ISO 27001 certification for Australian businesses
Last reviewed 19 October 2026.
ISO/IEC 27001 is the international standard for information security management. It sets out how a business should run an information security management system (ISMS): a documented, risk-based way of protecting the information it holds, which an independent, accredited auditor can certify. Static Computers is ISO 27001 certified, and we help Sydney businesses understand the standard, prepare for certification and answer the security questions their clients, insurers and tenders ask.
What is ISO 27001?
ISO/IEC 27001 is published jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). The current version is ISO/IEC 27001:2022.
It isn't a product, and it isn't a checklist of software to buy. It's a management system. You decide which information matters to your business, assess the risks to it, choose controls to deal with those risks, and keep checking that the controls work. It covers people, processes and physical security as well as technology, which is why it's recognised by clients and government buyers around the world.
What the standard requires
The requirements sit in clauses 4 to 10 of the standard. In plain English:
- Context and scope. Decide which parts of the business, locations and systems the ISMS covers.
- Leadership. Management commits to it, signs off an information security policy and assigns clear roles.
- Risk assessment and treatment. Identify the risks to your information, decide how to treat each one, and record which controls apply in a Statement of Applicability.
- Support and operation. Give the ISMS the people, training and documentation it needs, and put the controls into practice.
- Performance evaluation. Monitor and measure, run internal audits and hold management reviews.
- Improvement. Fix what the audits find, and keep improving the ISMS over time.
The Annex A controls (2022 version)
Annex A of ISO/IEC 27001:2022 lists 93 controls, grouped into four themes. Not every control applies to every business: your Statement of Applicability explains which ones you use and why.
| Theme | Controls | Examples |
|---|---|---|
| Organisational | 37 | Information security policies, supplier security, incident management, business continuity |
| People | 8 | Screening, security awareness training, confidentiality agreements, remote working |
| Physical | 14 | Secure areas, clear desk and screen, equipment protection, secure disposal |
| Technological | 34 | Access control, multi-factor authentication, malware protection, backups, logging, secure configuration |
How ISO 27001 certification works
-
Scope and gap analysis
Agree what the ISMS will cover, then compare how you work today with what the standard requires.
-
Build the ISMS
Write the policies, run the risk assessment, and prepare the risk treatment plan and Statement of Applicability.
-
Put it into practice
Implement the controls, train your team, and run the ISMS for long enough to show it works, including an internal audit and a management review.
-
Stage 1 and stage 2 audits
An accredited certification body first reviews your documentation and confirms you're ready (stage 1), then checks that the ISMS works in practice across the scope you've chosen (stage 2).
-
Certification and upkeep
The certificate is valid for three years, with surveillance audits in between and a recertification audit at the end.
In Australia, certification bodies are accredited by JAS-ANZ, the Joint Accreditation System of Australia and New Zealand. Certification is always done by an independent body, not by the IT provider or consultant who helps you prepare.
How long it takes and what it costs
There's no fixed price or timeline, because both depend on:
- Size and scope. How many people, sites and systems the ISMS covers.
- Where you're starting from. A business with MFA, managed devices, tested backups and written policies is much closer than one starting from scratch.
- How much help you use. Doing the work in-house costs time; outside help costs money but usually shortens the journey.
- Security improvements. Gaps the risk assessment finds may need new tools or changes.
- Audit fees. The certification body charges for the stage 1 and stage 2 audits, and for the surveillance audits that follow.
The fastest way to get a realistic estimate for your business is a complimentary IT review: we look at what you run today and tell you how far you are from the standard.
ISO 27001 vs the Essential Eight
Australian businesses often ask which one they need. They do different jobs, and many businesses use both.
| ISO 27001 | Essential Eight | |
|---|---|---|
| Who publishes it | ISO and IEC (international) | Australian Signals Directorate (ASD) |
| What it is | A management system for information security, built on risk | Eight prioritised strategies to mitigate cyber security incidents |
| Can you be certified? | Yes, by an accredited certification body | No formal certification; maturity is assessed against levels Zero to Three |
| What it covers | People, processes, physical security and technology | Technical controls: applications, patching, macros, admin rights, MFA, backups |
| Best for | Proving your security to clients, tenders and international partners | A practical technical baseline for any Australian business |
A common approach is to use the Essential Eight as the technical baseline inside an ISO 27001 ISMS. Read more in our Essential Eight guide or book an Essential Eight assessment.
Why it matters if your IT provider is ISO 27001 certified
Your IT provider usually holds administrator access to your email, files, devices and backups. That makes them one of your biggest supplier risks, and it's exactly what clients, insurers and tender panels ask about in security questionnaires.
An ISO 27001 certified provider runs its own information security management system, independently audited against the standard. Static Computers is ISO 27001 certified, so when a client or insurer asks how your IT provider protects your data, you have a clear answer.
How Static Computers helps
- Readiness and gap analysis. We compare how your business runs today with ISO 27001, in plain English, and tell you what to fix first.
- The technical controls. Access control, MFA, endpoint protection, patching, logging and backup and disaster recovery, set up and kept running through managed IT services and cyber security.
- Policies and evidence. Help writing the policies and procedures, and collecting the evidence auditors look for.
- Tenders and questionnaires. Help answering supplier security questionnaires, cyber insurance renewals and tender requirements accurately.
- Between audits. Ongoing support that keeps the controls working, so surveillance audits aren't a scramble.
More on ISO 27001
- Static Computers Is Now ISO 27001 Certified: What It Means
- ISO 27001 Certification Cost in Australia: What Drives the Price
- ISO 27001 Controls Explained: All 93 Annex A Controls (2022 Version)
- ISO 27001 vs Essential Eight: Which Does Your Business Need?
- Why Your IT Provider Should Be ISO 27001 Certified
What clients say on Google
Read 10 of our 40+ reviewsThe best MSP I have used. These guys are quick, reliable and professional.
Great to deal with very helpful always answers a call , is very efficient at solving problems and making your data safe would highly recommend static computers and Steven
Steve turned around an issue we were having with our CRM configuration in a timely and professional manner. I would definitely engage Steve at Static Computers again in the future.
Questions we get asked
Not here? Call 1300 366 638 or ask on the review call.
Is ISO 27001 mandatory in Australia?
No. ISO 27001 is voluntary. It's often asked for by clients, government buyers and larger businesses in contracts and tenders, which is why many small and medium businesses choose to certify.
What's the difference between ISO 27001 and ISO 27002?
ISO 27001 sets the requirements a business is certified against. ISO 27002 is a companion guidance standard that explains how to implement the controls in Annex A.
How long is an ISO 27001 certificate valid?
Three years. During that time the certification body runs surveillance audits, and at the end there's a recertification audit.
Is the 2013 version of ISO 27001 still valid?
The transition period from ISO/IEC 27001:2013 to the 2022 version ended on 31 October 2025, so certificates now need to be to ISO/IEC 27001:2022.
Can a small business get ISO 27001 certified?
Yes. The standard scales to the size of the business, and the scope can be set to the parts of the business that matter most to your clients.
Is Static Computers ISO 27001 certified?
Yes. Static Computers is certified to ISO/IEC 27001, the international standard for information security management.
Sources
ISO/IEC 27001:2022, International Organization for Standardization. Essential Eight, Australian Signals Directorate, cyber.gov.au. Accreditation of certification bodies, JAS-ANZ.
Book your complimentary IT review
25 minutes, phone or Teams. You get a written report covering what you run, what is at risk and what we would fix first, with a proposed agreement within five business days. No obligation.
Rather talk now? Call 1300 366 638. Not ready yet? Get Steven’s book, 90 Days to a Secure Business.