Security and ISO certification for SaaS and cloud companies

5 min read

ISO/IEC 27001:2022: what changed and how audits treat it

The 2022 edition reorganised Annex A into 93 controls across four themes and tightened several clauses. This guide sets out what changed, what auditors look for and how to close the gaps in a sensible order.

5 min read

Preparing for stage 1 and stage 2 certification audits

Initial certification happens in two stages: a readiness review and a full assessment of how the system works. Here is what each stage covers and how to prepare without overbuilding.

5 min read

Integrated management system audits

Organisations with more than one ISO certification can be audited against them together. This guide explains what an integrated audit shares, what still has to be assessed standard by standard, and how to prepare.

5 min read

Transferring your certification to a new certification body

You can move an accredited management system certification from one certification body to another without starting over. This guide explains who is eligible, what the pre-transfer review covers and what happens to your audit cycle.

5 min read

Surveillance and recertification: the three-year cycle

Certification is not a single event. This guide explains the three-year cycle, what each surveillance audit looks at, what puts a certificate at risk and how to plan recertification so it never lapses.

5 min read

Preparing for a CERT-In empanelled security audit

A security audit by a CERT-In empanelled organisation goes faster and says more when the auditee is prepared. This checklist covers scope, environments, access, evidence, fixes and the final report.