ISO 27001 Certification for NZ Businesses

For a New Zealand business, the decision is whether a managed system and certification support its risks, customer requirements and growth plans. You can use the ISO 27001 framework without seeking certification. If a customer asks for a certificate, first confirm the scope they expect, the deadline and whether they accept another form of assurance.

This guide explains what certification covers, when it is worth considering, how controls are chosen, how the audit works, what affects the cost, and the responsibilities of your business, advisers, IT provider and certification body. For a review of your technical controls against the standard, see our security audit service.

What does ISO 27001 cover?

ISO/IEC 27001 is the international standard setting the requirements for an ISMS, published jointly by ISO and the International Electrotechnical Commission. The current edition is ISO/IEC 27001:2022, and ISO’s page for the standard lists Amendment 1:2024, which adds climate action changes. Under the amendment, an organisation determines whether climate change is a relevant issue, and relevant interested parties can have climate-related requirements, so both belong in the review of context.

Certification assesses the management system within a stated scope, such as a legal entity, a site or a service. It does not mean a breach cannot happen, and a certificate for one division or product may not cover the service a customer buys.

What is an ISMS?

An ISMS is the set of policies, processes, risk decisions, controls and records an organisation uses to manage information security deliberately. It covers people, suppliers and premises as well as technology. The standard also asks for leadership commitment, security objectives, resources, competence, monitoring and continual improvement, so the system is more than a set of documents.

How is ISO 27001 different from ISO 27002?

ISO/IEC 27001 contains the requirements an organisation is certified against. ISO/IEC 27002 is guidance on implementing information security controls, and organisations are not certified to it. Teams use 27002 to understand how a control listed in Annex A might be put in place.

When is certification worth considering?

A contract or tender that requires certification is a clear reason to investigate. It can also be worth considering when you handle sensitive customer information, need a consistent way to manage risk, or want external assurance for future customers. The business case depends on the value of that assurance and the work needed to maintain it.

Illustrative. Confirm the actual requirement before choosing a route.

Ask what the certificate must cover before you commission the work. Where certification is optional, compare adopting the framework without certification with the ongoing cost of external audit. Weigh the cost against the likely contribution or margin from the opportunity, rather than gross contract revenue. Government tenders may also reference the New Zealand Information Security Manual (NZISM), which applies to government information and systems, so read the request closely to see which is being asked for.

Is Cyber Essentials an alternative?

Cyber Essentials is a UK scheme covering a set of baseline technical controls. The basic level is a verified self-assessment, and Cyber Essentials Plus adds a technical audit of systems. It may meet a different or narrower need, but it does not replace an ISO 27001 requirement unless the customer accepts it, and neither level is a prerequisite. The baseline controls can be useful without buying either certificate.

What about SOC 2?

SOC 2 is an assurance report produced by a CPA firm against the AICPA trust services criteria, rather than a certificate. The recipient decides which form of assurance it needs, so check the request rather than assuming from the customer’s location.

Does the Privacy Act require ISO 27001?

No general law requires every New Zealand business to hold ISO 27001 certification, although a customer, contract or sector requirement may make it necessary for you. Under information privacy principle 5, an agency holding personal information must protect it with security safeguards that are reasonable in the circumstances, whether or not it holds a certificate. Our guide to Privacy Act compliance covers those duties.

Illustrative summary of recurring ISMS activities.

What is a Statement of Applicability?

The Statement of Applicability, or SoA, lists the necessary controls, the reason each is included, whether it is implemented, and the justification for excluding any Annex A control. Necessary controls can extend beyond Annex A. The 2022 edition lists 93 Annex A controls in four themes: organisational, people, physical and technological. Check that any template was written for the 2022 edition, because the withdrawn 2013 edition used a different structure.

Can you exclude Annex A controls?

Exclusions need a risk-based justification. A business without an internal development team should not automatically exclude the secure development controls, because purchased, configured and outsourced systems still need to be considered. The decision depends on the risks and on how systems are acquired, built and changed.

How do internal audit and management review work?

Internal audit checks that the ISMS meets the organisation’s own requirements and the standard, and that it is effectively implemented. Auditors need to be competent and impartial, so nobody audits their own work. Management review is where leadership considers audit results, performance and changes, then decides on improvements. Both need suitable records, but the standard does not prescribe a meeting-minute format or a public audit timetable. A one-off security audit is a different exercise from the internal audit programme, and an audit and a risk assessment answer different questions.

How does the certification process work?

Preparing and operating the ISMS is your work; the two-stage certification audit is the certification body’s. A gap analysis is useful preparation, but it is not a compulsory certification stage.

Typical route. Timing and evidence requirements are agreed with the certification body.

Who issues the certificate?

A certification body makes the certification decision. ISO’s certification guidance states that ISO does not issue certificates and that accreditation is not compulsory. Choose a body accredited for ISO/IEC 27001, then check that its accreditation and the certificate scope meet your customer’s requirements. Accreditation adds external assurance about the body’s competence, and JAS-ANZ is one accreditation route in New Zealand. Certification bodies work to ISO/IEC 27006-1:2024 alongside ISO/IEC 17021-1.

Exodesk does not issue ISO 27001 certificates. Certification is a separate function from implementation, carried out by a competent and impartial body.

What happens if the audit finds problems?

The certification body records findings and sets the required corrective action and verification process. Certification depends on meeting its requirements and receiving a positive decision. Confirm the response timetable and any additional audit cost with the body before the audit.

Who sets the scope?

The business proposes the ISMS scope and the certification body checks it. The scope must reflect actual activities and dependencies and meet the buyer’s requirement. Narrowing it to lower the fee does not help if the service the customer buys is excluded.

How long does certification take?

Timing depends on scope, existing processes, staff capacity, evidence of operation and audit availability. Agree the plan and evidence requirements with the certification body before committing to a deadline. A scoping conversation can show where to start and a gap analysis identifies the work needed, but neither sets a certification date. Allow time to operate the ISMS and collect records before Stage 1, and plan audit dates around the staff who will be interviewed.

Who does what, and how can Exodesk help?

Exodesk can help review and improve the technical controls supporting your ISMS, including access, patching, logging, endpoint protection and backup and recovery. We agree which systems, controls and records are covered, and work alongside the people responsible for the wider management system. Your business retains ownership of risk decisions, responsibilities and ongoing operation.

Supplier contracts, staff screening, physical access and incident communications belong to the business, so name an owner for each early. A general security audit is not automatically a complete ISMS internal audit or a certification-readiness assessment. Our security audits include agreed gap reviews against ISO 27001 that state whether they cover technical controls only or the wider ISMS, and a cyber security assessment helps choose the right kind of review. If a customer has sent a security questionnaire, answer from evidence and confirm what certification or assurance they require.

Exodesk has supported New Zealand businesses since 1989. Today, our Christchurch and Dunedin teams support businesses nationwide. If a customer has asked for certification, tell us what they require and when, so we can discuss the technical work and agree the scope of support. For wider implementation and ongoing protection, see our cyber security services.

Contact us or call 0800 396 337 to talk about ISO 27001.