OHS compliance
Ensure Educational Excellence and OHS Compliance with Sancert
Protect Your Information. Build Trust.
Information security is about more than technology. It’s about protecting your business, your customers and your reputation. ISO/IEC 27001 certification provides a practical framework for managing information security risks and giving your clients confidence that their information is in safe hands.
About the Standard
What Is ISO/IEC 27001?
ISO/IEC 27001:2022 is the internationally recognised standard for Information Security Management. It helps organisations identify information security risks, put the right controls in place, and continually improve how information is protected.
ISO/IEC 27001 is built around three core principles: confidentiality, integrity and availability. It helps organisations ensure that information is only accessed by authorised people, remains accurate and complete, and is available when it is needed. Rather than focusing only on technology, the standard looks at the people, processes and systems involved in protecting your organisation’s information.
Who Is ISO 27001 For?
ISO/IEC 27001 certification is suitable for organisations of all sizes and across every industry.
It is particularly valuable for organisations that:
- Handle confidential customer, employee or financial information.
- Need to meet contractual or regulatory information security requirements.
- Want to reduce information security risks.
- Supply customers who require ISO/IEC 27001 certification.
- Need to protect intellectual property and business-critical information.
- Want to give customers confidence that information is managed securely.
Value Beyond the Certificate
Benefits of ISO/IEC 27001 Certification
ISO/IEC 27001 certification helps organisations strengthen their information security while improving the way risks are managed.
Protect Sensitive Information
Reduce the risk of unauthorised access, data breaches and information loss.
Build Customer Confidence
Show customers and stakeholders that information security is taken seriously.
Manage Risk Effectively
Identify potential risks before they become costly security incidents.
Support Legal and Contractual Compliance
Help meet information security obligations and industry requirements.
Improve Business Continuity
Reduce disruption by strengthening your organisation’s ability to respond to security incidents.
Drive Continual Improvement
Regular reviews and audits help keep your Information Security Management System effective as your organisation grows.
Why Certify With Sancert?
Our experienced auditors understand the practical application of ISO/IEC 27001 across a wide range of industries. From your initial enquiry through to certification, we provide a professional, efficient process backed by internationally recognised accreditation.
Current Applicable Standard
ISO/IEC 27001:2022 – Information Security Management: This is the current internationally recognised version of the standard. Certification is valid for three years and maintained through annual surveillance audits.
Why Trust Sancert?
Whether you’re seeking certification for the first time or switching to a more reliable partner, Sancert makes the process straightforward, efficient, and built around your business.
Information security expertise
Our auditors understand that information security extends beyond IT, assessing how people, processes and technology work together to protect information.
Risk-based approach
We focus on how your ISMS manages real information security risks, rather than treating certification as a box-ticking exercise.
Independent and impartial
As an accredited certification body, our role is to independently assess your management system against the requirements of ISO/IEC 27001.
Practical certification process
We keep the certification process clear and focused, helping you understand what is required at each stage without unnecessary complexity.
International recognition
Sancert’s accreditation provides confidence that your ISO/IEC 27001 certification is recognised locally and internationally.
Frequently Asked Questions
Securing client data and meeting modern information security requirements comes with unique operational details. Below, we’ve answered the most frequently asked questions regarding ISO/IEC 27001:2022 certification, system readiness, integrated standards and audit expectations.
How long does ISO/IEC 27001 certification take?
Timeframe depends on the size and complexity of your Information Security Management System (ISMS). Once the certification audit has been successfully completed, Sancert typically issues certificates within 10 working days.
How long is an ISO/IEC 27001 certificate valid?
ISO/IEC 27001 certification is valid for three years, with annual surveillance audits to confirm your ISMS continues to meet the requirements of the standard.
Can small businesses become ISO/IEC 27001 certified?
Yes. ISO/IEC 27001 is scalable to organisations of any size — the risk-based approach means controls are applied proportionally to your actual risk exposure, not a fixed checklist.
Is ISO/IEC 27001 legally required?
No. However, many organisations pursue certification to demonstrate data protection commitments, satisfy customer/tender security requirements, reduce breach risk, and support compliance with regulations like POPIA or GDPR (certification doesn’t replace legal compliance but strengthens the underlying controls).
Can ISO/IEC 27001 be integrated with ISO 9001 and ISO 14001?
Yes. ISO/IEC 27001 follows the same High-Level Structure (Annex SL) as ISO 9001 and 14001, so it integrates cleanly into a combined management system rather than running as a separate, siloed process.
What's the difference between ISO/IEC 27001:2013 and 2022?
The 2022 revision restructured Annex A controls from 114 down to 93, reorganised into four themes (Organisational, People, Physical, Technological), and introduced 11 new controls covering areas like threat intelligence and cloud security. Organisations on the 2013 version have a transition deadline to migrate.
Do we need a Statement of Applicability (SoA)?
Yes – the SoA is a mandatory document listing which Annex A controls apply to your organ
What is the certification process?
Our certification process is designed to be straightforward and minimise disruption to your organisation.
1. Initial Enquiry & Scoping
We assess your organisation’s size, activities and scope to prepare an accurate quotation and audit plan.
2. Stage 1 Audit – Documentation Review (“Say what you do”)
Our auditors review your Information Security Management System (ISMS) documentation to determine whether your organisation is ready to proceed to certification. Particular attention is given to your internal audit report, management review records, and Statement of Applicability (SoA).
3. Stage 2 Audit – Certification Audit (“Do what you say”)
We assess how your ISMS operates in practice by reviewing processes, interviewing employees and examining objective evidence.
4. Findings & Corrective Actions
If any nonconformities are identified, these are documented and corrective actions are completed before certification is recommended.
5. Certification & Ongoing Surveillance
Once the requirements have been met, your ISO/IEC 27001 certificate is issued, typically within 10 working days of a successful audit. Annual surveillance audits help ensure your management system continues to meet the requirements of the standard.
