Static Computers is ISO 27001 certified. Our information security management system has been audited by an independent certification body against ISO/IEC 27001, the international standard for information security management, and it passed.
In plain terms, that means the way we protect information, including our clients' information, has been checked by someone from outside the business. Not by us. Not by a vendor selling us software. By an auditor whose job is to find the gaps.
We're a Sydney managed IT provider and we've been looking after local businesses since 2006. On any given day we hold administrator access to our clients' email, files, devices, networks and backups. That access is what lets us fix things fast. It's also exactly why our own security has to be beyond question.
What does ISO 27001 certified mean?
Being ISO 27001 certified means a business runs an information security management system (ISMS) that meets the requirements of ISO/IEC 27001, and an accredited certification body has audited it and issued a certificate. The certificate lasts three years, with surveillance audits in between, so it has to be earned again and again.
It doesn't mean a business can never be breached. No standard can promise that. It means the business manages information security risks in a structured, documented way, and lets an independent auditor check that it actually works.
Who publishes the standard?
ISO/IEC 27001 is published jointly by ISO, the International Organization for Standardization, and the IEC, the International Electrotechnical Commission. That's why you'll see it written as ISO IEC 27001 or ISO/IEC 27001. The current version is ISO/IEC 27001:2022.
Is ISO 27001 a product or a piece of software?
No. You can't buy ISO 27001 off the shelf. It's a management system standard, in the same family as other ISO management system standards for quality or environmental management. It describes how a business should run information security as an ongoing process, not which tools to install.
What is an information security management system?
An information security management system is the set of policies, processes, roles and controls a business uses to protect its information. It covers the confidentiality, integrity and availability of that information: who can see it, whether it can be trusted, and whether it's there when you need it.
A good ISMS isn't a binder on a shelf. It's how the business actually works. It decides which information assets matter, who owns each risk, which controls are in place, and how the business checks those controls are doing their job.
What information does an ISMS protect?
Pretty much anything the business would be hurt by losing, leaking or having tampered with. That includes client records, sensitive data such as financial and health information, employee data, contracts, intellectual property, passwords and system configurations. For an IT provider, it also includes the administrator credentials and remote access tools that reach into every client environment.
Why is it a risk-based approach?
ISO 27001 doesn't hand you one fixed checklist. It asks you to work out your own information security risks, then decide what to do about each one. A 15-person accounting practice in Parramatta and a national logistics company face different threats, so they shouldn't have identical controls. The risk-based approach lets each business put its effort where the real risk is.
How the ISO 27001 requirements work
The requirements of ISO/IEC 27001 sit in clauses 4 to 10 of the standard. To be certified, a business has to meet all of them. Annex A then provides a reference list of 93 controls the business can use to treat its risks.
What do clauses 4 to 10 cover?
- Clause 4, context: understanding the internal and external issues that affect the business, the interested parties and their security requirements, and the scope of the ISMS.
- Clause 5, leadership: management commitment, an information security policy, and clear roles and responsibilities.
- Clause 6, planning: the information security risk assessment, the risk treatment process and measurable information security objectives.
- Clause 7, support: resources, competence, awareness, communication and documented information.
- Clause 8, operation: actually running the risk assessment and risk treatment plan, and controlling the processes that matter.
- Clause 9, performance evaluation: monitoring, measurement, internal audit and management reviews.
- Clause 10, improvement: dealing with nonconformities and continually improving the system.
The final clause is the one that keeps the system alive. A business that stops improving will struggle at its next surveillance audit.
What are the Annex A controls?
Annex A lists 93 controls grouped into four themes: 37 organisational, 8 people, 14 physical and 34 technological. They range from access control and backups to supplier security, secure disposal of equipment and staff awareness training. We cover them in detail in our guide to ISO 27001 controls.
A business records which controls apply, which don't, and why, in a document called the Statement of Applicability.
The information security risk assessment
The information security risk assessment is the heart of ISO 27001. It's where a business identifies what could go wrong, how likely it is and how bad it would be. Everything else follows from it.
How do you assess information security risks?
Assessing information security risks usually starts with a list of information assets: systems, data, devices, people and suppliers. For each one, the business asks what threats it faces, what weaknesses could be exploited, and what the impact would be on the business objectives. Each risk is given an owner, the person accountable for deciding how it's handled.
Take a small architecture firm in Newcastle. Its biggest risks might be a ransomware attack on its file server, a staff member's laptop being stolen from a car, and a contractor keeping access to project files after the job ends. Each of those becomes a line in the risk register.
What is risk treatment?
Once risks are assessed, the business has to select risk treatment options for each one. Broadly, a risk can be reduced with controls, avoided by stopping the activity, shared with someone else such as an insurer, or accepted. The decisions go into a risk treatment plan, and the risk owners sign off on whatever is left over.
What are residual information security risks?
Residual information security risks are what remains after the controls are in place. They're never zero. The standard asks risk owners to formally accept them, which is a useful discipline: someone senior has looked at the remaining risk and agreed it's adequately managed, rather than nobody noticing it at all.
The ISO 27001 certification process
The certification process is run by an independent certification body. In Australia, certification bodies are accredited by JAS-ANZ, the national accreditation body for Australia and New Zealand. Accreditation is what gives the certificate its weight: it means the auditor has been checked too.
What happens in the stage 1 audit?
The stage 1 audit is mostly a documentation and readiness review. The auditor looks at the scope of the ISMS, the information security policy, the risk assessment, the Statement of Applicability and other documented information. The aim is to confirm the business is ready for the main audit and to flag anything that needs fixing first.
What happens in the stage 2 audit?
The stage 2 audit checks that the ISMS works in practice. The auditor interviews staff, looks at evidence and tests whether the controls described on paper actually happen. Does the access review really get done every quarter? Are backups really tested? Did the internal audit actually take place? If the answers hold up, the certification body issues the certificate.
How long does an ISO 27001 certificate last?
An ISO 27001 certificate is valid for three years. During that time the certification body carries out surveillance audits to confirm the system is still running and improving. At the end of the three years there's a recertification audit, and the cycle starts again.
Can a business certify itself?
No. A business can say it's aligned with ISO 27001, but only an accredited certification body can issue a certificate. The same goes for consultants and IT providers. We help businesses prepare, but we never certify anyone ourselves. If someone offers to both build your ISMS and certify it, that's a red flag.
Why ISO 27001 certification matters
For most small and medium businesses, the value of ISO 27001 certification comes down to trust. It gives customers, partners and insurers independent evidence that information entrusted to the business is being looked after properly.
Does ISO 27001 certification reassure customers?
Yes, and that's often the main reason businesses pursue it. When a larger client sends a security questionnaire, a valid certificate answers a big chunk of it in one go. It shows the business has a risk-aware culture and a system that's been tested from the outside, rather than just a promise that security is taken seriously.
Does it help with tenders and contracts?
Often. Many tenders, particularly for larger organisations, ask suppliers whether they're ISO 27001 certified or can show an equivalent information security management system. Contractual obligations around data handling are also easier to meet, and to prove, when the controls and evidence are already in place. For businesses with bigger ambitions, certification can open doors to enterprise buyers and to global markets, where ISO 27001 is widely recognised.
Does it improve security posture?
It should. Going through certification forces a business to find and address weaknesses it might otherwise ignore, from unmanaged devices to old accounts nobody removed. It also builds the habit of checking. Internal audits and management reviews mean problems are found by the business before they're found by an attacker. That's real cyber resilience, not just a certificate on the wall. A well-run ISMS can also reduce the risk and cost of a breach, and it prepares the business for a calmer, more robust incident response, because roles and steps are agreed in advance. Clear, documented processes tend to bring operational efficiency too.
Does ISO 27001 help with regulatory requirements?
It can support them. A well-run ISMS helps a business understand its legal and regulatory requirements for information, document how it meets them and respond properly to cyber security incidents. It isn't a substitute for legal advice, and certification doesn't automatically mean a business is fully compliant with every law that applies to it.
What our certification means for our clients
For our clients, the change is mostly invisible, and that's the point. The way we protect your systems has been independently audited, and it will keep being audited.
- Your IT provider's own security has been checked against an international standard by an independent certification body.
- When a client, insurer or tender panel asks how your IT provider protects your data, you have a clear, verifiable answer.
- The same approach we use internally, from access control to backups and incident response, is what we bring to your business.
- Nothing changes in how you work with us. Your support, your contacts and your agreement stay the same.
Why your IT provider's certification matters to you
Your IT provider is usually the supplier with the most access to your business. Security questionnaires from clients and insurers increasingly ask about suppliers with access to your systems, and the IT provider tends to sit at the top of that list. We've written more about this in why your IT provider should be ISO 27001 certified.
Why we became ISO 27001 certified
More and more of our clients were being asked hard questions about cyber security: by their own customers, by insurers at renewal time and in tender documents. Many of those questions were really about us, their IT provider.
We wanted our answer to be simple and independently backed. Going through certification also sharpened our own processes, and it means we understand first-hand what's involved when a client wants to go down the same path.
What certification really takes
For most businesses, certification is more about discipline than technology. The technical controls matter, but the harder part is making sure every process has an owner, every decision is recorded and every check actually happens on schedule. That's where most of the effort goes, and it's where an ISMS proves its worth.
Thinking about ISO 27001 for your business?
If your clients, insurers or tenders are starting to ask about ISO 27001, you're not alone. Plenty of Australian small businesses are weighing it up for the first time. The good news is you don't have to work it out on your own.
How Static Computers can help
We help Sydney businesses prepare for certification. That usually includes:
- A gap analysis to show how far your current setup is from the standard.
- Putting the technical controls in place, from multi-factor authentication to backups and device management.
- Helping you build the policies, procedures and evidence an auditor will want to see.
- Support with tenders and supplier security questionnaires along the way.
The certification itself is always done by an independent, accredited certification body. We don't certify anyone, and we'll tell you honestly if we think you're not ready yet.
How much does certification cost?
It depends on your size, scope and starting point, so there's no single price. We break down the cost components in our guide to ISO 27001 certification cost.
Is ISO 27001 or the Essential Eight the right starting point?
For many Australian businesses, the Essential Eight is the practical technical baseline and ISO 27001 is the management system around it. We compare them in ISO 27001 vs the Essential Eight.
Frequently asked questions
Is Static Computers ISO 27001 certified?
Yes. Static Computers is ISO 27001 certified. Our information security management system has been audited by an independent certification body against ISO/IEC 27001.
Which version of ISO 27001 is current?
ISO/IEC 27001:2022. The transition period from the 2013 version ended on 31 October 2025, so valid certificates now need to be to the 2022 version.
Who accredits certification bodies in Australia?
JAS-ANZ, the Joint Accreditation System of Australia and New Zealand. It's worth checking that any certificate you're shown comes from an accredited certification body.
How often is an ISO 27001 certified business audited?
There's an external audit for initial certification in two stages, surveillance audits during the three-year certificate, and a recertification audit at the end. The business also runs its own internal audit programme in between.
Where to go from here
For the bigger picture, read our plain-English guide to ISO 27001 certification for Australian businesses. And if you'd like to know where your business stands today, book a complimentary IT review. We'll look at your current setup and tell you, in plain English, what's in good shape and what needs work.