ISO 27001 in Pakistan: a step-by-step path to certification
In short: ISO 27001 is the international standard for running information security as a managed system, not a one-off project. You define what you protect, assess the risks, put the right controls in place, run them for a while, and then an accredited certification body audits you in two stages. For a focused mid-size company, six to twelve months is realistic.
Why Pakistani companies pursue it
- Winning clients: banks, telcos, multinationals and foreign buyers increasingly ask suppliers for ISO 27001, especially in IT, BPO, software export and fintech.
- Fewer questionnaires: a valid certificate answers most of a client's security questions in one document.
- Better security: done honestly, it forces you to know your risks, assign owners and test your controls.
The 2022 version in one paragraph
The current edition is ISO/IEC 27001:2022. Its Annex A lists 93 controls in four groups: organisational, people, physical and technological. New controls include threat intelligence, cloud services security, data masking, data leakage prevention, monitoring activities and secure coding. Certificates to the older 2013 edition had to move to 2022 by October 2025, so anything you start now should be on the 2022 version.
The 8 steps
- Get management commitment. Certification fails without an owner at the top who gives time, budget and decisions.
- Define the scope. Which offices, teams, systems and services are covered? A tight scope (for example "software development and hosting for clients") is faster to certify than "the whole group".
- Gap assessment. Compare what you do today against the standard's clauses and Annex A. This tells you how much work is ahead.
- Risk assessment and treatment. List your information assets, the threats to them, how likely and how harmful each risk is, and what you will do about it. This is the heart of the standard.
- Statement of Applicability (SoA). For each of the 93 controls, say whether it applies, why, and how it is implemented. Auditors read this closely.
- Implement controls and policies. Access control, MFA, backups, supplier security, incident response, secure development, HR onboarding and exit, physical security. Write only the policies you will really follow.
- Run it, then check it. Train staff, keep records, run an internal audit and a management review. Auditors want evidence the system has been working, usually for at least a few months.
- Certification audit. Stage 1 reviews your documents and readiness. Stage 2 tests whether you actually do what the documents say. Fix any non-conformities, and the certificate is issued for three years, with yearly surveillance audits.
Choosing a certification body
Check that the certification body is accredited for ISO 27001, for example by the Pakistan National Accreditation Council (PNAC) or another accreditation body that is a member of the International Accreditation Forum (IAF), such as UKAS. Your clients may verify this. A certificate from an unaccredited body, or one issued without a real audit, can hurt you more than having none.
Keep roles separate: the consultant who helps you implement should not be the body that certifies you.
Common mistakes that cause delays
- Copy-paste policies that nobody follows. Auditors interview staff and spot this quickly.
- Scope too wide for the first certificate.
- Risk assessment done once in a spreadsheet and never updated.
- No evidence: access reviews, backup restore tests and training that happened but were not recorded.
- Ignoring suppliers: cloud providers, outsourced IT and developers are part of your risk.
- Treating it as IT's job alone. HR, legal, admin and management all own parts of it.
How a security assessment helps
An external assessment early in the project gives you real evidence for the risk assessment, shows auditors that you test your controls, and finds technical gaps (weak remote access, missing patches, exposed services) before the auditor or an attacker does. Repeating it before Stage 2 shows the gaps were closed.
Want a second pair of eyes? FarSec checks businesses in Pakistan for exactly these gaps and helps fix them. Email [email protected] and tell us what worries you.