Compliance-first delivery
What ISO 27001 consultants in Chennai should do
ISO 27001 consultants in Chennai should define a realistic scope, run a risk assessment your managers understand, build a Statement of Applicability for the 93 Annex A controls of ISO/IEC 27001:2022, help implement the controls, run an internal audit and management review, and prepare you for an accredited certification body. They should never issue the certificate themselves, and should warn you off any “certificate in days” offer.
A Chennai ISO 27001 project usually starts with a client’s contract clause
Search for ISO 27001 consultants in Chennai and page one has a handful of consultancies, directory listings and a free Google Sites page. Very few explain what a Chennai buyer is usually facing: a client contract that now requires ISO 27001, a parent company that wants its delivery centre certified, or an automotive customer that wants information security evidence before the next programme award. The certificate is the visible goal; a management system that survives audits is the real one.
This page goes beyond our general ISO 27001 compliance service and our readiness checklist. It covers the scopes we see in Chennai, how to tell a credible certificate from a worthless one, what changed in the standard recently, what drives cost, and how ISO 27001 fits with TISAX, SOC 2 and India’s DPDP rules.
Radiatus prepares organisations for certification and supports them through the audit. The certificate itself is issued only by an accredited certification body after its own Stage 1 and Stage 2 audits. We work remotely on Indian time, with on-site days in Chennai for workshops, the internal audit or the certification audit by agreement. We have no Chennai office.
What is specific about ISO 27001 in Chennai
Delivery centres bring client rules into scope. Many Chennai IT, ITES and BPO operations run offshore development centres or dedicated floors for individual clients, each with its own access, device and data-handling rules. An ISMS here has to show both the company’s controls and how client-specific requirements are met, without writing a separate policy set for every client.
GCCs answer to headquarters. Guidance Tamil Nadu counts more than 350 global capability centres in Chennai. Some are certified under their parent group’s ISO 27001 scope, others need their own certificate. Deciding that early, with the parent’s security team, avoids building controls twice.
Manufacturers face IT and OT. Auto and electronics plants along the Sriperumbudur–Oragadam belt have office IT, engineering data and plant networks in one estate. A sensible scope often covers design data and office systems first and treats the plant network as an interface with defined controls, rather than certifying everything at once.
Auto customers may also ask for TISAX. Suppliers to German carmakers are often asked for a TISAX assessment, run through the ENX Association. TISAX is built on an information security assessment closely related to ISO 27001, so a well-built ISMS shortens that path considerably.
DPDP adds personal data duties. Most obligations under India’s DPDP Rules apply from 13 May 2027. ISO 27001 controls cover much of the security side; consent, notices, rights handling and breach reporting to the Board need their own work. Our DPDP checklist maps them.
Typical ISO 27001 scopes for Chennai organisations
Illustrative scopes, not client case studies. Scope decides cost more than headcount does.
| Organisation | Sensible first scope | Watch out for |
|---|---|---|
| 50-person software company on OMR | Product development and delivery, office and cloud, all staff | Developer laptops, cloud access and customer data in test environments |
| 300-seat BPO with client floors | Operations floors, support functions and the client-facing systems | Physical access per floor, clean-desk rules, call recordings and screening records |
| GCC of a European group | The Chennai centre as a site in the group scope, or a standalone scope agreed with headquarters | Duplicate policies, and whose risk register governs local risks |
| Tier-1 auto supplier | Engineering design data, office IT and supplier portals; plant network as a defined interface | Customer drawings on USB drives, shared engineering logins, OT remote access |
| Fintech operations centre | Customer onboarding, operations systems and the cloud platform | KYC documents, privileged access and outsourced vendors |
ISO 27001 consultant, certification body, internal auditor: who does what?
| Role | Does | Must not |
|---|---|---|
| Consultant (for example, Radiatus) | Scopes the ISMS, runs workshops, drafts the risk method and Statement of Applicability, helps implement controls, trains staff, prepares for audits | Issue certificates, or audit the same system as the certification body |
| Your ISMS owner and team | Own the risks and controls, run the system day to day, collect evidence, decide on risk treatment | Hand ownership to the consultant; the auditor will interview your people |
| Internal auditor | Checks the ISMS against the standard before the certification audit, independently of the work being audited | Audit their own work |
| Accredited certification body | Runs the Stage 1 and Stage 2 audits, issues the certificate, runs yearly surveillance audits and recertification every three years | Consult on how to implement the controls it then audits |
How to tell whether an ISO 27001 certificate is worth anything
A certificate is credible only if the body that issued it is accredited for ISO 27001 by an accreditation body that is a member of the International Accreditation Forum. In India that is usually NABCB; certification bodies accredited by other IAF members, such as UKAS or ANAB, are also recognised. Before you sign with a certification body, and before you rely on a supplier’s certificate:
- Check the certificate on IAF CertSearch, the global database of accredited certifications.
- Confirm the scope on the certificate covers the site and services you care about.
- Check it refers to ISO/IEC 27001:2022. The transition period for 2013-version certificates ended on 31 October 2025.
- Be wary of certificates from unaccredited bodies, or offers to “arrange” a certificate with the consultant and auditor from the same firm. Customers increasingly reject them.
What changed in ISO 27001 recently?
| Change | What it means for you |
|---|---|
| ISO/IEC 27001:2022 | Annex A reorganised into 93 controls in four themes (organisational, people, physical, technological), with new controls such as threat intelligence, cloud services security, data masking and secure coding |
| Amendment 1:2024 | Clause 4.1 now asks whether climate change is a relevant issue for the ISMS, and 4.2 notes that interested parties may have climate-related requirements. Usually a short, honest assessment, not a project |
| End of the 2013 transition | Certificates to the 2013 version could not remain valid after 31 October 2025; any supplier still showing one is out of date |
| ISO/IEC 27006-1:2024 | The rules certification bodies follow, including how audit time is calculated from headcount, sites and complexity. Accredited bodies had to move to it by 31 March 2026 |
What drives the cost of ISO 27001 in Chennai?
There are two separate bills: the consultant and the certification body. We do not publish rates; here is what moves each.
- Scope. Number of sites, client floors, products and cloud platforms inside the boundary. Scope affects every later line.
- Headcount in scope. Certification bodies set audit days from the number of people doing work under the ISMS, adjusted for complexity, following ISO/IEC 27006-1. More people and more sites mean more audit days.
- Starting maturity. If access reviews, backups, logging and vendor checks already happen and are recorded, implementation is mostly documentation. If not, engineering time dominates.
- How much you want the consultant to do. Advice and review costs less than hands-on control implementation and evidence collection.
- Other frameworks. Mapping the same controls to SOC 2, TISAX or ISO 27701 adds effort once, and saves it every year after.
- Tooling. A spreadsheet works for small scopes; a GRC tool helps when evidence comes from many teams. Our GRC Platform publishes its prices.
Red flags in “ISO 27001 certificate in 7 days” offers
- A fixed delivery date for the certificate before anyone has seen your scope.
- Policies delivered as a template pack with your logo pasted in, and no risk assessment.
- No mention of an internal audit or management review, both of which the standard requires.
- The same firm consulting and certifying, or a certification body you cannot find on IAF CertSearch.
- No Stage 1 and Stage 2 audit, or audits done entirely by email.
- No plan for surveillance audits in years two and three.
What your own team must do during an ISO 27001 project
Certification bodies interview your staff, not the consultant. Plan for this time on your side:
- An ISMS owner with authority to make decisions, usually a few days a month during the build and less afterwards.
- Leadership to approve the scope, the information security policy and the risk appetite, and to chair the management review.
- Risk owners in each function who decide how their risks are treated, not just sign a form.
- IT and engineering to implement or confirm technical controls and keep the records: access reviews, backup tests, change tickets, vulnerability fixes.
- HR for screening, onboarding and exit checklists, and the disciplinary process the standard expects.
- Facilities for physical security on each floor and site in scope, including visitor and contractor access.
- Every employee for awareness training and for following the policies, which auditors test by asking people at random.
Keeping the certificate: surveillance audits and recertification
Certification is a three-year cycle: surveillance audits in years one and two, then recertification. Organisations that struggle in year two usually stopped running the system after the certificate arrived. Keep a simple compliance calendar with quarterly access reviews, backup restore tests, supplier reviews, risk register updates, an annual internal audit and management review, and incident drills. Record each one as it happens. Update the risk assessment whenever something significant changes: a new client floor, a new cloud platform, a new office. Then the surveillance audit becomes a review of records you already have.
Questions to ask ISO 27001 consultants in Chennai
- What scope would you propose for us, and why that boundary?
- How will the risk assessment work, and who in our company owns it afterwards?
- Which certification bodies do you suggest, and are they accredited for ISO 27001 by an IAF member?
- How much of the implementation will you do, and how much will our team do?
- Who performs the internal audit, and how is it kept independent?
- What will running the ISMS cost us in time each year after certification?
- Can the same controls cover SOC 2, TISAX or ISO 27701 if we need them later?
ISO 27001 alongside TISAX, SOC 2, ISO 27701 and ISO 42001
One well-built control set can serve several frameworks. TISAX, run through the ENX Association, is the usual next step for automotive suppliers. SOC 2 is a US attestation report from a licensed CPA firm, often asked for by US software buyers. ISO/IEC 27701 adds privacy management on top of ISO 27001 and fits naturally with DPDP work. ISO/IEC 42001 is the management-system standard for AI, relevant if you build or deploy AI systems for clients. We map controls once and collect evidence once, in your tool or our GRC Platform. Adding a second framework later is far cheaper when the first one was built with that in mind.
ISO 27001 consulting for Chennai organisations
Four pieces of work, which can be bought separately. Certification is always by an accredited body you contract directly.
Scope and gap assessment
The problem
You know a client or parent company wants ISO 27001, but not what the boundary should be or how far away you are.
How we do it
Workshops with your leadership, IT and operations teams to agree the scope, then a gap assessment against the clauses and the 93 Annex A controls, ending with a roadmap, a timeline and a list of certification bodies to approach.
What you get
- Scope statement and boundary diagram
- Gap report against clauses and Annex A
- Roadmap with owners and dates
- Certification body shortlist
ISMS build: risk, SoA and policies
The problem
Template policies exist, but nobody follows them and the risk assessment is a spreadsheet nobody understands.
How we do it
We set up a risk method your managers can use, run the first risk assessment with them, write the Statement of Applicability with justified inclusions and exclusions, and write policies around how your teams actually work.
What you get
- Risk method and first risk register
- Statement of Applicability
- Policies and procedures people can follow
- Awareness training for staff
Control implementation
The problem
The gaps are technical: shared logins, no access reviews, untested backups, no logging, unmanaged laptops.
How we do it
Our engineers implement technical controls alongside your IT team: identity and access, endpoint management, logging and monitoring, backups and restore tests, secure development practices and vendor reviews, producing evidence as they go.
What you get
- Technical controls implemented
- Evidence trail per control
- Handover to your IT team
- Optional penetration test
Internal audit and certification support
The problem
The ISMS is running, and the certification body’s Stage 1 is booked.
How we do it
An internal audit independent of the people who built the controls, a management review with your leadership, readiness checks before Stage 1 and Stage 2, and support during the audits. Then a calendar for the surveillance years.
What you get
- Independent internal audit
- Management review pack
- Stage 1 and Stage 2 readiness
- Surveillance-year calendar
A typical route to certification
For a small or mid-sized Chennai organisation with reasonable IT basics. Larger or less mature organisations take longer, mostly in implementation.
Scope and gaps
Scope agreed with leadership and, for GCCs, the parent company. Gap assessment, roadmap and certification body chosen.
Build the ISMS
Risk assessment, Statement of Applicability, policies and training, with technical controls implemented in parallel.
Run and record
Controls operate and produce records long enough to show they work, as auditors will expect.
Internal audit and review
Independent internal audit, corrective actions, management review.
Certification audits
Stage 1 (documentation and readiness) and Stage 2 (operation) by the certification body, then yearly surveillance.
A compliance product we build and run
Optional, with published prices. The ISMS works just as well in your own tools.
Guides and related pages
Guides
Questions about ISO 27001 consultants in Chennai
They help you define the scope of your information security management system, run a risk assessment, write a Statement of Applicability for the Annex A controls, implement and document controls, train staff, run an internal audit and management review, and prepare you for the certification body’s audits. They do not issue the certificate.
An accredited certification body, after its Stage 1 and Stage 2 audits. In India, certification bodies are usually accredited by NABCB; bodies accredited by other International Accreditation Forum members are also recognised. You can verify accredited certificates on IAF CertSearch.
For a small or mid-sized organisation with reasonable IT basics, our typical plan is four to six months from scoping to the certification audits. The controls need to run long enough to produce records before Stage 2. Larger scopes, several sites or weak starting controls take longer.
There are two bills. The consultant’s fee depends on scope, starting maturity and how much hands-on work you want; we price after a gap assessment and do not publish rates. The certification body’s fee depends on audit days, set from headcount, sites and complexity under ISO/IEC 27006-1. Get quotes from at least two accredited bodies.
No. The transition period for certificates issued against the 2013 version ended on 31 October 2025, so a valid certificate today refers to ISO/IEC 27001:2022. If a supplier still shows a 2013 certificate, ask for the current one.
Suppliers to German carmakers are often asked for a TISAX assessment, organised through the ENX Association. TISAX is closely related to ISO 27001 controls, so a working ISMS shortens the route. Check your customer’s requirement for the assessment level they expect.
Often yes, as a site in the group’s scope, if the parent’s certification body and ISMS owner agree. Otherwise the Chennai centre can hold its own certificate. Decide this early with headquarters to avoid building duplicate policies and controls.
No. Radiatus works remotely on Indian time and visits Chennai by agreement for workshops, the internal audit or the certification audit. Most ISO 27001 work, including document reviews and evidence checks, happens comfortably over video and shared repositories.
Has a client or parent company asked for ISO 27001?
Tell us who is asking, your headcount, your sites and any deadline. A senior consultant will reply with a proposed scope and the first questions we would ask.