Scope and risk assessment
Define context, stakeholders, service boundaries and risk treatment decisions.
Security & cloud
Manage information security risks through an auditable system
ISO/IEC 27001 specifies information security management system requirements. Assess scoped risks, implement necessary controls and explain decisions through the Statement of Applicability, internal audits and management reviews.
Source record updated:
Discuss your certification →Scope and applicability
Information security management system certification
Usually voluntary, certification may be required by customers, tenders or supply chains. ISO does not issue certificates; check the certification body's accreditation and customer acceptance.
Korean certification schemes and international standards are different. A translated guide does not extend a Korean certificate to other countries. Confirm the target market, product classification and current requirements with the relevant body.
Who this is for
- SaaS vendors serving international enterprises
- Organizations standardizing security operations
- Teams scoping multiple sites and services
Documents to prepare
Statement of Applicability (SoA)
Explain controls, inclusion and exclusion rationale and implementation status.
Internal audit and management review
Retain evidence of performance, corrective actions and leadership review.
Preparation process
Choose scope and certification body
Confirm personnel, sites, activities and required accreditation.
Operate risk-based controls
Implement policies and technical controls and conduct audits and improvements.
Complete stage 1 and stage 2
Demonstrate readiness and operation, close findings and arrange surveillance.
Timing
Timing depends on readiness, scope and audit availability. Plan continuing operation, surveillance and renewal as well as initial certification.
Agency fees
Institutional testing and assessment fees
Quotation based on the agreed scope
Confirm scope, assessor days, retesting, travel and VAT in the final quotation. Institutional fees are separate from Specify subscription charges.
Sources and references ↗Document automation and management cost KRW 300,000 per month. Expert services and certification body testing or assessment fees are separate. Specify supports preparation; the relevant authority or certification body makes the final decision.
Pricing and certification costs →Optional expert consulting
Expert review and consulting are optional, separately scoped services. Choose support for ISO/IEC 27001 based on your team's readiness and the evidence or assessment preparation you need.
- Confirm institutional testing, assessment and registration fees separately in the contract.
- Development fixes, clinical studies where applicable, security equipment and infrastructure operations may require separate budgets.
- Confirm internal staffing, travel, translation, VAT, surveillance and renewal costs in the quotation.
Questions and answers
Must every Annex A control be applied?
Determine necessary controls through risk assessment and compare against reference controls to explain omissions and applicability.
Does this replace Korean ISMS obligations?
No automatic substitution applies; Korean statutory requirements are assessed under the Korean scheme.
Why do quotations differ?
Advisory work, full implementation and audit-inclusive packages differ. Compare staffing, sites, services, travel and surveillance consistently.