Prepare your ISMS for ISO/IEC 27001:2022 certification
Training for CISOs, IT managers, GRC officers, internal audit teams, and business process owners — understand ISMS clauses 4–10, apply the 93 Annex A controls, and run internal audits per ISO 19011 before the certification body arrives.
- Core clauses
- Clauses 4–10Core clauses
- Annex A controls
- 93 controls (2022)Annex A controls
- Companion standard
- ISO/IEC 27002:2022Companion standard
- Format
- Inhouse, online, hybridFormat
ISO 27001 Awareness + Internal Auditor training equips your team to understand ISMS clauses 4–10 and the 93 Annex A controls (2022 version), draft the Statement of Applicability, and run internal audits per ISO 19011. Neksus trains to readiness; a KAN-accredited certification body performs the audit and issues your ISO/IEC 27001:2022 certificate.
The international standard for Information Security Management Systems
ISO/IEC 27001:2022 is the international standard for Information Security Management Systems (ISMS), jointly published by ISO and IEC. The 2022 edition replaces 27001:2013, preserving the Annex SL clause 4–10 structure and refactoring Annex A from 114 controls in 14 domains into 93 controls across 4 themes: Organizational (37), People (8), Physical (14), and Technological (34). Its implementation companion is ISO/IEC 27002:2022 — deeper per-control guidance. Neksus trains your team to define the ISMS context, perform risk assessment, draft the Statement of Applicability, implement applicable Annex A controls, and run an internal audit cycle before the certification body arrives.
- The 2022 edition is mandatory — organizations on 27001:2013 must transition before October 2025 (IAF deadline)
- All 93 Annex A controls must be evaluated and marked applicable or excluded with written justification
- The Statement of Applicability (SoA) is the most scrutinized mandatory document
- Aligns with Indonesia’s UU 27/2022 PDP Law for personal-data security components
ISO/IEC 27001 certificates can only be issued by accredited certification bodies (KAN in Indonesia, internationally recognized via the IAF MLA). Neksus prepares your ISMS to pass Stage 1 and Stage 2 — without promises of guaranteed certification.
UU 27/2022 PDP regulates personal data processing as a legal obligation. ISO 27001 is the information security management framework that helps organizations implement supporting technical and organizational controls. Many organizations use the ISMS as the foundation for PDP compliance.
Per the IAF resolution, ISO 27001:2013 certificates become invalid after 31 October 2025. Organizations holding 27001:2013 certificates must pass a transition audit to 27001:2022 before that date. Transition Internal Auditor training focuses on the Annex A restructure and the 11 new controls.
Typical ISMS scopes that get certified
Scope definition (clause 4.3) is a strategic decision that determines audit complexity and cost.
Scope: SaaS service from development through delivery; includes engineering, cloud infrastructure, customer support, and vendor management. Common enterprise-customer requirement.
Scope: digital financial services, payment processing, online lending. Often paired with POJK 11/2022 IT risk management and POJK Cybersecurity regulations.
Scope: data center infrastructure and operations. Many Annex A.7 (physical) controls may be applicable.
Scope: core information systems managing employee/citizen data. Aligns with BSSN and SPBE security guidelines.
Scope: electronic medical records, queue systems, BPJS integration. Very sensitive for health data.
Scope: operational technology (OT/ICS) systems converging with IT. Unique challenges in Annex A.7 (physical) and A.8 (technological).
Organizational readiness before inviting a certification body
Without these items, Stage 1 declares ‘inadequate readiness’ and Stage 2 is deferred.
- Information security policy authorized by top managementCommitment to information security, compliance obligations, risk framework, and security objectives.
- ISMS context & written scopeClause 4 — issue analysis, interested parties (regulators, clients, partners), interfaces with systems outside the scope.
- Risk assessment & treatment methodologyClause 6.1 — documented risk method (e.g. ISO 31000 or OCTAVE), risk acceptance criteria, current risk register.
- Statement of Applicability (SoA)Must cover all 93 Annex A controls: applicable/excluded status, justification, and reference to procedures/technical controls.
- Risk Treatment PlanList of selected controls with target dates, owners, and implementation status.
- Evidence of applicable Annex A control implementationFor every applicable control, there must be a procedure, log, and/or technical configuration that is auditable.
- One internal audit cycle + management reviewInternal audit per ISO 19011, compliance evaluation, and management review (clause 9.3) with standard inputs/outputs.
Audit path from contract to certificate
Per ISO/IEC 17021-1 — 3-year certification cycle with two surveillance audits.
- 1
Application & contract
1–2 weeksSubmit scope, employees in scope, sites, IAF sector (37 for IT). The body computes mandays per IAF MD 5.
- 2
Stage 1 — ISMS documentation review
1–2 daysAuditor reviews policy, scope, risk register, SoA, risk treatment plan, internal audit results, and management review minutes. Output: readiness confirmed, or prerequisites to close.
- 3
Stage 2 — Implementation audit
3–10 days onsiteAuditor goes into processes & systems. Interviews CISO, IT team, asset owners, vendors. Review of access logs, firewall configs, backups, patch management, incident logs. Findings classified.
- 4
Closure of findings & certification recommendation
30–90 daysMajor NCs must be closed with evidence of effective corrective action before the recommendation. Minor NCs may close at surveillance.
- 5
Certificate issuance (3-year cycle)
—Certificate carries the specific ISMS scope. Often required by enterprise customers and during M&A due diligence.
- 6
Year 1 & 2 surveillance audits
Annual, 2–5 daysFocus on significant changes (new architecture, new vendors, major incidents), monitoring results, and a sample of critical controls.
- 7
Recertification audit (year 3)
Before certificate expiresFull re-audit. Pass → renewed for another 3 years.
What an ISO 27001 Internal Auditor does — beyond the checklist
Internal Auditor training follows ISO 19011:2018 with added information-security competency focus.
An ISO 27001 internal auditor verifies the SoA — that every control declared applicable is actually implemented and effective. They go into the systems: examining access logs against least privilege, testing the incident response procedure, evaluating firewall configurations against the baseline, auditing asset lifecycle (HR onboarding/offboarding), and auditing vendor contracts for security clauses. Independence is critical — auditors from one BU audit another BU. Internal audits are a mandatory input to the management review (clause 9.3).
- Understanding of ISMS clauses 4–10 and the Annex SL structure
- Mastery of the 93 Annex A controls: organizational, people, physical, technological
- Risk-based thinking & risk assessment methods (ISO 31000 / OCTAVE / FAIR)
- SoA audit: justifying inclusion/exclusion and consistency with implemented controls
- Basic technical audit: access logs, security configuration, backup, vulnerability management
- Understanding of supporting regulation: UU 27/2022 PDP, PP PDP, BSSN regulations
- ISO 19011 — independence, objectivity, evidence-based
- Major NC
E.g. SoA inconsistent with implemented controls, a critical control (e.g. backup) not working, or a major incident not handled per procedure.
- Minor NC
E.g. access logs not reviewed regularly, a procedure not updated after a change, or awareness training not delivered for one department.
- OFI
E.g. recommendation to automate access review, or to adopt an additional framework (e.g. NIST CSF) for governance strength.
- Observation
E.g. note on a newly emerging risk (new vendor, new service) not yet covered by the risk assessment.
Expected outcomes for your team
Awareness vs Internal Auditor vs Lead Auditor preparation (Information Security)
| Criterion | Awareness | Internal Auditor ★ | Lead Auditor preparation |
|---|---|---|---|
| Typical duration | 1 day | 3 days | 5 days (IRCA-style) |
| Target audience | All employees with system access | Internal audit & GRC team | Aspiring Lead Auditors / ISMS consultants |
| Main output | Security policy understood & lived | Audit checklists + draft SoA + finding reports | Individual certificate from a registered training scheme |
| Delivered by | Training vendor (e.g. Neksus) | Training vendor (e.g. Neksus) | Registered training organization (e.g. IRCA / PECB) |
Engagement path with Neksus for ISO 27001
- 1
Kickoff & gap analysis
Week 12-hour workshop with CISO/IT Lead: ISMS scope mapping, gap identification vs 93 Annex A controls, target certification schedule.
- 2
1-day awareness
Week 2For all in-scope employees (engineering, customer support, HR, finance). Goal: embed an information security culture.
- 3
3-day Internal Auditor workshop
Weeks 3–4Clauses 4–10, the 93 Annex A controls, risk assessment methods, SoA audit, ISO 19011 technique, and finding-write practice.
- 4
Mock audit in critical areas
Week 5Facilitator accompanies audit at one BU (e.g. engineering / data center). Participants practice interview technique & log verification.
- 5
Readiness review & closure recommendations
Week 6Report: remaining gaps, priority actions, Stage 1 document readiness.
- 6
Handoff to the certification body
Week 7+Stage 1 document package is ready. Body selection is entirely your decision.
Target roles
ISMS owner, primary contact with the certification body.
Accountable for Annex A.8 (technological) control implementation.
Maintains the SoA, risk register, and ISMS documentation.
4–8 cross-BU people for independence.
Aligns the ISMS with UU 27/2022 PDP.
Information asset owners who must demonstrate controls at audit.
Annex A.6 (people) controls — screening, training, disciplinary process.
Directs the information security policy and leads the management review.
Examples of accredited certification bodies for ISO 27001 in Indonesia
The list below is not a Neksus recommendation. Body selection is entirely your organization’s decision.
UK-origin body; original author of many ISO/IEC information security standards.
Broad experience auditing ISMSs for SaaS, fintech, and data centers.
Common for 27001 combined with 27017/27018 (cloud).
Multi-site and cross-jurisdiction cloud ISMS experience.
ISMS audit experience in financial services and energy.
Frequently used in SOE/government tenders and OJK fintech ecosystem.
The bodies above are examples of organizations accredited (typically through KAN and the IAF MLA network) that can perform certification audits. They are not Neksus partners and do not receive referrals from Neksus. Choosing a certification body is entirely your organization’s decision based on scope, sector, and internal procurement requirements.
Typical outcome patterns from comparable clients
B2B SaaS, 80 employees, first-time certification to satisfy enterprise customer demand.
Awareness for the whole team (1 day) + 3-day Internal Auditor for 5 cross-functional people + mock audit focused on engineering & vendor management.
Stage 1 passed without critical findings; Stage 2 produced 2 Minor NCs (access review & vendor security clauses) closed within 45 days. Certificate unlocked the next enterprise-customer pipeline.
OJK-regulated fintech, 150 employees, transition from 27001:2013 to 27001:2022.
2-day Internal Auditor transition training focused on the 11 new controls + SoA update + mock transition audit.
Transition audit passed within the regular surveillance cycle at no extra cost.
SOE utility, certifying the SCADA-IT system.
Training for IT, OT, and vendor management teams; coaching on a feasible vs ambitious scope definition.
ISO 27001 with a focused scope (control room + SCADA-IT) achieved, establishing the foundation for a scope-expansion roadmap the next year.
Procurement information
- Contract formatInhouse training, continuous program, or integrated awareness + Internal Auditor + mock audit package.
- LocationOnsite at the client site (Jabodetabek with no extra travel charge), regional onsite, or live online.
- Language of deliveryIndonesian or bilingual ID/EN (many engineering teams default to EN).
- Materials & participant certificateModules, handouts, SoA template, Annex A audit checklists, Neksus participation certificate.
- Tax documentationVAT invoice, receipt, BAST. SOE/government e-procurement support available.
- Payment terms30% advance on contract, 70% on training completion.
- Optional implementation coachingSeparate consulting on a manday basis: Annex A control implementation coaching, pre-Stage-1 coaching.
Frequently Asked Questions
Discuss ISO/IEC 27001:2022 readiness for your organization
Send your ISMS scope and target certification schedule. The Neksus team studies your context and prepares a program design within 2 business days.
- Awareness, Internal Auditor, and mock audits focused on critical areas
- Facilitators with CISO/security architect & ISMS audit backgrounds
- Materials cover the 27001:2013 → 27001:2022 transition and PDP Law alignment
- Structured handoff to your chosen certification body