ISO 27001 certification · GRC software
Get ISO 27001 certified, and stay certified.
ISO 27001 is the international standard for an information security management system. AEGIS builds your ISMS, risk assessment and Statement of Applicability from a short interview, then keeps the evidence current through every surveillance audit.
Every framework on every plan, priced by team size. You choose your auditor.
The basics
What is ISO 27001?
ISO/IEC 27001 is the international standard for running an information security management system (ISMS). It sets out how you identify information security risks, choose controls to treat them and keep improving. An accredited certification body audits you and, if you meet the standard, issues a certificate.
The current version is ISO/IEC 27001:2022. The transition period for certificates issued against the 2013 version ended on 31 October 2025, so new certificates are issued against 2022.
Requirements
What ISO 27001:2022 asks for
Clauses 4 to 10 are mandatory for every organisation. Annex A lists 93 controls, and you justify which apply in your Statement of Applicability.
- Clauses 4 to 10Context and scope, leadership, planning, support, operation, performance evaluation and improvement.
- Organisational controls37 controls, from policies and supplier security to incident management.
- People controls8 controls, including screening, awareness training and remote working.
- Physical controls14 controls covering offices, equipment and secure areas.
- Technological controls34 controls, from access and logging to secure development and vulnerability management.
- ISO 27002The guidance document that explains how to implement each Annex A control.
Explained
How does ISO 27001 certification work?
Certification is a two-stage audit. In Stage 1 the certification body reviews your ISMS documentation and readiness. In Stage 2 it checks that the controls are actually working. Pass both and you get a three-year certificate.
Surveillance audits follow in years one and two, and a recertification audit in year three. This is where most programs slip: AEGIS keeps collecting evidence between audits, so each surveillance visit is a walkthrough.
Checklist
ISO 27001 checklist
What an auditor or regulator will want to see. AEGIS generates each of these as a control, policy or evidence task, with an owner.
- Scope: define the ISMS boundary: teams, systems, locations.
- Risk assessment: identify, score and treat information security risks.
- Statement of Applicability: which Annex A controls apply, and why.
- Policies: the policy set the standard requires, approved by management.
- Internal audit: an independent check of the ISMS before the certification audit.
- Management review: leadership reviews performance and sets improvements.
- Evidence: proof each applicable control operates, kept current between audits.
- Vulnerability management: technical vulnerability management (control 8.8), often evidenced with a pentest.
With AEGIS
Get ISO 27001 ready, then stay ready.
Gets you compliant
From zero to ready
- A short security interview scopes ISO 27001 for your company, with a reason for every control.
- Controls, policies, risk register and evidence backlog are generated in an afternoon.
- AI drafts each policy in your real context; a person on your team approves it.
- Evidence collects from your cloud, code, identity and devices.
Keeps you compliant
Current every day after
- Checks keep running and evidence keeps collecting after the audit.
- Access reviews, training and policy sign-offs come round on schedule, with owners.
- A control that drifts shows up before your next audit, and a check that cannot run never counts as a pass.
- ISO 27001 shares one control set with every other framework, all included on every plan.
Your auditor, your choice
Pick the auditor that fits your buyers.
ISO 27001 certificates are issued by certification bodies accredited by a national body, such as ANAB in the US or NABCB in India. You choose the body that fits your buyers and budget, tier 1, 2 or 3, US-based or India-based. We help you choose, and AEGIS gives your auditor read-only access to the ISMS and evidence.
Works with Nexus Void
Security work that becomes ISO 27001 evidence.
VAPT
Penetration testing
Technical vulnerability management (Annex A 8.8) is usually evidenced with a pentest. Our VAPT report files into AEGIS as that evidence.
Explore VAPTARGUS
Code security
Secure development controls (Annex A 8.25 to 8.29) map to ARGUS. Code findings become risks and evidence, and a Secure Code check fails while a critical finding is open.
Explore ARGUSOther frameworks
One control set, every framework included.
Questions
ISO 27001 questions, answered.
How long does ISO 27001 certification take?
AEGIS builds the ISMS, risk register and Statement of Applicability in an afternoon. Audit-ready then depends on closing real gaps and running an internal audit and management review. The certification body sets the Stage 1 and Stage 2 dates.
What changed in ISO 27001:2022?
Annex A went from 114 controls in 14 domains to 93 controls in 4 themes, with 11 new controls such as threat intelligence, cloud services security and secure coding.
How much does ISO 27001 cost?
The certification fee is set by the certification body and depends on its tier, your scope and headcount. AEGIS is priced by team size, and every plan includes ISO 27001 and every other framework we support.
ISO 27001 or SOC 2?
ISO 27001 is a certificate recognised worldwide; SOC 2 is the attestation US buyers often ask for. Most controls overlap, and AEGIS maps both onto one control set.
Do we need a consultant?
Many teams hire one to write the ISMS. AEGIS drafts it for you from your real context, and a person on your team reviews and approves every policy.
Can we choose our certification body?
Yes. Pick an accredited body, tier 1, 2 or 3, US-based or India-based, and AEGIS gives them read-only access.
Updated 22 October 2026 by the Nexus Void team.
ISO 27001 with AEGIS
Get ISO 27001 ready, and keep it that way.
Tell us who is asking for it and we will show you the path, and which auditors fit.