In short
ISO/IEC 27001:2022 is the international standard for an information security management system (ISMS): the policies, risk process, roles and controls an organisation uses to protect information. You assess your risks, choose controls from Annex A to treat them, and prove they work. An independent certification body then audits you and issues a certificate for a defined scope. It is voluntary in India, but for software it means access control, logging, secure development and change management you can show to an auditor.
Who it applies to
ISO/IEC 27001 is voluntary. Any organisation, of any size or sector, can adopt it. In practice, these are the ones that need it and those who ask:
- Software and IT service vendors whose enterprise or overseas clients put it in vendor questionnaires and contracts.
- Bidders for tenders that list ISO/IEC 27001 certification as an eligibility condition.
- Businesses holding sensitive personal data. Rule 8 of the SPDI Rules 2011 says a business that has implemented IS/ISO/IEC 27001 is deemed to follow reasonable security practices. The practices must be audited by an independent auditor at least once a year, and again after significant upgrades. See IT Act and SPDI Rules.
- Suppliers to regulated firms in banking, capital markets and insurance, which must manage their vendors’ security.
What certification involves. A Stage 1 audit reviews your documents and readiness. A Stage 2 audit checks that the ISMS works in practice, through interviews, records and site visits. Nonconformities must be corrected before the certificate is issued. The certificate is normally valid for three years, with a surveillance audit every year and a recertification audit before expiry.
Who certifies. Certification bodies are accredited in India by NABCB, which assesses them against ISO/IEC 27006. Check that the body is accredited for ISO/IEC 27001:2022 and that the certificate’s scope covers the service your client buys.
The 2022 transition. Certificates against the 2013 edition expired or were withdrawn after 31 October 2025. A current certificate must cite ISO/IEC 27001:2022.
What it means for your website
ISO/IEC 27001 has no rules written specifically for websites. If your website or customer portal falls inside the ISMS scope, its hosting, encryption, patching and changes are audited like any other system. If you mention certification on the site, state the scope accurately: a certificate for one office or service does not cover the whole company.
What it means for your software
How the standard is built
Clauses 4 to 10 are mandatory: context of the organisation, leadership, planning, support, operation, performance evaluation and improvement. They require a risk assessment, risk treatment, internal audits and management review. Annex A lists 93 controls in four themes: organisational (37), people (8), physical (14) and technological (34). You select controls through risk treatment and record each choice, with reasons, in a Statement of Applicability (clause 6.1.3 d). Of the 93 controls, 11 are new in the 2022 edition.
Access control (5.15 to 5.18)
Controls 5.15 access control, 5.16 identity management, 5.17 authentication information and 5.18 access rights apply directly to business software. The system needs a unique login for each person, role-based permissions, strong authentication and a quick way to remove access when someone leaves. Auditors look for periodic access reviews and records of who approved each right.
Logging and monitoring (8.15, 8.16)
Control 8.15 requires logs of activities, exceptions and faults to be produced, kept, protected and analysed. Control 8.16 requires monitoring for unusual behaviour. In an ERP or CRM, that means logging logins, failed attempts, permission changes and edits to key records. Logs must be protected from tampering.
Secure development (8.25 to 8.31)
Seven controls cover how software is built: 8.25 secure development life cycle, 8.26 application security requirements, 8.27 secure system architecture and engineering principles, 8.28 secure coding, 8.29 security testing in development and acceptance, 8.30 outsourced development, and 8.31 separation of development, test and production environments. If a vendor builds your software, control 8.30 makes you responsible for directing and checking their work.
Change management and test data (8.32, 8.33)
Control 8.32 requires changes to systems to follow a change management process. Control 8.33 requires test information to be chosen and protected with care. Keep a record of who requested, approved, tested and released each change. Do not copy live customer data into test systems without masking it.
Vulnerabilities, configuration and backups (8.8, 8.9, 8.13)
Control 8.8 covers managing technical vulnerabilities, which is where VAPT and patching fit. Control 8.9 covers configuration management, and 8.13 covers backups. See VAPT for how independent testing supports these controls.
Encryption, cloud and incidents (8.24, 5.23, 5.24 to 5.28)
Control 8.24 covers the use of cryptography, and 5.23 covers security for cloud services. Controls 5.24 to 5.28 cover incident management, from planning through response, learning and collecting evidence. Your software should help you find out quickly what happened, when and to which records.
Checklist
- Decide the ISMS scope: which services, offices, systems and teams the certificate will cover.
- Run a risk assessment and decide how to treat each risk.
- Write the Statement of Applicability against all 93 Annex A controls, with reasons.
- Set up role-based access, unique logins and periodic access reviews in every system in scope.
- Turn on security logging, protect the logs and review them.
- Document your development life cycle, coding standards, testing and change approvals.
- Separate development, test and production, and mask real data used in testing.
- Run internal audits and a management review before the Stage 1 audit.
- Choose a certification body accredited by NABCB, or by another IAF member, for ISO/IEC 27001:2022.
- Plan for yearly surveillance audits and recertification in year three.
How Kreon helps
The systems we build support the controls auditors check: role-based access, security logging, and an audit trail that records before and after values and allows reverts. We can prepare an ERP, CRM or web system for your ISO/IEC 27001 audit and fix the gaps auditors find. Certification itself comes from an accredited certification body.