Question 1

What is an Information Security Management System (ISMS)?

Accepted Answer

An ISMS is a systematic framework of policies, procedures, technical controls, and risk management processes designed to protect an organization's information assets in accordance with ISO/IEC 27001 requirements.

Question 2

What is the difference between ISO 27001:2013 and ISO 27001:2022?

Accepted Answer

The 2022 revision restructured Annex A controls from 114 controls across 14 clauses into 93 controls across 4 themes (Organizational, People, Physical, Technological), and introduced 11 new controls including threat intelligence, cloud services security, and data masking.

Question 3

What evidence must be prepared for a Stage 1 ISO 27001 audit?

Accepted Answer

Stage 1 requires documented ISMS scope, information security policy, risk assessment methodology and risk treatment plan, Statement of Applicability (SoA), and evidence of at least one internal audit and management review cycle.

Question 4

How long does the ISO 27001 certification cycle last?

Accepted Answer

An ISO/IEC 27001 certificate is valid for 3 years, subject to mandatory annual surveillance audits at months 12 and 24 to verify continuous ISMS operation before recertification in year 3.

Question 5

What is the difference between Stage 1 and Stage 2 certification audits?

Accepted Answer

Stage 1 audit evaluates your Information Security Management System (ISMS) documentation, scope definition, Statement of Applicability, and operational readiness to confirm your organization is prepared for testing. Stage 2 audit evaluates the actual implementation and effectiveness of controls through evidence gathering, interviews, and operational sampling. An accredited Certification Body conducts both stages during the formal certification process.

Question 6

How are the ISMS scope and Statement of Applicability (SoA) defined?

Accepted Answer

The ISMS scope defines the organizational boundaries, locations, assets, and technology systems included in certification, aligned with business requirements, legal obligations like Malaysia's PDPA 2010, and regulatory frameworks such as Bank Negara Malaysia RMiT. The Statement of Applicability (SoA) lists all 93 Annex A controls, justifying why each control is included or excluded based on your risk assessment outcomes.

Question 7

How long does ISO 27001 implementation take before certification?

Accepted Answer

Implementation timelines vary significantly depending on organizational complexity, existing security controls, resource availability, and defined ISMS scope. A small organization with established processes may achieve readiness faster than a complex enterprise operating across multiple business units. nCrypt assists clients through gap analysis, risk assessment, policy development, and pre-audit readiness checks structured specifically around your operational capacity.

Question 8

Is penetration testing mandatory for ISO/IEC 27001 certification?

Accepted Answer

While ISO 27001 does not explicitly mandate penetration testing by name, control A.8.8 (Management of technical vulnerabilities) requires organizations to obtain timely information about technical vulnerabilities, evaluate exposure, and take appropriate measures. For Malaysian financial institutions and technology providers governed by Bank Negara Malaysia RMiT guidelines, CREST-aligned technical security testing and vulnerability assessments form essential evidence demonstrating technical control effectiveness.

Question 9

What is the difference between ISO 27001 and SOC 2?

Accepted Answer

ISO 27001 is an internationally recognized standard requiring an operational Information Security Management System (ISMS) verified through accredited third-party certification. SOC 2 is an attestation framework governed by AICPA evaluating controls across Trust Services Criteria (Security, Availability, Confidentiality, Processing Integrity, Privacy). International buyers often request ISO 27001, whereas US-focused clients typically request SOC 2 Type II reports.

Question 10

What are the internal audit requirements under ISO 27001 Clause 9.2?

Accepted Answer

Clause 9.2 mandates that organizations conduct internal audits at planned intervals to evaluate whether the ISMS conforms to organization requirements and ISO 27001 standards. Auditors must remain independent of the processes being audited to ensure objectivity. nCrypt helps clients conduct thorough, impartial internal audits and management reviews before the external Certification Body audit stage.

ISO 27001 certification

End-to-end certification support

Gap analysis

Implementation

Certification support

Applicability & Scope

Who Must Comply

Statutory Penalties & Enforcement

nCrypt Audit Deliverables & Technical Scope

Frequently asked questions

Achieve ISO 27001 certification

Not sure what you need?