ISO 27001 certification in India: NABCB accreditation, CERT-In duties, the DPDP Act and local practice

Why Indian organisations pursue ISO/IEC 27001

For most Indian companies the certificate is asked for from abroad. An IT services or BPO provider in Pune, Bengaluru or Navi Mumbai finds ISO/IEC 27001 on the vendor security questionnaire of a US or European client, often next to a request for a SOC 2 report. A global capability centre is asked to show its parent that the Indian centre runs security under the same governance as the group, and the parent's auditors want an accredited certificate rather than a policy pack.

Domestic demand comes from regulated customers. Banks, NBFCs and SEBI-regulated entities work under their own cyber frameworks and pass security terms down to their technology vendors, who then find a certificate is the fastest way through due diligence. Those frameworks are summarised on the RBI and SEBI cybersecurity frameworks page. A certificate does not make anyone compliant with them, but it answers the questions they generate.

What the standard requires is in the requirements guide.

The local landscape: NABCB, STQC and checking a certificate

The National Accreditation Board for Certification Bodies (NABCB) was set up by the Ministry of Commerce and Industry as a constituent board of the Quality Council of India. It accredits management system certification bodies to ISO/IEC 17021-1, and it lists information security management systems to ISO/IEC 27001 among its schemes, with ISO/IEC 27006 as the additional requirement for ISMS bodies. NABCB states that it is a member of IAF, ILAC and APAC and a signatory to their arrangements. Confirm NABCB's current recognition, or that of whichever accreditation body stands behind your certificate, on that body's own site and on the Global ACI list before you rely on it.

A certification body working in India does not have to be accredited by NABCB. Many operate under overseas accreditation bodies, which most clients accept if the accreditation is internationally recognised and the scope covers ISMS. Among Indian bodies, the Standardisation Testing and Quality Certification (STQC) Directorate lists ISO 27001 ISMS certification among its certification services. If a government customer names STQC, ask it to confirm the accreditation behind its ISMS certificates.

To check a certificate, use NABCB's directory of accredited bodies, IAF CertSearch and the issuing body's own register. The verification guide covers the full check.

Local practice that changes the project

CERT-In incident reporting and logs

The CERT-In directions issued under section 70B(6) of the Information Technology Act, 2000 set three things an Indian ISMS must show working: reporting of the listed incident types to CERT-In within 6 hours of noticing them, ICT system logs kept securely for a rolling 180 days within Indian jurisdiction, and clocks synchronised to the NTP servers of NIC or NPL, or servers traceable to them. Auditors sample the incident procedure, the log retention settings and the time source.

DPDP Act and personal data

Where the ISMS holds personal data of people in India, the Act's duties to keep reasonable security safeguards and to notify breaches to the Data Protection Board and affected individuals sit in your register of legal requirements. The DPDP Act page covers the obligations and their commencement dates.

GCC and client-dedicated delivery

GCCs run under group policies; IT services firms run client-dedicated centres on client networks. The scope must say which controls the Indian entity operates and which the parent or client operates, or the audit stalls on who owns access reviews.

Multi-city delivery

Delivery centres in several cities are common. Bodies sample sites, so every location must follow the same controls. Agree the site list early.

How Sterling works in India

Sterling runs Indian engagements from its Navi Mumbai office, with consultants on site in Mumbai and other cities and working remotely where that suits the client. The team draws on an international practice of 8,100+ client engagements in 60+ countries since 2003. Sterling does not certify: an independent, accredited certification body audits you and decides, and we help you choose one whose accreditation your clients accept.

ISO/IEC 27001 in India: questions buyers ask