34. Indian Cyber Law and Cyber Crime Awareness
34.8 ISO 27001
Example first. Before a bank in India hires an IT company like Infosys or TCS, it asks: "Show us your security." One quick answer is an ISO 27001 certificate. AWS, Microsoft Azure and Google Cloud also hold it. It tells customers that an outside auditor checked how the company manages security.
Why it matters
Customers cannot check every supplier themselves. A known standard saves time and builds trust. Many big clients will not sign a contract without it. Inside the company, it gives a clear plan instead of random fixes.
What it is
ISO/IEC 27001 is an international standard. It says how to run an ISMS, an information security management system. The current version is from 2022. It is not a law. Companies choose to follow it.
| Word | Simple meaning |
|---|---|
| ISMS | The full set of rules, people and processes a company uses to manage security risk. |
| Risk assessment | Listing what can go wrong, how likely it is and how bad it would be. |
| Control | A safeguard that lowers a risk, like backups or access rules. |
| Annex A | The list of 93 controls in the 2022 version. |
| SoA | Statement of Applicability. A document saying which controls you use, and why you skip any. |
| Certification body | An approved outside company that audits you and gives the certificate. |
| Annex A theme | Number of controls | Example |
|---|---|---|
| Organisational | 37 | 5.15 Access control |
| People | 8 | 6.3 Security awareness training |
| Physical | 14 | 7.2 Physical entry |
| Technological | 34 | 8.13 Information backup |
How a company gets certified
- Decide the scope: which offices, teams and systems.
- Do a risk assessment.
- Pick controls from Annex A and write the SoA.
- Put the controls in place and train staff.
- Run an internal audit and a management review.
- Stage 1 audit: the auditor reads your documents.
- Stage 2 audit: the auditor checks that you really follow them.
- Get the certificate. It lasts 3 years, with a check-up audit every year.
Worked examples
Worked example 1: A lost laptop
- Risk: a staff laptop with customer files is lost.
- Controls: 8.1 User endpoint devices (encrypt the disk, allow remote wipe) and 5.15 Access control.
- Evidence for the auditor: a list showing every laptop has disk encryption on.
Worked example 2: Ransomware
- Risk: ransomware locks the main file server.
- Control 8.13 Information backup: daily backups kept offline.
- Control 5.24 Incident management planning: a written plan (Chapter 31.6).
- Evidence: backup logs and a test restore report.
Worked example 3: Standard vs law in India
| ISO 27001 | IT Act / DPDP Act 2023 | |
|---|---|---|
| What is it? | Voluntary standard | Law |
| Who checks? | Certification body | Government, courts, Data Protection Board |
| If you fail | Lose the certificate | Penalties |
The DPDP Act asks companies to take reasonable security safeguards for personal data (Chapter 34.4). Following ISO 27001 helps show that you did.
In short
- ISO 27001 is a voluntary international standard for running an ISMS.
- The 2022 version has 93 Annex A controls in 4 themes.
- Certification: risk assessment, SoA, controls, internal audit, stage 1 and stage 2 audits.
- It is not a law, but it helps you meet laws like the DPDP Act.