ISO 27001,done properly thefirst time.
SIRI Law LLP helps you scope, build and certify an information security management system against ISO 27001, with policies drafted by advocates so they hold up beyond the audit.
- Free first consultation
- Legally sound documentation
- Fixed-fee readiness packages
- Audit-day support
- Hyderabad and online
ISO 27001 Certification
ISO 27001 is often treated as a documentation exercise, which is exactly why audits fail: the policies do not match practice, and nobody owns the risks once the certificate is issued. We build a management system you can actually run, not just show an auditor once.
SaaS and technology companies
Certification that unblocks enterprise deals and security reviews.
Regulated and data-heavy businesses
An ISMS that satisfies both the standard and applicable Indian law.
Companies recertifying
Gap review, updated documentation and surveillance-audit readiness.
Group companies
Scoping a management system across subsidiaries and shared services.
Roadmap
Certification, stage by stage.
A predictable path from scoping to the certificate.
- 01Weeks one to two
Scope and assess
Decide what is in scope and where the gaps are.
- Scope statement and boundaries
- Gap assessment against Annex A controls
- Asset inventory and data flows
- Roadmap and responsibilities
- 02Weeks two to four
Assess risk
Risk assessment drives the whole system.
- Risk methodology and register
- Risk treatment plan and Statement of Applicability
- Owner assignment for each risk
- Leadership sign-off
- 03Weeks three to eight
Build the ISMS
Documented, usable policies.
- Core policies and procedures
- Control implementation across Annex A
- Training and awareness rollout
- Supplier and access management controls
- 04Weeks seven to ten
Audit internally
Test before the real audit does.
- Internal audit against the standard
- Management review meeting
- Corrective actions closed out
- Evidence organised for the auditor
- 05Audit
Certify
Stage 1 and Stage 2 audits, then ongoing surveillance.
- Certification body liaison
- Support during audit days
- Closing non-conformities
- Surveillance and recertification planning
What we do
ISO 27001, end to end.
A fixed-fee readiness package, or ongoing support through SIRI Shield.
Scoping and gap assessment
Defining ISMS boundaries and assessing current maturity against the standard.
- Scope
- Gaps
- Roadmap
Risk assessment and SoA
Risk register, treatment plan and Statement of Applicability.
- Risk
- SoA
- Treatment
Policy and procedure drafting
A complete, legally reviewed policy set mapped to Annex A controls.
- Policies
- Annex A
- Procedures
Internal audit
Independent testing of the ISMS before the certification audit.
- Internal audit
- Findings
- Corrective action
Certification body liaison
Selecting an accredited body and managing the audit process.
- Audit
- Liaison
- Scheduling
Employee training
Role-based awareness training to embed the ISMS in daily work.
- Training
- Awareness
- Culture
Supplier and contract alignment
Security clauses in vendor and customer contracts consistent with your ISMS.
- Vendors
- Contracts
- Clauses
Surveillance audit support
Ongoing evidence collection and audit support for years two and three.
- Surveillance
- Evidence
- Maintenance
Multi-standard mapping
Mapping ISO 27001 controls to SOC 2, PCI DSS or DPDP requirements to avoid duplicate work.
- Mapping
- SOC 2
- DPDP
Where we come in
Five mistakes we often see.
Each one is a common reason certification projects stall or fail audit.
Buying a template policy set
Generic policies that do not match your actual environment are quickly spotted by auditors.
No risk owners named
A risk register without owners and dates does not satisfy the standard and does not reduce risk.
Scope set too broad
An overly broad scope multiplies the work without adding value. Scope deliberately.
Evidence collected only before the audit
Auditors look for evidence over time, not a folder assembled the week before.
Treating certification as the finish line
The ISMS must keep running after the certificate is issued, through internal audits and management review.
Ready to certify?
Need ISO 27001 for a deal or a deadline? Call for a free first consultation.
Tell us your timeline and target audience and we will map the fastest realistic path. Calls are answered by an advocate.
Why organisations choose us
Legally sound, audit-ready.
Retain us for a single matter or for the long run. Either way you deal with the same accountable team.
Policies that hold up
Drafted by advocates, so they are consistent with your contracts and Indian law.
Realistic timelines
We give an honest estimate based on your starting point, not a generic promise.
One system, multiple standards
We map controls across ISO 27001, SOC 2 and DPDP so you do the work once.
Google reviews
See what our clients say on Google.
We would rather you read independent reviews than take our word for it. Every review is on our Google Business Profile.
Questions
Common questions.
General information only, not legal advice. Every situation differs, so speak to us about yours.
How long does ISO 27001 certification take?
Typically a few months from scoping to the Stage 2 audit, depending on your starting maturity and team availability.
We give a realistic timeline after the initial gap assessment.
What is the Statement of Applicability?
A document listing the Annex A controls, whether each applies to you, and how it is implemented. It is central to both the risk assessment and the audit.
We prepare this as part of the risk assessment stage.
Do we need a certification body, or can you certify us?
Certification must be issued by an accredited certification body; we do not issue certificates. We prepare you for that audit and can support you during it.
We help you select an appropriate certification body.
Can we combine ISO 27001 with SOC 2 or DPDP compliance?
Yes. Many controls overlap, and mapping them once avoids duplicated evidence collection.
We build the mapping into your programme from the start.
What happens after certification?
Certification bodies conduct surveillance audits, usually annually, with recertification typically every three years. The ISMS must keep operating in between.
We can support ongoing maintenance through a retainer.
How much does this cost?
Readiness work is available as a fixed-fee package once scope is agreed, separate from the certification body's own audit fees.
Fees are agreed in writing before work starts.
Related
Often needed alongside.
ISO 27001 readiness often involves these services too.
Cybersecurity & Compliance
Testing, ISO 27001 and SOC 2.
Explore
Cybersecurity GRC
Governance, risk and compliance.
ExploreSOC 2 Readiness
Type I and Type II readiness.
Explore
Data Privacy & Cyber Law
DPDP Act, GDPR and breach response.
Explore
Free first consultation
Tell us about your iso matter.
High level is fine. We check conflicts, tell you honestly whether we can help, and what it would cost. You decide, with no pressure.
- Call+91 79819 12046
- WhatsAppMessage us on WhatsApp
- Emailinfo@sirilawllp.com
- HoursMon–Sat, 9:30 AM–7:00 PM IST. Incident line 24/7.
- Existing client?Message your named lead directly, or use the incident line for anything urgent.
Thank you. We have your enquiry.
A member of our team will be in touch within one working day. For anything urgent, call +91 79819 12046.
Visit us
Find our offices.
HITEC City, Madhapur, Hyderabad, Telangana 500081
Mon to Sat, 9:30 AM to 7:00 PM IST · Meetings by appointment · Online consultations worldwide