ISO 27001:2022 Certification Checklist for IT and SaaS Companies

To get ISO 27001 certified in 2026, an IT or SaaS company needs a working information security management system (ISMS) built to ISO/IEC 27001:2022: a defined scope, a risk assessment, a Statement of Applicability covering the 93 Annex A controls, evidence that the controls actually operate, an internal audit and a management review. A certification body then runs a two-stage audit. For a typical 30 to 200 person software company, preparation takes about three to five months.

This checklist sets out what auditors look for, which controls matter most for cloud-hosted products, and the Indian legal requirements that sit alongside the standard.

First, make sure you are working to the current version

The current edition is ISO/IEC 27001:2022, read with Amendment 1:2024, which asks you to consider whether climate change is a relevant issue for your ISMS when you analyse your context and interested parties. Certificates issued against the older 2013 edition expired after 31 October 2025, so any template, consultant or policy pack still built around the 114 controls of the 2013 version is out of date.

The 2022 Annex A has 93 controls grouped into four themes:

Theme	Number of controls	Examples
Organisational	37	Policies, supplier security, cloud services, incident management
People	8	Screening, awareness training, remote working
Physical	14	Office access, equipment, physical security monitoring
Technological	34	Access rights, logging, backup, secure coding

Eleven controls are new in 2022, including threat intelligence, information security for use of cloud services, ICT readiness for business continuity, configuration management, information deletion, data masking, data leakage prevention, monitoring activities, web filtering and secure coding.

Part 1: Mandatory ISMS documents and records (Clauses 4 to 10)

• ISMS scope, including the products, locations, teams and cloud environments covered (Clause 4.3)
• Information security policy approved by top management (Clause 5.2)
• Roles and responsibilities, with a named owner for the ISMS (Clause 5.3)
• Risk assessment and risk treatment methodology, the risk register and the risk treatment plan (Clauses 6.1.2, 6.1.3, 8.2 and 8.3)
• Statement of Applicability listing every Annex A control, whether it applies, why, and its status (Clause 6.1.3)
• Measurable information security objectives (Clause 6.2) and a process for planning changes to the ISMS (Clause 6.3)
• Evidence of competence and awareness training (Clauses 7.2 and 7.3)
• Monitoring and measurement results (Clause 9.1)
• Internal audit programme and report (Clause 9.2)
• Management review minutes (Clause 9.3)
• Nonconformity and corrective action records (Clause 10.2)

Part 2: Annex A controls auditors test hardest at SaaS companies

• Access control and identity: joiner, mover and leaver process, least privilege, quarterly access reviews and multi-factor authentication for production and admin consoles (5.15 to 5.18, 8.2, 8.5)
• Cloud services: a documented approach for selecting, using and exiting AWS, Azure or GCP and your SaaS tools (5.23)
• Secure development: secure development life cycle, code review, secure coding standards, separation of development, test and production, and change management (8.25 to 8.28, 8.31, 8.32)
• Configuration and vulnerability management: hardened baselines, infrastructure-as-code reviews, patching timelines and periodic penetration tests (8.8, 8.9)
• Logging and monitoring: centralised logs, alerting and log retention (8.15, 8.16)
• Backup and resilience: tested restores and a business continuity plan for your service (8.13, 8.14, 5.30)
• Data protection: encryption, data masking in non-production, data leakage prevention and secure deletion when customers leave (8.10 to 8.12, 8.24)
• Suppliers: security clauses and reviews for hosting, payment, email and support vendors (5.19 to 5.22)
• Incident management: a tested incident response plan with evidence collection and lessons learnt (5.24 to 5.28)
• People: background verification, confidentiality agreements, awareness training and remote working rules (6.1 to 6.7)

Part 3: Indian laws your ISMS should reflect

ISO 27001 is voluntary, but Clause 4.2 and control 5.31 require you to identify legal and contractual requirements. For Indian IT companies these usually include:

• CERT-In Directions of 28 April 2022 under Section 70B(6) of the Information Technology Act, 2000: reporting specified cyber incidents to CERT-In within 6 hours of noticing them, and keeping ICT system logs for a rolling 180 days within India.
• The Digital Personal Data Protection Act, 2023 and the DPDP Rules notified on 13 November 2025, which are being brought in over an 18-month phase (see our DPDP Act compliance checklist). They require reasonable security safeguards, breach intimation to the Data Protection Board and affected individuals, and contracts with processors.
• Customer contracts and data processing agreements, which often set shorter breach notice periods and audit rights.

Worked example: a 60-person SaaS company in Chennai

A Chennai product company with 60 staff hosts its platform on AWS in the Mumbai region and has two enterprise customers asking for ISO 27001. A realistic plan looks like this:

1. Weeks 1 to 2: gap assessment against Clauses 4 to 10 and Annex A, and agreement on scope (the product, its AWS environment and the Chennai office).
2. Weeks 3 to 6: risk assessment, Statement of Applicability, policies and procedures written around the tools the team already uses.
3. Weeks 7 to 14: controls put into practice, such as access reviews, MFA, logging, backup restore tests, vendor reviews and training, with evidence kept as it is generated.
4. Weeks 15 to 16: internal audit, management review and closure of findings.
5. Stage 1 audit (documentation and readiness), then Stage 2 audit (whether controls work in practice).

After certification, the certificate runs for three years with surveillance audits in the intervening years, so the ISMS has to keep operating.

How Vakil Labs supports ISO 27001

Our ISO team runs the gap assessment in one to two weeks, supports implementation over 8 to 16 weeks, conducts the internal audit and coordinates the certification audit. Certification audits are arranged through Vakil Labs’ tie-up with Veritas International (a JAS Global Certifications brand). Vakil Labs is a consultant and does not issue certificates. See our ISO 27001 certification consulting page, and our data privacy and DPDP compliance service for the legal side. If you already have ISO 9001, read our guide to the ISO 9001 certification process: the two standards share the same clause structure and can be run as one management system.

Common mistakes and red flags

• Scoping too narrowly, for example certifying only the office while the product runs in the cloud. Customers read the scope statement.
• Buying a generic policy pack that describes tools and processes your team does not use. Auditors test what you do, not what you wrote.
• No evidence trail. Access reviews, backup tests and training that happened but were never recorded count for little.
• Leaving suppliers out of the risk assessment when most of your stack is third-party SaaS.
• Treating the certificate as a one-time project and skipping internal audits in year two.
• Relying on a certificate from a body your customers do not recognise. Ask your key customers what they accept before you choose.

Frequently asked questions

Is ISO 27001 mandatory for IT companies in India?

No. It is a voluntary standard, but enterprise customers, banks, government tenders and overseas clients often ask for it in vendor due diligence.

How long does ISO 27001 certification take?

For a small or mid-sized software company, three to five months is typical from gap assessment to Stage 2 audit, depending on how many controls already exist.

Should we do ISO 27001 or SOC 2?

ISO 27001 is an international certification and is widely asked for in India, Europe and the Middle East. SOC 2 is an attestation report that US customers commonly request. Many SaaS companies build one control set that serves both. See our SOC 2 readiness service. For a detailed comparison, read ISO 27001 vs SOC 2: which one does your company need.

Does ISO 27001 make us compliant with the DPDP Act?

Not by itself. It helps show reasonable security safeguards, but the DPDP Act also covers notice, consent, the rights of individuals and breach intimation, which need separate legal work.

Clients and investors who ask for ISO 27001 often also check HR compliance. See our POSH Act compliance checklist for companies.

Talk to us

Vakil Labs combines ISO consulting with legal advice on contracts, privacy and compliance. Growing companies can also cover ISO, DPDP, contracts and labour compliance through one team under our Legal Retainer for Companies. Contact us or call +91 99416 26224. Book a call with an advocate

This article is for general information only and isn’t legal advice.