ISO/IEC 27001 is the international standard for an information security management system (ISMS). Certification means an external certification body has audited your ISMS against it. JCSS Indonesia supports readiness reviews, internal audits and control testing, while the certificate itself can only be issued by an accredited certification body.
What is ISO 27001 and what is an ISMS?
ISO/IEC 27001 specifies requirements for an ISMS, a risk-based management system that protects the confidentiality, integrity and availability of information.
The current edition is ISO/IEC 27001:2022 (Edition 3, October 2022), applicable to organisations of any size and sector. An amendment, ISO/IEC 27001:2022/Amd 1:2024, added climate action changes, published in February 2024. The ISMS is the combination of scope, risk assessment, risk treatment, controls, monitoring and continual improvement that management operates. The standard is about management, not only technology: leadership, resourcing, awareness and review are as central as firewalls.
Which controls does the 2022 edition include?
The 2022 Annex A contains 93 controls in four themes: organisational, people, physical and technological.
ISO states that ISO/IEC 27002:2022 contains 93 controls grouped in these four themes, and its Annex A numbering is reused by ISO/IEC 27001:2022. Annex A is a reference set. You decide which controls apply through your risk assessment and record the decision, with justification, in a Statement of Applicability (SoA). Excluding a control needs a reason, not just a preference. Equally, controls outside Annex A can be added when your risks require them.
What is the ISO 27001 certification process?
You define scope, assess risk, select and implement controls, test the system yourself through internal audit and management review, then an external certification body audits it.
| Stage | What happens | Evidence typically produced |
|---|---|---|
| Scope and context | Define boundaries, interested parties and requirements | Scope statement, context analysis |
| Leadership | Management commits and assigns roles | Policy, objectives, role assignments |
| Risk assessment and treatment | Identify and rate risks, choose treatments | Methodology, risk register, treatment plan |
| Statement of Applicability | Record which controls apply and why | SoA |
| Implementation and awareness | Operate controls, train staff | Procedures, records, training logs |
| Internal audit | Independent check of the ISMS | Audit programme and reports |
| Management review | Leadership reviews performance and decisions | Minutes and actions |
| Corrective action | Fix nonconformities | Action log with closure |
| Certification audit | Accredited certification body audits | Audit report and certificate decision |
Certification is a decision by the certification body, not ISO. ISO states that it does not perform certification and that certification to its management system standards is not required. The same material from ISO's committee describes certification audits as systematic, independent and documented, testing whether the requirements are fulfilled.
What drives the cost of ISO 27001 certification?
Cost depends mainly on scope, current maturity, number of sites and staff, and how much is done internally. Fees vary by provider, so obtain written quotes.
We do not quote typical amounts because published figures are inconsistent and depend on scope. Instead, budget for these drivers:
- Scope size: entities, locations, systems and headcount covered.
- Maturity: a gap analysis shows how much policy, process and tooling work remains.
- Internal effort: time from leadership, IT, HR, legal and operations is often the main cost.
- Technical remediation: fixes arising from risk assessment or VAPT.
- Certification body fees: audit days depend on scope and complexity; request a clear schedule of audits and fees.
- Sustaining the system: internal audits, management reviews, training and tooling continue after the certificate.
Any figures from vendors should be treated as indicative and subject to written confirmation.
What are the benefits, and is ISO 27001 mandatory?
Benefits include a structured risk approach, clearer accountability and evidence for customers and auditors. ISO states certification is not required; contracts or regulators may still ask for it.
Practical benefits tend to be organisational: fewer ad hoc security questionnaires, a shared vocabulary between IT and management, and faster responses to customer due diligence. Whether certification is expected depends on your customers, sector and contracts. Check requirements with your regulators or counterparties rather than assuming. Do not describe certification as a legal compliance assurance: it covers your ISMS scope only, and does not itself demonstrate compliance with, for example, Law No. 27 of 2022 on Personal Data Protection.
What happened to the transition from the 2013 edition?
The transition from ISO/IEC 27001:2013 to the 2022 edition has closed; certificates must now be to the 2022 edition. IAF MD 26 required 2013 certificates to expire or be withdrawn at the end of the transition period.
If you hold an older certificate, confirm its status with your certification body. For new projects, build against the 2022 edition and the 93-control Annex A from the start. Mapping your existing controls from the old structure is straightforward but should be documented in the SoA.
How do certification and compliance differ?
Certification is an independent audit result issued by a certification body; compliance is your own assertion or internal assessment against the standard's requirements.
You can be compliant without certification, for example for internal assurance or a customer who accepts a self-assessment or an independent readiness review. Certification adds external verification and usually involves periodic follow-up audits. For governance groundwork, see our security governance checklist and GRC automation guide. Our internal audit, ITGC and cybersecurity service covers gap assessments and internal ISMS audits, delivered as drafts for partner review.
Frequently asked questions
What is ISO 27001 certification?
It is a formal attestation by an external certification body that an organisation's information security management system meets the requirements of ISO/IEC 27001 within a defined scope. ISO itself does not certify. The certificate relates to your ISMS scope and risk-based controls, and it is maintained through follow-up audits.
How many controls are in ISO 27001:2022 Annex A?
Annex A of the 2022 edition lists 93 controls in four themes: organisational, people, physical and technological. They are not all mandatory. You select those relevant to your risks and record the choices, with reasons, in your Statement of Applicability, and may add other controls where needed.
Is ISO 27001 certification mandatory in Indonesia?
ISO states that certification to its management system standards is not required. This article does not establish whether an Indonesian rule requires it for your sector; a customer contract, tender or sector regulator may. Check the specific obligations that apply to your organisation, and take legal advice where a regulatory requirement is claimed.
How is certification different from compliance?
Compliance means you meet the standard's requirements, as judged by you or an internal or consulting reviewer. Certification means an independent, accredited body has audited the ISMS and decided to issue a certificate. Certification gives external assurance, while self-assessed compliance does not carry the same weight with customers or auditors.
What is a Statement of Applicability?
It is the document that lists the Annex A controls, states whether each applies, explains why, and records whether it is implemented. It links your risk assessment to your control choices and is one of the first documents an auditor reads. Keep it current whenever risks or controls change.
General information only, not legal or tax advice for your specific facts. Regulations change; confirm the current position with JCSS Indonesia before acting.