ISO 27001 in Pakistan: a step-by-step path to certification

By the FarSec team · Updated 2026-11-12

Why Pakistani companies pursue it

• Winning clients: banks, telcos, multinationals and foreign buyers increasingly ask suppliers for ISO 27001, especially in IT, BPO, software export and fintech.
• Fewer questionnaires: a valid certificate answers most of a client's security questions in one document.
• Better security: done honestly, it forces you to know your risks, assign owners and test your controls.

The 2022 version in one paragraph

The current edition is ISO/IEC 27001:2022. Its Annex A lists 93 controls in four groups: organisational, people, physical and technological. New controls include threat intelligence, cloud services security, data masking, data leakage prevention, monitoring activities and secure coding. Certificates to the older 2013 edition had to move to 2022 by October 2025, so anything you start now should be on the 2022 version.

The 8 steps

1. Get management commitment. Certification fails without an owner at the top who gives time, budget and decisions.
2. Define the scope. Which offices, teams, systems and services are covered? A tight scope (for example "software development and hosting for clients") is faster to certify than "the whole group".
3. Gap assessment. Compare what you do today against the standard's clauses and Annex A. This tells you how much work is ahead.
4. Risk assessment and treatment. List your information assets, the threats to them, how likely and how harmful each risk is, and what you will do about it. This is the heart of the standard.
5. Statement of Applicability (SoA). For each of the 93 controls, say whether it applies, why, and how it is implemented. Auditors read this closely.
6. Implement controls and policies. Access control, MFA, backups, supplier security, incident response, secure development, HR onboarding and exit, physical security. Write only the policies you will really follow.
7. Run it, then check it. Train staff, keep records, run an internal audit and a management review. Auditors want evidence the system has been working, usually for at least a few months.
8. Certification audit. Stage 1 reviews your documents and readiness. Stage 2 tests whether you actually do what the documents say. Fix any non-conformities, and the certificate is issued for three years, with yearly surveillance audits.

Choosing a certification body

Check that the certification body is accredited for ISO 27001, for example by the Pakistan National Accreditation Council (PNAC) or another accreditation body that is a member of the International Accreditation Forum (IAF), such as UKAS. Your clients may verify this. A certificate from an unaccredited body, or one issued without a real audit, can hurt you more than having none.

Keep roles separate: the consultant who helps you implement should not be the body that certifies you.

Common mistakes that cause delays

• Copy-paste policies that nobody follows. Auditors interview staff and spot this quickly.
• Scope too wide for the first certificate.
• Risk assessment done once in a spreadsheet and never updated.
• No evidence: access reviews, backup restore tests and training that happened but were not recorded.
• Ignoring suppliers: cloud providers, outsourced IT and developers are part of your risk.
• Treating it as IT's job alone. HR, legal, admin and management all own parts of it.

ISO 27001 certification in Karachi, Lahore and Islamabad

Most searches for ISO 27001 in Pakistan come from Karachi, Lahore and Islamabad, where banks, fintechs, software exporters, telecom suppliers and hospitals face client and regulator questions about information security. The process is the same in every city: the certificate is issued by an accredited certification body after an on-site or partly remote audit, not by your consultant.

• Karachi: financial services, insurance, logistics and BPO firms, often asked for ISO 27001 by foreign clients or parent companies.
• Lahore: software houses and IT exporters, where ISO 27001 is a common requirement in international tenders and vendor security questionnaires.
• Islamabad / Rawalpindi: government suppliers, telecom vendors and technology firms, where security frameworks and audits are becoming part of contracts.

Readiness work (gap assessment, policies, risk register, internal audit) can be done almost fully online, so the city matters less than finding an accredited certification body that can send auditors to your site.

How much does ISO 27001 cost in Pakistan?

There is no single price, and a very cheap quote is often a warning sign. The total cost depends on:

• Scope and headcount: the number of people, sites and systems inside the scope. Certification bodies calculate audit days mainly from the number of staff in scope, so a tight, well-defined scope keeps audit days down.
• Certification body fees: Stage 1 and Stage 2 audits, then a surveillance audit in each of the next two years and a recertification audit in year three.
• Readiness effort: gap assessment, risk assessment, policies and procedures, staff awareness and an internal audit, done by your own team, a consultant, or both.
• Fixing real gaps: for example multi-factor authentication, backups, logging, endpoint protection or access reviews. These are often the biggest real cost, and also where most of the security value is.
• Staff time: someone has to own the system after the certificate, or the first surveillance audit becomes painful.

Ask every certification body for a written quote that shows audit days for Stage 1, Stage 2 and surveillance, and confirm they are accredited for ISO/IEC 27001:2022.

Frequently asked questions

How long does ISO 27001 take? For a small or mid-size company with reasonable IT basics, 3 to 6 months from gap assessment to Stage 2 audit is common. Large scopes or weak starting points take longer.

Is the 2013 version still valid? No. The transition period to ISO/IEC 27001:2022 ended on 31 October 2025, so new and renewed certificates should be against the 2022 version.

Can a small company get certified? Yes. ISO 27001 does not require a large team; it requires a working, documented system that fits your size. Smaller scopes are faster and cheaper to certify.

Do we need a penetration test for ISO 27001? It is not named as mandatory, but auditors expect technical vulnerabilities to be managed (Annex A 8.8). A recent vulnerability assessment or penetration test is a practical way to show this. See our VAPT guide.

Who can issue the certificate? Only a certification body. Check its accreditation (for example PNAC or another IAF-member accreditation body) before you sign.

How a security assessment helps

An external assessment early in the project gives you real evidence for the risk assessment, shows auditors that you test your controls, and finds technical gaps (weak remote access, missing patches, exposed services) before the auditor or an attacker does. Repeating it before Stage 2 shows the gaps were closed.