Secure · Governance, risk and compliance
ISO/IEC 27001:2022 implementation and audit readiness for Indian organisations whose customers, regulators or parent companies ask for the certificate. NetScale assesses the gaps, builds the information security management system and runs the internal audit, then supports the certification audit and keeps the evidence current. Each phase is fixed-scope and signed off separately.
ISO 27001
ISO/IEC 27001 is the international standard for an information security management system (ISMS): the policies, risk process and controls that protect information, and the evidence that they work.
Certification comes from an accredited certification body, through a certification audit and then surveillance audits. NetScale builds the system and prepares you for each audit; it does not issue the certificate.
The privacy standard, certified on its own or alongside this one, sits under ISO 27701:2025 privacy management.
ISO 27001, DPDP, CERT-In and customer contracts run on one control set sit under Governance, risk and compliance frameworks.
The technical design of the controls themselves sits under Security architecture and GRC.
Certification was pursued to win contracts. The auditor now asks for evidence. How long does it take to produce?
Our answer: Internal audit and audit preparation
The surveillance audit is due. Who has kept the records current since the last one?
Our answer: Surveillance audit support
The certificate’s scope was set for the first audit. Which systems have been added since?
Our answer: ISMS implementation
A customer sends a security questionnaire before renewal. Who answers it?
Our answer: ISO 27001:2022
Information security management system implementation and audit to the current standard, with evidence kept current between audits.
Clauses, Annex A controls, policies and records compared against ISO/IEC 27001:2022, each gap written up with the evidence an auditor will ask for.
Scope, risk assessment and treatment, the Statement of Applicability and policies, built in fixed-scope phases and signed off separately.
An internal audit and management review before the certification audit, with findings closed and the evidence ready to show.
VAPT and penetration testing, phishing simulation and security awareness training, run on a schedule and filed as ISMS evidence.
Access reviews, risk register updates and corrective actions kept current between audits, so each surveillance audit draws on records already in place.
One management system, drawn three times.
You can stop at any phase boundary. The assessment is free, and each phase is priced in writing before it starts.How we engage
No Indian law requires ISO 27001 of most organisations. SEBI’s cybersecurity framework (CSCRF) makes it mandatory for market infrastructure institutions and the entities it classes as Qualified REs, and for the providers that run their outsourced data centre, DR site, SOC or colocation. Customer contracts and global parent companies commonly ask for the certificate too. Your counsel or auditor can confirm what applies to you.
Under the Directions of April 2022, logs are kept for a rolling 180 days within India and clocks synchronised to NIC or NPL. The ISMS’s logging and clock synchronisation controls are written to meet both.
Certificate scope: the sites, systems and processes the certificate will cover.
Starting point: how much policy, control and evidence already exists.
Sequence: ISO 27001 alone, or with ISO 27701 in one programme.
Certification body fees, which the body charges separately from implementation.
The most relevant engagement, with its numbers. Client names and the full write-up are shared in conversation.
Industrial manufacturing · Nine plants, seven cities
How a multi-site industrial company scoped a security programme across its network, devices, user access and sites.
Privileged access management
Email security and awareness
Endpoint protection
Cloud platform and identityOur own: ISO/IEC 27001:2022
It depends on scope and starting point: how many sites, systems and processes the certificate covers, and how much policy and evidence already exists. The gap assessment gives you a written timeline by phase before you commit. Each phase is fixed-scope and signed off separately.
Implementation and certification are charged separately. Our implementation fee depends on the certificate’s scope, how much policy, control and evidence already exists, and whether ISO 27001 runs alone or with ISO 27701 in one programme. The certification body charges its own fees for the audits. The gap assessment is free, and the findings are yours either way.
No, not by law for most organisations. SEBI’s cybersecurity framework (CSCRF) makes it mandatory for market infrastructure institutions and the entities it classes as Qualified REs, and many customer contracts require it. Where a contract asks for it, the gap assessment shows how far you are from certification. Your counsel or auditor can confirm what applies to you.
Evidence that the management system runs as written. That starts with the scope, the risk assessment and treatment plan, the Statement of Applicability and the policies. Then come internal audit and management review records, and proof that the chosen controls work, such as access reviews and logs. The gap assessment lists what is missing.
No. Certification comes from an accredited certification body, which keeps the audit independent of whoever built the system. We implement the system, run the internal audit and prepare you for the certification audit. Our own certificates were issued the same way, by Quality Control Certification, accredited by UASL.
The Statement of Applicability (SoA) is the document that lists every Annex A control and says whether each applies to you, and why. It also records whether each one is in place, and auditors start from it. We write it from your risk assessment, so every control traces back to a risk you have rated.
Surveillance audits. The certification body returns to check that the system still runs, and recertifies before the certificate expires. Between audits the work is keeping evidence current: access reviews, risk register updates, internal audits and corrective actions. We can run that for you, or hand it over as yours.
It costs nothing and commits you to nothing. You get a written list of where your IT environment is exposed, and your team can act on it with or without us.
