ISO 27001 certification, done with you and for you.

ISO/IEC 27001 is the international standard for an Information Security Management System (ISMS). It sets requirements for managing information security risk through leadership, risk assessment, controls and continual improvement, and it can be independently certified by an accredited certification body. The current version is ISO/IEC 27001:2022.

With Cyber Veda, a typical small-to-medium business reaches audit-ready in about eight weeks. The certification body then runs Stage 1 (documentation review) and Stage 2 (implementation audit), usually a few weeks apart. Your timeline depends on scope, size and what already exists.

The number of people, sites and systems in scope sets the starting point. Then we work with you on the total cost of ownership, not just our fee: certification audits, any platform, your team’s time and the surveillance years after. We shape the engagement to get the most value from your budget, and send a written proposal after a free 30-minute consultation. The certification body’s audit fee is paid to them directly.

Some government and enterprise tenders require ISO 27001 outright. Many more score it as evidence of mature information security, and some accept equivalent controls such as Essential Eight. We read the tender requirements with you first so you only build what is actually needed.

Yes. Our internal audit tests your ISMS and is required by the standard, but only an accredited certification body can certify you. You engage and pay them directly. We recommend and introduce certification bodies we have worked with, based on your region and industry, and support you through their Stage 1 and Stage 2 audits.

Nobody independent can honestly guarantee a certification outcome, because the certification body decides. What we do is test your system against the same criteria the auditor uses, through a full internal audit, and fix what we find before they arrive.

ISO 27001 is an international certification of your Information Security Management System and is the most widely recognised in Australia, Europe and Asia. SOC 2 is an attestation report against the AICPA Trust Services Criteria, most often requested by US customers. Many controls overlap, so we can build once and map to both.

ISO/IEC 27001:2022 Annex A lists 93 controls in four themes: 37 organisational, 8 people, 14 physical and 34 technological. They are a reference set, not a checklist: you select the ones your risk assessment calls for.

No. You decide which controls apply based on your risks, and record each decision, with a justification for anything excluded, in a Statement of Applicability. The certification auditor checks that your choices are reasoned and that the selected controls work.

The Statement of Applicability (SoA) is a mandatory ISO 27001 document listing every Annex A control, whether it applies to you, why, and whether it is implemented. It is one of the first documents a certification auditor reads, and one of the most useful to get right.

Certificates are valid for three years, with surveillance audits in years one and two and a recertification audit in year three. Our Managed Compliance retainer keeps your ISMS running so surveillance audits are routine.