If a client, tender or insurer has asked for ISO 27001, here is the bottom line. ISO 27001 certification is achievable for a small or medium business, but treat it as a management commitment, not an IT project. You build an information security management system, run it long enough to produce evidence, then pass a two-stage audit by an independent certification body. ISO 27001 certification in Australia follows the same international rules as anywhere else. What is local is how you check the certifier, and how the standard sits beside the Essential Eight and the Privacy Act.
The rest of this guide walks through the request itself, each step to a certificate, what drives time and cost, common mistakes and realistic first steps.
What ISO 27001 certification means
ISO 27001 certification is a certificate from an independent certification body confirming that your organisation runs an information security management system meeting the requirements of ISO/IEC 27001:2022. It certifies how you manage information security risk, not that you cannot be breached. Certificates run on a three-year cycle, with surveillance audits in the years between.
That second sentence matters. Certification audits sample evidence and don't include penetration tests. What the certificate shows is a disciplined, repeatable way to find, treat and review risk.
First, check what you are being asked for
Before you commit budget, read the exact clause in the contract, tender or insurance form, and confirm four things:
- Certified or aligned. Some buyers want a certificate. Others will accept a business that follows the standard as good practice. Standards Australia notes that ISO 27001 certification is optional; what it adds is independent verification for customers.
- Accredited or not. If the request says "accredited certification", the certificate must come from a body accredited for ISO/IEC 27001.
- Scope. The certificate should cover the services, sites and systems the requester actually relies on.
- Edition. The transition from the 2013 edition ended at the end of October 2025. Valid certificates now reference the 2022 edition.
If an insurer asked, a separate guide on checking your cyber insurance answers covers the other IT questions on the form.
ISO 27001 and the ISMS in plain terms
ISO/IEC 27001 is the international standard that sets the requirements for an information security management system (ISMS). The current version is the third edition, published in October 2022, and it has one amendment, issued in 2024, covering climate action changes. Australia and New Zealand adopt it word for word as AS/NZS ISO/IEC 27001:2023.
An ISMS is not a piece of software. It is the way your business decides what information matters, assesses the risks to it, chooses controls and checks they work. It covers people, process and technology, with the goal of protecting the confidentiality, integrity and availability of information.
What Annex A is, and what it isn't
Annex A of the standard lists 93 information security controls, grouped into four categories: organisational, people, physical and technological. A companion standard, ISO/IEC 27002, gives guidance on applying them, but you cannot be certified to 27002 itself.
Annex A is a catalogue, not a checklist. You decide which controls apply based on your risk assessment, and you record each decision, with reasons, in a Statement of Applicability (SoA). Auditors follow the thread from risk, to control, to evidence that the control works.
How ISO 27001 certification works, step by step
First you build and run your ISMS, then a certification body audits it. Certifiers follow their own international rules (ISO/IEC 17021-1, plus ISO/IEC 27006-1 for information security), and under those rules the initial audit happens in two stages.
| Step | What happens | Who does it |
|---|---|---|
| Scope | Define which services, sites, systems and people the ISMS covers | Your leadership team |
| Risk assessment | Identify information assets, threats and weaknesses, and rate risks against criteria you set | Your ISMS owner, with input from IT |
| Risk treatment and SoA | Choose a treatment for each risk and record every Annex A decision in the Statement of Applicability | Your ISMS owner |
| Implement and operate | Put controls in place and keep records showing they run | Your staff and your IT provider |
| Internal audit | Test the ISMS against the standard and your own rules, then fix what you find | A competent internal or contracted auditor |
| Management review | Leadership reviews risks, performance and resources, and records decisions | Your senior management |
| Stage 1 audit | Review of documents, scope and readiness, including whether internal audits and management reviews are planned and under way | The certification body |
| Stage 2 audit | Evaluation of whether the ISMS is implemented and effective | The certification body |
| Surveillance audits | At least once each calendar year, with the first no later than 12 months after certification | The certification body |
| Recertification | A full re-audit in the third year, before the certificate expires | The certification body |
Two details catch first-timers. Stage 1 is a readiness check, not a pass; the certification decision draws on both stages. And if Stage 2 finds a major nonconformity, the certification body must verify it has been corrected within six months of the last day of Stage 2, or it has to run Stage 2 again.
How to check a certification body is accredited in Australia
ISO writes the standard, but it does not certify anyone or issue certificates. Certification bodies do the auditing. Accreditation bodies then check that those certifiers operate to international standards. In Australia and New Zealand, the joint accreditation body is JASANZ (often written JAS-ANZ).
To check a certifier before you sign:
- Search the JASANZ register of accredited bodies by name or by standard.
- Confirm ISO/IEC 27001 appears in that body's scope of accreditation. Each listing shows its scope.
- Ask more than one body for a proposal. ISO's own advice is to evaluate several.
- Once certified, make sure your certificate can be verified on the JASANZ register or on IAF CertSearch, the global database of accredited certifications.
ISO notes that accreditation is not compulsory, but it adds confidence because an independent body has confirmed the certifier's competence. If your client asked for accredited certification, an unaccredited certificate won't meet the request.
Keep the roles clear, too. ISO/IEC 17021-1 sets requirements for certifiers' competence and impartiality: their job is to audit your ISMS, not to build it.
What drives the time and cost of ISO 27001 certification
Prices and timelines depend on your starting point and scope. These factors move both.
| Factor | Why it matters | How to keep it in check |
|---|---|---|
| Scope | More sites, staff, systems and services mean more risks to assess and more for the auditor to sample | Scope to what your clients rely on, not the whole group by default |
| Starting maturity | Existing policies, MFA, tested backups and patching records shorten the build | Run a gap assessment before you plan |
| Outsourced services | Cloud platforms and IT providers become suppliers you must manage and evidence | Ask key suppliers early for evidence |
| Internal capacity | Someone has to own the ISMS, run reviews and keep records | Name an owner and give them protected time |
| Outside help | Consultants and ISMS software cost money but can prevent rework | Buy help for the gaps, not the whole program |
| Audit fees | The certification body plans the audit from the scope, sites, processes and resources in your application | Get proposals from more than one accredited body |
| Evidence period | Auditors need records showing controls, internal audit and management review in operation | Start operating controls while documents are still in draft |
| Ongoing upkeep | Surveillance audits come every year and recertification in year three | Budget for the full three-year cycle, not just year one |
Remediation is easy to underestimate. Your risk assessment may expose gaps, such as accounts without multi-factor authentication or untested backups, and fixing them is a separate cost.
How ISO 27001 relates to the Essential Eight and the Privacy Act
The Essential Eight and the new ASD Essentials
The Essential Eight is the Australian Signals Directorate's (ASD) set of eight mitigation strategies: patch applications, patch operating systems, multi-factor authentication, restrict administrative privileges, application control, restrict Microsoft Office macros, user application hardening and regular backups. It is a technical baseline, assessed against a maturity model. For a refresher, see the Essential Eight explained.
As at November 2026, ASD is transitioning from the Essential Eight to its new ASD Essentials series, published on 15 October 2026, which replaces maturity levels with priority phases. Every Essential Eight strategy maps to at least one Essentials principle, so the controls remain a sound baseline for smaller businesses. ASD says the series is written mainly for Commonwealth entities, critical infrastructure and large organisations, that smaller businesses can use it where relevant, and that current Essential Eight work should continue while it advises on transition timing. Its guide to transitioning from the Essential Eight explains how existing work carries forward.
| | ISO/IEC 27001 | Essential Eight |
|---|---|---|
| Published by | ISO and IEC (international) | Australian Signals Directorate |
| What it is | Requirements for a management system | Eight technical mitigation strategies |
| Approach | Risk-based: you choose controls and justify them | Set requirements at each maturity level |
| How it's checked | Certification audits by a certification body | Assessment against ASD's maturity model |
| Governance, people and suppliers | Core to the standard | Not assessed under the maturity model |
| Status as at November 2026 | 2022 edition current | Being evolved into the ASD Essentials |
The two work well together. Essential Eight controls such as MFA, patching and backups can become risk treatments in your SoA, and ISO 27001 adds the management layer around them: ownership, risk decisions, supplier oversight and review.
The Privacy Act
Under the Privacy Act 1988, Australian Privacy Principle 11 requires covered organisations to take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. Businesses with annual turnover over $3 million are generally covered, and so are some smaller ones, including health service providers.
An ISMS gives you a structured way to show those reasonable steps. ISO 27001 certification does not, however, automatically mean you comply with the Privacy Act. ISO 27001 is an international standard and cannot contain Australian legal requirements; it expects you to identify the laws that apply to you. This guide is general information, not legal advice, so check your obligations with a qualified adviser or the Office of the Australian Information Commissioner (OAIC).
Common mistakes first-time applicants make
- Chasing the certificate, not the capability. Minimal scope and template documents may pass an audit but rarely change how you handle risk.
- Implementing every Annex A control because it's listed. Controls with no risk behind them become policies nobody reads.
- A thin risk assessment. Weak links between risks, treatments and the SoA are a common source of audit findings.
- Handing it all to IT. The standard requires top management involvement. Leadership sets risk appetite, accepts risks and runs management review.
- Assuming certified means secure or legally compliant. The certificate covers your management system, not every control or law.
- Misusing logos. ISO does not allow its logo to be used to show certification. Ask your certifier which mark you may use, and write "certified to ISO/IEC 27001:2022" in full.
- Budgeting for year one only. Surveillance audits come every year, and recertification falls due in year three.
Practical first steps toward ISO 27001 certification
- Get the requirement in writing: edition, accredited or not, scope and deadline.
- Appoint an ISMS owner and a senior sponsor. Standards Australia stresses that executive buy-in is crucial.
- Draft a short scope statement built around the services your client or tender relies on.
- List the information you hold, where it lives and who can reach it. Standards Australia suggests small businesses start here.
- Buy the standard. ISO also sells a practical guide to ISO/IEC 27001:2022 written for small and medium enterprises.
- Run a gap assessment of your current policies and IT controls against the standard.
- Contact two or three JASANZ-accredited certification bodies about their process and audit lead times.
- Plan the calendar so an internal audit and a management review are done before Stage 2. Stage 1 checks they are planned or under way.
How CSPRO Can Help
Computer Support Professionals (CSPRO) is ISO 27001 certified, and its ISO certifications page lists the standards it holds. Certificate scope and details are available on request.
CSPRO is not a certification body, and your business still owns its ISMS. The scope, risk decisions, Statement of Applicability, internal audit and management review stay with you. CSPRO can help with the IT side your ISMS depends on:
- IT audits and compliance-focused risk assessments that surface risk and compliance gaps in your current environment.
- Managed security controls through CSPRO's cybersecurity services, including endpoint protection, firewall management, email filtering, multi-factor authentication and identity access controls, patching and 24/7 threat monitoring.
- Regular audit reports and compliance documentation from the managed firewall service, which can form part of your evidence.
If ISO 27001 certification in Australia is on your agenda, a sensible first move is CSPRO's free initial cybersecurity risk assessment. It shows where your IT controls stand before you plan the rest. Call 1300 660 368 to arrange it.
