ISO/IEC 27001 certification in Australia: JASANZ, the Essential Eight, SOCI and CPS 234

Why Australian organisations pursue ISO/IEC 27001 certification

Three pressures drive most Australian projects. The first is commercial: enterprise and overseas customers send security questionnaires, and a current certificate answers much of them at once. The second is regulatory, and it comes from laws and prudential standards that do not require the certificate but expect the managed, risk-based security it demonstrates. The third is government supply, where agencies use Australian frameworks of their own.

That regulatory layer is what makes an Australian ISMS different. The Essential Eight, the Security of Critical Infrastructure Act 2018, APRA CPS 234 and the Privacy Act 1988 each shape what your risk assessment has to consider and which controls an Australian buyer or regulator will look at first. The standard itself is explained on the requirements guide.

JASANZ accreditation and checking a certificate in Australia

JASANZ does not certify organisations. In its own words, it accredits the organisations that do, and it names ISO/IEC 27001:2022 among the management system schemes it covers. A certification body working in Australia may instead hold accreditation from another national body; what matters to your customer is that the accreditation body is internationally recognised, since 1 January 2026 through the Global ACI arrangement, and that the certificate's scope covers the services, sites and cloud platforms you actually supply. Confirm the current recognition status of JASANZ, or of whichever body stands behind your certificate, on that body's site and on the Global ACI list before relying on it.

To check an Australian certificate, JASANZ provides a register of certified organisations linked from its "Check a certificate" page. Search it, then the issuing body's own register. The verification guide covers the full check.

Local practice that changes the project

Essential Eight beside Annex A

Many Australian buyers ask about the Essential Eight in the same questionnaire as ISO/IEC 27001. The two work differently: the Essential Eight is eight mitigation strategies assessed against ASD's maturity model, while ISO/IEC 27001 requires you to select controls from your own risk assessment. Build the Essential Eight strategies into the risk treatment plan and map them in the Statement of Applicability, and one set of evidence serves both.

Critical infrastructure and SOCI

Responsible entities for critical infrastructure assets must keep a written risk management programme covering material risks from hazards, including cyber and information security hazards, and give an annual report approved by the board or governing body. The rules let an entity meet the cyber hazard requirement by complying with AS ISO/IEC 27001 or one of four other named frameworks. Scope the ISMS around the critical assets so the same risk register feeds the programme.

APRA-regulated entities

Banks, insurers and superannuation trustees answer to CPS 234: board accountability, controls over third-party information assets, systematic testing and notification to APRA within 72 hours of a material incident. Design the incident procedure and supplier controls to those terms from the start, rather than retrofitting them after certification.

Privacy Act and notifiable data breaches

Organisations and agencies covered by the Privacy Act 1988 must notify affected individuals and the Office of the Australian Information Commissioner of a data breach likely to result in serious harm. Your incident management controls should include the assessment and notification steps, with records that show when and how each decision was made.

Government cloud and IRAP

For cloud services sold to government, ASD endorses IRAP assessors to assess ICT systems and cloud services. A certified ISMS gives the assessor governance, risk records and operating controls to sample, but the IRAP assessment remains a separate engagement.

Local items to check, and where

How Sterling works in Australia

Sterling supports Australian clients from its Sydney office, on site and remotely, drawing on an international practice of 8,100+ client engagements in 60+ countries since 2003. Sterling does not certify: an independent, accredited certification body audits you and decides, and we help you choose one whose accreditation your customers and regulators accept.

ISO/IEC 27001 certification in Australia: questions buyers ask