ISO 27001:2022 Certification in Mangalore: ISMS for IT Companies & Data Processors

Theme 1 — Organisational Controls (37 controls)

Covers policies, roles, responsibilities, threat intelligence, information security in project management, supplier relationships, incident management, business continuity, and legal compliance. For Mangalore IT companies, the new Threat Intelligence control (5.7) and ICT Supply Chain Security controls (5.19–5.22) are the most material additions — requiring structured processes for monitoring threat landscapes and managing security risks introduced by cloud providers, software vendors, and subcontractors.

Theme 2 — People Controls (8 controls)

Covers screening, terms of employment, information security awareness, training, disciplinary processes, remote working, and confidentiality agreements. Mangalore BPOs and software development firms with remote or hybrid workforces need explicit documented controls for remote working (6.7) and end-user device policies — an area that was loosely covered under the 2013 standard’s physical security domains but is now a standalone requirement.

Theme 3 — Physical Controls (14 controls)

Covers physical security perimeters, entry controls, offices and facilities, physical security monitoring (new), clear desk and clear screen policies, equipment security, and secure disposal. The new Physical Security Monitoring control (7.4) requires documented surveillance or monitoring processes for secure areas — directly relevant to Mangalore data centres, server rooms, and BPO processing floors handling sensitive client data.

Stage 1 — Scope Definition and Context of the Organisation

ISO 27001 begins with defining the Information Security Management System (ISMS) scope — which assets, locations, processes, and third parties are included. Scope decisions directly impact the number of controls required, the size of the Stage 2 audit, and the CB’s fee. For a Mangalore software company with a development team, a client portal, and cloud infrastructure, the scope definition determines whether the CB audits 2 locations or 4, and 50 controls or 80. Suntew conducts the scope workshop with technical and management leadership as the first engagement step.

Stage 2 — Information Asset Register and Risk Assessment

A complete inventory of information assets — hardware, software, people, data, processes, suppliers — is built and assessed for risk. ISO 27001:2022 requires a structured risk assessment methodology (not a specific one — but documented, consistent, and repeatable). Risks are evaluated and either mitigated (control applied), accepted, transferred (insurance), or avoided (activity stopped). The risk assessment drives which of the 93 controls are applicable and how they are implemented.

Stage 3 — Statement of Applicability (SoA)

The SoA is the most critical ISO 27001 document. It lists all 93 controls from Annex A, states whether each is applicable or excluded, provides a justification for exclusions, and references where each applicable control is implemented. For organisations transitioning from ISO 27001:2013, the SoA must be completely rewritten — the 2013 SoA referencing 114 controls is not transferable. Suntew prepares the SoA with technical input from the client’s IT and security team, typically over 3–5 working sessions.

Stage 4 — Control Implementation and Documentation

Applicable controls are implemented — either through policy documents, technical configurations, process changes, or training. The 11 new controls in ISO 27001:2022 require specific implementations: threat intelligence (a structured process for monitoring relevant threats), web filtering (a deployed and configured filtering system), secure coding (a documented SDLC with code review processes), and data masking (technical controls in development and testing environments). Suntew coordinates the technical implementation requirements with the client’s IT team and documents each control’s implementation evidence.