ISO 27001 for Indian SMEs, Explained in Plain Words
ISO 27001 has a reputation for being paperwork-heavy and expensive. Some of that is fair. Most of it comes from people not knowing what the standard actually asks for. Here is the short version for a small or mid-sized Indian business.
💡 In Simple Terms (For Beginners)
ISO 27001 has a reputation for being paperwork-heavy and expensive. Some of that is fair. Most of it comes from people not knowing what the standard actually asks for. Here is the short version for a small or mid-sized Indian business.
- ISO 27001 is a standard for running information security as a managed process, not a list of tools to buy.
- The 2022 edition has a short set of management clauses plus Annex A, a menu of 93 controls in four groups.
- It helps with the "reasonable security safeguards" part of the DPDP Act but does not make you DPDP compliant by itself.
- Certification is worth it when customers or tenders ask for it. Otherwise, start with the basics and decide later.
COMPLIANCE · September 30, 2026 · 7 min read · By Hardik Patel
What ISO 27001 actually is
ISO/IEC 27001 is an international standard for an Information Security Management System (ISMS). That is a formal way of saying: a repeatable method for finding your information risks, deciding what to do about them, doing it, and checking that it worked.
The standard does not tell you which firewall to buy. It asks whether you know what data you hold, who can reach it, what could go wrong, and whether you have controls that match those risks. A ten-person accounting firm and a 500-person factory can both follow it, because the scope and the depth are yours to define.
The current edition is ISO/IEC 27001:2022. Certificates issued under the older 2013 edition had a transition deadline, so any new project should be built on the 2022 edition.
The parts of the standard
The main body has seven clauses that you must satisfy (clauses 4 to 10). In plain words:
- Context. What does your business do, who cares about your data, and what part of the business is in scope?
- Leadership. Someone senior owns security and signs off the policy. It cannot be delegated entirely to the IT person.
- Planning. You run a risk assessment, decide how to treat each risk, and set measurable security objectives.
- Support. People are trained, roles are clear, and documents are controlled.
- Operation. You actually carry out the risk treatment.
- Performance evaluation. Internal audits, management review, monitoring.
- Improvement. When something fails, you fix the cause and record it.
Two documents matter most. The risk assessment and treatment record shows how you decided. The Statement of Applicability lists every Annex A control, says whether you use it, and gives a reason. An auditor will read the Statement of Applicability closely.
Annex A at a glance
Annex A is the menu of controls you choose from. In the 2022 edition there are 93 controls in four themes:
| Theme | Number of controls | What it covers, in plain terms |
|---|---|---|
| Organisational | 37 | Policies, roles, asset lists, supplier security, incident handling, legal and contractual requirements |
| People | 8 | Screening, terms of employment, awareness training, what happens when someone leaves |
| Physical | 14 | Office access, secure areas, clear desk, equipment protection |
| Technological | 34 | Access control, MFA, encryption, backups, logging, patching, vulnerability management, secure development |
You are not required to implement all 93. You must consider all 93 and justify any you leave out. A business with no in-house software development can reasonably mark secure-coding controls as not applicable, and say why.
Some controls will feel familiar because they are the basics: strong authentication, tested backups, patching, restricting admin rights, and staff awareness. A vulnerability assessment or penetration test is the usual way to give evidence for technical vulnerability management.
How ISO 27001 relates to the DPDP Act
India's Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 govern personal data. The main obligations for data fiduciaries take effect on 13 May 2027, unless MeitY notifies a different date. Confirm the current date on MeitY's site.
The two overlap in one place: the Act requires a data fiduciary to protect personal data through reasonable security safeguards. An ISMS is a structured way to meet that. Access control, encryption, logging, backups and incident response from Annex A line up closely with the safeguards the Rules describe.
The two are not the same thing, though:
- ISO 27001 does not cover consent management, privacy notices, data principal rights (access, correction, erasure), handling of children's data, or the specific breach notification duties in the DPDP Rules. You need separate work for those.
- The DPDP Act does not require ISO 27001 certification. A certificate is evidence of good practice, not a legal shield.
- The penalty schedule of the Act allows a penalty of up to ₹250 crore for failing to take reasonable security safeguards. That is a ceiling set by law, not a typical outcome, but it explains why boards are paying attention.
If DPDP is your main driver, start with a DPDP gap assessment. Use ISO 27001 as the security backbone underneath it if you also need the certificate.
When it is worth it, and when it is not
It usually is worth it when:
- Enterprise or bank customers ask for it in vendor questionnaires or tenders.
- You provide IT services, software or outsourced processing and handle client data.
- You export services and overseas customers expect an independent assurance.
- You want one framework that ties your policies, audits and risk register together.
It usually is not the right first step when:
- Nobody has asked for it and you have not yet done the basics: MFA, backups, patching, staff awareness.
- You have no one who can own the ISMS day to day. A certificate without upkeep decays quickly, and certification bodies check this in yearly surveillance audits.
On cost: it varies with scope, headcount and the certification body, so this post gives no rupee figures. Get written quotes from at least two certification bodies accredited in India (NABCB accredits them) and compare what is in scope. Ask about the surveillance audits in years two and three as well, since a certificate runs on a three-year cycle.
Key takeaways
- ISO 27001 is a management method for information risk, not a product.
- Annex A 2022 has 93 controls in four themes. You justify each one you include or exclude.
- It supports the DPDP security duty but leaves consent, notices and data principal rights untouched.
- Get certification when the market asks for it. Until then, the basics come first.
- Budget for upkeep, not just for the first audit.
Frequently asked questions
Q: Is ISO 27001 mandatory for Indian companies?
A: No. It is voluntary. Some customers, tenders and sector regulators expect it or something similar, but there is no general legal requirement to hold the certificate.
Q: Does ISO 27001 make us DPDP compliant?
A: No. It helps with the security safeguards duty. You still need consent, notices, rights handling, retention rules and breach notification processes as the DPDP Act and Rules require.
Q: How long does certification take?
A: It depends on scope, size and how much is already in place. Firms that already have documented policies and a risk register move faster. Ask your certification body and consultant for a written plan instead of relying on a generic number.
Q: Can a small business do this without a full-time security team?
A: Yes, if scope is kept tight and someone senior owns it. The standard scales with the organisation. What it does not tolerate is nobody owning it.
Q: What is the difference between ISO 27001 and ISO 27701?
A: ISO 27701 is an extension for privacy information management that builds on 27001. Ask whether it is relevant only after your security management system is in place.
How iTechFixr can help
If your first question is what the DPDP Act means for the personal data you hold, our DPDP Act compliance service starts with a gap assessment and a plan you can work through before the 13 May 2027 date. If you need technical evidence for Annex A, such as a vulnerability assessment and penetration test, see our cybersecurity audit and VAPT service.
Need Help With This?
Talk to Hardik directly about your organisation's cybersecurity needs — get a tailored response within 24 hours.
