Governance, Risk & Compliance
An ISO 27001 certification consultant in India can get you a certificate in a few months. The harder question is whether the management system behind it still functions at the first surveillance audit, when the consultant has gone and someone internal has to produce a year of risk reviews, internal audits and management meetings.
ISO 27001:2022 is a management system standard, not a control checklist. The certifiable part is the machinery (scope, risk assessment, treatment, objectives, internal audit, management review, corrective action) and the 93 Annex A controls are what the risk assessment selects from. Programmes that start with the control list and work backwards produce documentation nobody uses.
We build it the other way round, sized to your organisation, and we design the ongoing operation to fit the people who will run it. Where cloud services are in scope, ISO 27017 extends the control set; where you also need SOC 2, the evidence largely overlaps and should be collected once.
Why you need it
01 / 06Enterprise procurement, government tenders and an increasing number of mid-market buyers require it. The certificate replaces a lengthy security review with a document, which frequently shortens a sales cycle by a quarter.
The standard requires you to identify risks to information, own them, treat them and review that treatment. Most organisations discover during this exercise that several accepted risks were never actually accepted by anyone with the authority to accept them.
Defined scope, assigned responsibilities, measurable objectives, internal audit and management review turn security from a set of activities into something that can be directed and held to account.
The 2022 Annex A maps closely to SOC 2, and substantially to DPDP Act and GDPR security expectations, sector regulation and customer questionnaires. Building once and mapping is far cheaper than running parallel programmes.
Instrument
02 / 06Pick a control and see the question it actually asks and the evidence that answers it. Then check how much of it you were doing for another framework anyway.
What we deliver
03 / 06Your current position measured against every clause of ISO 27001:2022 and every applicable Annex A control, with evidence sampled rather than self-reported. Delivered as a gap register with effort estimates, so the certification decision is made on a real number.
Defining what the management system covers (which services, sites, systems and people) because scope determines both the cost of certification and the value of the certificate. Too narrow and customers reject it; too broad and the programme stalls.
A repeatable risk methodology, an asset and risk register your team can maintain, treatment decisions with named owners, and a Statement of Applicability that justifies every control you have included and every one you have not.
Practical delivery of the Annex A controls the risk assessment selected (policies, access control, cryptography, logging, supplier management, secure development, business continuity) implemented in your actual environment rather than described in a document.
The clauses that catch most first-time applicants. We run the first internal audit programme, prepare the management review, and train someone internal to run both after we leave.
Selecting an accredited certification body, preparing your team for Stage 1 and Stage 2, being present during the audit, and handling nonconformities through to closure.
How we run it
04 / 06Current state against clauses 4-10 and Annex A, with evidence sampled. The output is a costed, sequenced gap register and an honest timeline, including when we think you are not ready to start.
Weeks 1-3ISMS boundaries agreed and documented, interested parties and their requirements identified, and security objectives set that align with what the business is actually trying to do.
Weeks 3-4Assets and risks identified and evaluated using a documented methodology, treatment decisions made and owned, and the Statement of Applicability produced with justification for every inclusion and exclusion.
Weeks 4-8The selected Annex A controls delivered in priority order, with policies written to be followed and evidence generated as a by-product of operating them rather than assembled before the audit.
Months 2-6A full internal audit against the standard, nonconformities raised and corrected, and a documented management review with the leadership team. Auditors check these first, and they are the most common reason a Stage 2 fails.
Months 5-7Stage 1 documentation review, then Stage 2 implementation audit with an accredited body. We attend both, manage the evidence requests, and drive any findings to closure within the corrective action window.
Months 6-9Key benefits
05 / 06A certificate with a scope statement that covers what the customer is buying answers most of an enterprise security review in one attachment.
A maintained risk register with named owners and dated treatment decisions, so accepting a risk becomes a decision someone made rather than something that happened.
Internal audit, management review and risk review run on your calendar, by your people, with the templates and training to sustain them through surveillance and recertification.
Tools we use
06 / 06No “latest tech tools”. These are the ones your report will cite, alongside the manual work that a tool cannot do for you.
Standards
ISMS operation
Evidence automation
Technical control validation
Mapping
Why Aphelion
SharedDarshap Nayak, formerly of KPMG, holds a master’s degree in cybersecurity and more than seven years in security operations. Jaimin Somani brings fifteen-plus years of academic and hands-on VAPT. Hemang Desai is an ICT network specialist from Australia. You will meet them, not a logo.
Meet the teamEvery finding arrives with the reproduction steps, the affected asset and the fix, ranked by what it actually reaches in your environment, not by a CVSS number copied from a scanner. You get the report and the raw output, not a summary of a summary.
See how we testAhmedabad and Sharjah, working the same methodology on the same tooling. Indian data-residency requirements and UAE delivery are both ordinary here, and the AphelioNYX AD Pen-Test module runs entirely inside your perimeter when regulation says it must.
The platformInvent a statistic to make a slide land. Publish your name as a client without written permission. Print an award badge nobody awarded. Founded in 2024. We say so, and we attribute experience to the people who have it.
Ask us anythingAcross the globe, and across eight industries. We name a client only with their written permission.
AphelioNYX is SOC 2, ISO and GDPR compliant; attestations are available on request under NDA. We would rather hand you the report than print a badge.
Questions
FAQNext door
RelatedA personalised walkthrough and a free readiness assessment against the frameworks you are actually being asked for. Pick a time that suits you, or write to us. We reply within one business day.