journey

graph TD
    A[Gap Assessment] --> B[ISMS Design]
    B --> C[Risk Assessment and Treatment Plan]
    C --> D[Control Implementation]
    D --> E[Internal Audit]
    E --> F{Findings?}
    F -- Yes --> G[Remediation]
    G --> E
    F -- No --> H[Stage 1 Audit — Documentation Review]
    H --> I{Pass?}
    I -- No --> J[Close Nonconformities]
    J --> H
    I -- Yes --> K[Stage 2 Audit — On-site or Remote]
    K --> L{Major NCs?}
    L -- Yes --> M[Corrective Action Plan]
    M --> K
    L -- No --> N[Certificate Issued]
    N --> O[Surveillance Audit Year 1]
    O --> P[Surveillance Audit Year 2]
    P --> Q[Recertification Audit Year 3]

    style A fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0
    style B fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0
    style C fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0
    style D fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0
    style E fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0
    style F fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0
    style G fill:#5f1e1e,stroke:#EF4444,color:#e2e8f0
    style H fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0
    style I fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0
    style J fill:#5f1e1e,stroke:#EF4444,color:#e2e8f0
    style K fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0
    style L fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0
    style M fill:#5f1e1e,stroke:#EF4444,color:#e2e8f0
    style N fill:#1e3d2f,stroke:#10B981,color:#e2e8f0
    style O fill:#1e3d2f,stroke:#10B981,color:#e2e8f0
    style P fill:#1e3d2f,stroke:#10B981,color:#e2e8f0
    style Q fill:#1e3d2f,stroke:#10B981,color:#e2e8f0

Phase 1 — Gap Assessment (2–4 weeks)

Before writing a single policy, map your current state against all 93 Annex A controls and the 10 clauses of the main standard. Most early-stage startups find they have informal practices that partially cover 30–50% of controls. The gap assessment tells you exactly where to focus effort and prevents over-engineering.

Produce a gap assessment report with: scope definition, asset inventory, identified gaps, and a remediation roadmap.

Phase 2 — ISMS Design and Risk Assessment (4–8 weeks)

The ISMS is the management framework that governs how you identify, assess, and treat information security risks. Key outputs at this stage:

1. Information Security Policy — top-level commitment statement signed by leadership
2. Risk Assessment Methodology — how you score likelihood and impact
3. Statement of Applicability (SoA) — lists all 93 controls, marks which apply and why, and documents exclusions with justification
4. Risk Treatment Plan — maps each unacceptable risk to one or more controls

Phase 3 — Control Implementation (6–16 weeks)

This is the engineering and process work. For a tech startup, the heaviest lifts are typically:

1. Access control reviews (IAM, least privilege, MFA everywhere)
2. Asset inventory (cloud resources, endpoints, SaaS tools, data stores)
3. Supplier/vendor assessment process
4. Incident response procedure with defined escalation paths
5. Secure development lifecycle documentation (links directly to new control 8.28)
6. Business continuity and DR runbooks

Phase 4 — Internal Audit (2–3 weeks)

Before the external certification audit, you must run an internal audit — a structured evidence-gathering exercise that checks whether implemented controls are actually working. Internal auditors must be independent of the areas they audit; for a small startup, this often means cross-team or external consultants.

Internal audits surface nonconformities early, when fixing them is cheap.

Phase 5 — Stage 1 Audit (1–2 days)

The accredited certification body (CB) reviews your documentation: ISMS scope, policies, SoA, risk register, risk treatment plan, and internal audit results. Stage 1 is a desktop review — the auditor is checking whether you are ready for Stage 2. Minor issues (observations) are common; major nonconformities at Stage 1 delay the Stage 2 date.

Phase 6 — Stage 2 Audit (1–3 days)

Stage 2 is the on-site (or remote) audit where the auditor samples evidence of actual control operation. They will interview staff, inspect configurations, review logs, and test that documented procedures match reality. A startup with 20–50 people typically completes Stage 2 in one to two days.

Findings are classified as:

1. Observations — informational, no action required
2. Minor nonconformities — must be closed within 90 days, no delay to certificate
3. Major nonconformities — certificate withheld until the root cause is evidenced as fixed

Realistic Timeline and Effort for a Startup

The 2022 Control Themes — Distribution at a Glance

pie title ISO 27001:2022 — Controls by Theme
    "Organisational (37)" : 37
    "Technological (34)" : 34
    "Physical (14)" : 14
    "People (8)" : 8

The heavy weighting toward Organisational and Technological controls reflects the reality of modern threats: policy gaps and technology misconfigurations cause far more incidents than physical breaches or untrained staff.

How ISO 27001 Complements DPDP

The DPDP Act 2023 requires Data Fiduciaries to "implement appropriate technical and organisational measures" to protect personal data. ISO 27001 provides exactly that framework, with documented evidence. Specific overlaps:

1. Data masking (8.11) → DPDP data minimisation in non-production environments
2. Information deletion (8.10) → DPDP erasure and right-to-be-forgotten obligations
3. Supplier management controls (5.19–5.22) → DPDP Data Processor agreements and third-party due diligence
4. Incident response (5.26, 5.28) → DPDP breach notification obligations
5. Access control (8.2–8.6) → DPDP purpose limitation and need-to-know access

Where Technical Security Fits In

ISO 27001 is a management-system standard — it defines what you must do, not how. Technical controls like vulnerability management (8.8), penetration testing (5.36), and secure coding (8.28) are required by the standard, but the evidence of implementation comes from your actual security tooling and testing results.

This is where automated vulnerability scanning becomes evidence, not just a tool. Running periodic automated VAPT against your infrastructure and applications — and being able to show the auditor your scan results, remediation history, and re-test outcomes — directly satisfies control 8.8 (management of technical vulnerabilities). Bachao.AI provides automated VAPT that generates audit-ready reports suitable for ISO 27001 evidence packages. You can start with a free VAPT scan to establish your current vulnerability baseline.

Choosing a Certification Body

Accreditation matters. Your certification body must be accredited by a member of the International Accreditation Forum (IAF). In India, the National Accreditation Board for Certification Bodies (NABCB) accredits CBs. Well-regarded accredited CBs operating in India include Bureau Veritas, BSI Group, TÜV SÜD, and SGS. Verify NABCB accreditation before signing any engagement.

Reference: ISO/IEC 27001:2022 official page — iso.org | NABCB accredited certification bodies — nabcb.qci.org.in