Information security is now a board-level concern for many Australian organisations. High-profile data breaches, the passage of the Privacy and Other Legislation Amendment Act 2024 (opens in a new tab) and rising expectations from enterprise clients have all increased pressure on suppliers to show that they manage information security formally.
What ISO/IEC 27001 Actually Is
ISO/IEC 27001 (opens in a new tab) is not a technical checklist. It specifies the requirements for an information security management system (ISMS): a structured way to identify your organisation’s information security risks, put controls in place to address them, and keep reviewing and improving them. The current edition is ISO/IEC 27001:2022.
An ISMS that meets the standard requires your organisation to:
- Identify the information assets it holds and the risks to those assets
- Select proportionate controls, using the 93 controls in Annex A as a reference
- Document its policies, procedures and risk treatment decisions
- Run a cycle of internal audit, management review and continual improvement
Certification is granted after an audit by an accredited certification body. Certified organisations have surveillance audits, usually annually, and a full recertification audit every three years.
Why Australian Businesses Are Moving Now
The Privacy Act reforms passed in late 2024 have sharpened regulatory expectations about how personal information is protected. Some government and enterprise tenders ask suppliers to hold ISO/IEC 27001 certification or demonstrate equivalent controls. And enterprise clients in sectors such as financial services, healthcare and legal services are pushing security requirements down their supply chains.
Timing matters for organisations already certified to the 2013 edition. The transition period to ISO/IEC 27001:2022 ends on 31 October 2025, after which certificates to the 2013 version are no longer valid. If you have not yet transitioned, it is worth scheduling the transition audit with your certification body well before that date.
What the Implementation Process Looks Like
- Gap analysis: compare current practices against the standard and identify where work is needed
- Policy and procedure development: create the documented framework
- Risk assessment and treatment planning: identify key risks and the controls to address them
- Implementation: put controls and procedures into practice
- Internal audit and management review: prepare for certification
- Certification audit: a formal two-stage assessment by an accredited body
Asset Hosting can help organisations at each stage. If you are considering ISO/IEC 27001, we would be glad to talk it through.