🔒 Information Security Management

ISO 27001 ISMS Certification Consulting

ISO/IEC 27001:2022 (GB/T 22080) · CNCA-ISMS-01:2026 certification rules · Covers gap analysis, risk assessment, system building and audit accompaniment

Free Consultation 📞 Contact Us

Certification Overview

ISO 27001 is the international standard for information security management systems. China has adopted it identically as GB/T 22080, and certificates are issued by CNCA-accredited certification bodies

3 years

Certificate validity, maintained through an annual surveillance audit

3-6 months

From system building to certification

Operating ≥3 months

The system must have been running for 3 months before you apply

50+ accredited bodies

CNCA-accredited certification bodies nationwide

Who It Applies To

IT service companies

Often a prerequisite for bidding on government and financial IT projects

Software development firms

Shows information security management capability across the development process

Cloud service providers

Addresses client audit requirements around data security compliance

Data-intensive enterprises

Compliance obligations under data security and personal information protection law

Certification Requirements

✓ Legal entity status

Relevant administrative licenses in place (where applicable)

✓ System running for 3 months

ISMS established and running normally

✓ No serious credibility record

Not on the list of seriously illegal and dishonest entities

✓ No major security incidents

No major cybersecurity incident in the past year

Certification Process

Gap Analysis

Review your existing management system against the standard

Risk Assessment

Identify information assets, threats and vulnerabilities

System Building

Draft the ISMS documentation (manual, procedures, work instructions)

Operation Coaching

Help you run the system for 3+ months

Internal Audit + Management Review

Train internal auditors, run the internal audit and hold the management review

✓

Certification Audit

Stage 1 (documentation) + Stage 2 (on-site) + certification

Consulting Fee Reference

Actual fees depend on the size of your organization, the complexity of your business and how mature your existing management system is. Contact us for a detailed quote

Need a tailored quote?

Tell us your organization's size and what you need, and we will come back with a proposal the same day

📞 Contact Us Now

ISMS vs ITSMS vs CCRC

	ISO 27001 (ISMS)	ISO 20000 (ITSMS)	CCRC
Focus	Information security	IT service management	Security service capability
Core	Confidentiality, integrity and availability	Service quality and SLAs	Service qualification level
What it demonstrates	"Security management is run properly"	"IT operations capability meets requirements"	"Security service capability is strong"
Relationship	Complementary; clients can apply for both	Complementary; clients can apply for both	Complementary; clients can apply for both

FAQ

How long does ISO 27001 take?

A typical timeline from scratch is 3-6 months: system building and operation take the first 2-3 months, then the audit and corrective actions take the next 1-2 months. If you already have some of the foundation in place (ISO 9001, for example), this can come down to 2-3 months.

Can a small IT company (10-20 people) do ISO 27001?

Yes. The standard lets small organizations build an ISMS scaled to their own size, without a complex documentation system.

We already have ISO 9001 — how much work does that save on ISO 27001?

If you already hold ISO 9001, the core of the management system is in place (document control, internal audit, management review, and so on). ISO 27001 then only needs the information-security-specific parts added — risk assessment, the Statement of Applicability, security controls — which can cut the workload by roughly 30-40%.

Preparing to apply for ISO 27001 certification?

We assess where you stand today and map out a practical path to ISMS certification

📞 Free Consultation