Skip to main content
010 447 2445Contact
Arke Technologies home
Request a hardware quoteTalk to us
Arke Technologies home
An analyst reviews monitoring dashboards on two monitors in an open-plan office.

ISO 27001 certification readiness, from gap analysis to certificate

ISO 27001 certification shows that an accredited certification body has audited your information security management system (ISMS) against ISO/IEC 27001:2022. Arke Technologies, in Johannesburg, prepares organisations and public bodies across South Africa for certification: gap analysis, risk assessment, controls, evidence and support through the audits.

Request a security assessmentSee our readiness method

What ISO 27001 is, and what the name stands for

ISO/IEC 27001 is the international standard for an information security management system: the policies, risk assessments, controls, audits and reviews through which an organisation protects the confidentiality, integrity and availability of its information. What does ISO 27001 stand for? ISO, whose short name comes from the Greek isos, meaning equal, publishes it jointly with the IEC, the International Electrotechnical Commission, and 27001 is its number in the ISO/IEC 27000 family. You will also see it written ISO27001 or ISO 27001.

The current edition, ISO/IEC 27001:2022, is the new ISO 27001 standard every certificate now uses, because the transition from the 2013 edition ended on 31 October 2025. Its requirements sit in clauses 4 to 10, and Annex A lists 93 controls in four themes: organisational, people, physical and technological. The standard descends from BS 7799, first published by BSI, the British Standards Institution. It is a management discipline, not a product: leadership sets objectives, the organisation assesses its risks, chooses controls, measures whether they work and fixes what does not.

An IT manager takes a call at his laptop in a glass-walled office.

Certification, accreditation and compliance

Three terms get mixed up in tenders and searches, and the difference matters when you buy:

TermWhat it meansWho is involved
ISO 27001 complianceWorking to the standard, with no independent auditYour organisation, on its own word
ISO 27001 certificationAn accredited certification body has audited the ISMS and issued a certificate, valid for three years with surveillance auditsAccredited certification bodies
ISO 27001 accreditationRecognition that a certification body is competent to certify; organisations are certified, not accreditedIn South Africa, SANAS (the South African National Accreditation System), or another member of the International Accreditation Forum
ISO 27001 certifications for peopleCourse certificates such as foundation, lead implementer and lead auditorTraining and personnel certification bodies

ISO 27001 certification companies fall into two groups: certification bodies, which audit and certify, and implementation specialists, which prepare you for the audit. ISO/IEC 17021-1 bars a certification body from consulting on the management system it certifies, so the two roles come from different firms. We are the second kind. Arke Technologies is not itself ISO 27001 certified and does not issue certificates; we work to the standard, align our own controls with it and prepare you for the auditors.

ISO 27001 certified companies can show their certificate and its scope on request, and the International Accreditation Forum's CertSearch database is the nearest thing to a list of ISO 27001 certified companies. Read the scope of any ISO 27001 cert: it may cover one service or site, not the whole organisation. ISO also does not allow its own logo on certificates or marketing, so an ISO 27001 logo on a website should lead back to a named, accredited certification body and its mark.

Four colleagues gather around a desktop computer to work through an issue together.

How to get ISO 27001 certification: our readiness method

How do you get ISO 27001 certified? Build an ISMS that works, show that it has operated, then pass a two-stage audit by an accredited certification body. Our ISO 27001 implementation follows the order auditors test:

  1. Scope and commitment

    Agree what the ISMS covers, the whole organisation or defined services, sites and systems, and leadership's commitment, budget and roles.

  2. Gap analysis

    Current practice compared with clauses 4 to 10 and the 93 Annex A controls, with each gap ranked and costed.

  3. Risk assessment and treatment

    Your ISO 27001 risk management framework: assets, threats, likelihood, impact, treatment and owners (clause 6.1, with ISO/IEC 27005 as guidance), producing the Statement of Applicability and the risk treatment plan.

  4. Controls and policies

    Technical controls first where risk is highest, such as access control (Annex A 5.15), privileged access rights (8.2), logging, backup and vulnerability management, then the policies the Statement of Applicability names.

  5. Operate and measure

    The ISMS runs long enough to create records: access reviews, incidents handled, backups restored in a test, objectives measured.

  6. Internal audit and management review

    An impartial internal audit (clause 9.2) and a management review (clause 9.3); each non-conformity gets a corrective action (clause 10.2).

  7. Certification audits

    We support you through stage 1, where the auditor reviews documentation and readiness, and stage 2, where the auditor tests operation. A major non-conformity at stage 2 delays certification until it is corrected. Surveillance audits follow in each of the next two years, then recertification.

Our cybersecurity assessment can serve as the gap analysis, and a retested penetration test gives evidence for controls 8.8 and 8.29.

ISO 27001 alongside other standards and frameworks

An ISMS rarely stands alone. The standards buyers ask about most, and how they relate:

Standard or frameworkWhat it coversRelationship to ISO 27001
ISO/IEC 27002Guidance on implementing each Annex A controlThe how-to behind 27001; not certifiable
ISO 9001Quality management system (QMS)Same clause structure, so an ISMS and QMS can share document control, internal audit and management review
ISO 22301Business continuity management systemDeepens the continuity controls (5.29 and 5.30); one business continuity plan can serve both audits
ISO/IEC 27701Privacy information management systemAdds privacy controls; the ISO route for data privacy and POPIA evidence
ISO/IEC 27017 and 27018Security for cloud services, and personal information in public cloudsExtra controls for cloud-heavy estates and cloud providers
NIST Cybersecurity FrameworkA voluntary cyber security framework from the US National Institute of Standards and TechnologyBoard reporting language that maps to ISO 27001 controls
SOC 2 (SOC2)An auditor's attestation report on a service provider's controlsAsked for by some international clients; much of the evidence overlaps
Cyber EssentialsThe UK's baseline scheme of five technical controlsA narrower baseline, covered within ISO 27001 controls

ISO 27001 and ISO 9001 run well as one integrated management system. Our team built ISOcore, a platform for ISO 9001, 14001 and 45001 documentation, non-conformance management, corrective actions and audit scheduling, so we know how integrated systems run day to day. For NIST and ISO 27001 together, many organisations report to the board in NIST terms and certify to ISO.

Cloud providers carry their own certificates: AWS and Microsoft Azure hold ISO 27001 certification for their services, and AWS SOC2 reports are available through AWS Artifact. Those cover the provider's side only; your accounts, identities and data sit in your own ISMS scope. See AWS and Microsoft Azure.

ISO 27001 training: foundation, lead implementer and lead auditor

ISO 27001 certification for individuals works differently: people earn course certificates that show competence, while organisations earn certification. The usual path runs from an ISO 27001 foundation course (terms, structure and controls) to internal auditor, then ISO 27001 lead implementer (building and running an ISMS) or lead auditor certification (ISO 27001 audit practice), each usually a five-day course with an exam. Choose courses on the 2022 edition.

Your ISMS needs an ISO 27001 implementer, someone accountable for it day to day, and an impartial internal auditor. Neither has to be a full-time hire: we can carry the implementation alongside your ISO 27001 lead, and the internal audit can come from an independent auditor. Everyone in scope needs awareness of the policy and their part in it, which our security awareness training covers.

Hands on a laptop keyboard beside a phone, ready for a sign-in prompt.

What ISO 27001 certification costs

Last reviewed: September 2026.

The cost of ISO 27001 certification has four lines, and only one is the certification body's fee:

Cost lineWhat drives it
Certification body feesAudit days for stage 1, stage 2, surveillance and recertification, set under ISO/IEC 27006 from the people in scope, the sites and the complexity
ImplementationScope, your starting maturity and how much your team does itself
ControlsThe gaps the risk assessment finds, and whether your Microsoft 365 or Google Workspace licences already include the controls
TrainingHeadcount, and who will run and audit the ISMS

The ISO 27001 certification fee is quoted by the certification body once it has sized the audit, so a 60-person firm on one site pays far less than a multi-province organisation. We quote readiness work per project after the gap analysis, with every line itemised. For context, published South African rates for IT project work run from about R550 to R750 an hour ex VAT (matnet.co.za, September 2026). Our ISO 27001 certification guide explains each line.

Governance, compliance, procurement and continuity

  • Board reporting. ISMS status for your executive and audit committee: risks, objectives, audit findings and corrective actions, supporting King IV Principle 12 (King V Principle 10) and, for public bodies, PFMA or MFMA risk management.
  • POPIA. A certified ISMS is strong evidence for POPIA section 19; see POPIA compliance.
  • Operating evidence. Under a managed agreement, monitoring checks each managed computer every 15 minutes and logs faults as tickets automatically, incidents are prioritised from P1 to P4 against targets agreed in your SLA, and the monthly service review adds to the records clause 9 asks for.
  • Procurement. Arke Technologies (Pty) Ltd is a Level 1 B-BBEE contributor (sworn affidavit available on request). Company documents, our CSD supplier number and SARS tax compliance status are available on request, and we complete SBD forms when a bid requires them. See company facts. Readiness work is bought on a fixed-scope proposal and purchase order, or as a response to your tender.
  • Continuity. The ISMS, its registers, policies and evidence are yours, in editable formats, with every credential in your name, so the system survives any change of staff or provider. A virtual CISO can own it after certification, within our wider cybersecurity services.

Frequently asked questions

How much does it cost to get ISO 27001 certified? Show answer

Getting ISO 27001 certified costs the sum of four lines: the certification body's audit fees, ISMS implementation, any security controls you lack, and training. Audit fees follow audit days, which depend on the people in scope, the sites and the complexity; implementation depends on your starting point. A gap analysis turns those variables into a budget your board can approve.

How long does it take to become ISO 27001 certified? Show answer

It takes months rather than weeks, because the stage 2 auditor needs to see an ISMS that has operated, with an internal audit and a management review completed. The biggest variable is your starting point: an organisation with multi-factor authentication, managed devices, tested backups and written policies moves much faster than one starting from scratch.

How do you become ISO 27001 certified? Show answer

You become ISO 27001 certified by building an ISMS that meets the standard and passing a two-stage audit by an accredited certification body. Define the scope, analyse the gaps, assess risk, implement controls, operate the system, and complete an internal audit and management review before stage 1 and stage 2. The certificate lasts three years, with annual surveillance audits.

Can Arke Technologies certify us? Show answer

No. Only an accredited certification body can issue ISO 27001 certification, and to stay impartial it may not also consult on your ISMS. We prepare you for it: gap analysis, risk assessment, controls, policies and evidence, then support through stage 1 and stage 2. Arke Technologies is not itself ISO 27001 certified; our own controls are aligned with the standard.

How hard is the ISO 27001 exam? Show answer

ISO 27001 exams run from straightforward at foundation level to demanding at lead implementer and lead auditor level. A foundation exam tests terms and structure and suits anyone new to the standard. Lead implementer and lead auditor exams, usually taken after a five-day course, test how you apply the clauses and controls to realistic scenarios. Hands-on experience of an ISMS or an audit is the best preparation.

How much does an ISO 27001 course cost? Show answer

An ISO 27001 course costs more as the level rises: foundation courses are the shortest and cheapest, while five-day lead implementer and lead auditor courses with an exam cost the most. Prices also vary with format, online or in a classroom, and with whether exam and certification fees are included. Check that the course covers the 2022 edition.

Where can we learn ISO 27001 for free, and get the standard itself? Show answer

You can learn a good deal for free: ISO/IEC 27000, the family's overview and vocabulary, is freely available from ISO, and the NIST Cybersecurity Framework is free to download. The standard itself is copyrighted and sold by ISO and national standards bodies, in South Africa the SABS; a free "ISO 27001pdf" download is usually an unauthorised or outdated copy.

Know how far you are from certification

We compare your organisation with ISO/IEC 27001:2022, rank the gaps and give you a plan and a budget your board can approve. Talk to us about scope and timing.

Request a security assessment