Question 1

How long does ISO 27001 certification typically take?

Accepted Answer

Most organizations complete gap assessment through certification in 3–6 months, depending on current maturity, organization size, and how quickly policies and controls can be rolled out internally. Timeline is scoped individually on the call.

Question 2

What's the difference between ISO 27001:2013 and ISO/IEC 27001:2022?

Accepted Answer

The 2022 revision restructured Annex A into 93 controls across 4 themes (organizational, people, physical, technological) and added new controls like threat intelligence and cloud security. If you're starting fresh or renewing, certification is now against the 2022 version — we build directly to that standard.

Question 3

Do we need to implement all 93 Annex A controls?

Accepted Answer

No — ISO 27001 requires you to assess every control's applicability to your organization and document the result in a Statement of Applicability (SOA). Controls that genuinely don't apply are documented as excluded, with justification; we help you make and defend those calls correctly.

Question 4

Will you handle the actual certification audit, or just get us ready?

Accepted Answer

Both. We build and implement the ISMS, run an internal audit dry-run to catch issues before the real thing, and then provide hands-on support during your external certification body's Stage 1 (documentation review) and Stage 2 (implementation) audits.

Question 5

Can our existing security tools and processes be reused?

Accepted Answer

Yes — we build the ISMS around what you already have wherever it meets the standard, and only recommend new tools or processes where there's a genuine gap. The goal is a right-sized program, not a rip-and-replace.

Question 6

What happens after we get certified?

Accepted Answer

ISO 27001 certification requires ongoing internal audits, management reviews and continual improvement to maintain it, plus a surveillance audit cycle from your certification body. We can support your ISMS on an ongoing basis or hand it off to your team with full documentation.

Question 7

Is this useful even if we don't need certification right away?

Accepted Answer

Yes — many clients start with the gap assessment and ISMS framework to strengthen their security posture and satisfy customer/vendor security questionnaires, then pursue formal certification later once the foundation is in place.

Question 8

Do you provide ISO 27001 implementation consulting in Gurugram?

Accepted Answer

Yes. Invield is headquartered in Gurugram and works with organisations across Delhi NCR and the rest of India. Workshops can be held on-site or remotely, and documentation, risk assessment and internal audit support are delivered throughout the project.

Get Certified Without the Guesswork

Request Your Free ISO 27001 Scoping Call

A 5-step path to certification

Scoping & Gap Assessment

ISMS Framework Design

Risk Assessment & Treatment

Policy Rollout & Control Implementation

Internal Audit & Certification Support

Why compliance teams choose Invield

100% audit pass rate

120+ organizations certified

Right-sized, not boilerplate

Common questions about ISO 27001

Ready to start your ISO 27001 journey?