Author name: ankittripathidigi@gmail.com

Information Security Guide How to Obtain ISO 27001 Certification in India Understand the ISO 27001 certification process, key requirements, estimated costs, and preparation steps to help your organisation strengthen information security and manage sensitive business data. ✓ Certification Process ✓ Key Requirements ✓ Cost Factors Explore Certification Support → Read the Guide ↓ Risk Management ISO 27001 Information Security Management System PROTECT · MANAGE · IMPROVE Data Protection Information Security What Is ISO 27001 Certification? ISO/IEC 27001 is an international standard that sets out the requirements for creating, implementing, maintaining, and continually improving an Information Security Management System (ISMS). In simple terms, an ISMS is a structured system that allows a business to protect its important information through policies, procedures, and security controls. How Does It Work in Practice? For example, a SaaS company may create clear rules for employee access, customer data protection, data backup, and incident response. ISO 27001 is not only focused on IT security. It also covers people, business processes, documentation, and risk management. ✓ Risk Management ISO/IEC 27001 Information Security Management System (ISMS) ✓ Data Protection 01 Information Security Policies 02 Security Controls 03 Risk Management 04 Continual Improvement Business Benefits Why Is ISO 27001 Certification Important? ISO 27001 helps businesses manage information security in an organized and structured way, supporting better protection, risk awareness, and confidence in business relationships. 01 Data Protection Use appropriate security controls to help protect sensitive business information, customer records, and other important data. 02 Customer Trust Demonstrate a clear and structured approach to information security and help customers understand how security risks are managed. 03 Risk Management Identify information security threats, assess their potential impact, and plan suitable actions to address risks systematically. 04 Business Opportunities Some clients, procurement processes, and tenders require ISO 27001 certification as part of their supplier or partner requirements. 05 Better Processes Define security responsibilities, document procedures, and establish more consistent ways of handling information securely. 06 Continual Improvement Regular reviews and monitoring help organisations evaluate their information security arrangements and improve them over time. ! Important to Understand ISO 27001 certification does not eliminate every security risk. Instead, it provides a systematic framework for identifying, assessing, treating, and monitoring information security risks. Standard Updates & Requirements What’s New in ISO 27001:2022? ISO/IEC 27001:2022 replaced the 2013 edition. The update reorganizes information security controls and addresses the changing risks organisations face when protecting information. ↗ ISO/IEC 27001:2022 — Key Changes The updated edition introduces a revised Annex A control structure, including four control themes and 11 new controls. Organisations should determine which controls are appropriate for their information security risks. 01 Annex A Controls: From 114 to 93 Annex A Control Changes 114 2013 Edition → 93 2022 Edition The 2022 edition reorganises the controls. A lower number of controls does not mean that security requirements have been reduced. Some controls were merged, updated, or reorganised. ▦ Organizational Controls Security governance, policies, responsibilities, and processes. ♙ People Controls Security responsibilities and controls related to people. ▣ Physical Controls Protection of facilities, equipment, and physical information assets. ⌘ Technological Controls Technical measures that help protect systems, networks, and data. ! Important: The reduction from 114 to 93 controls is mainly a restructuring of Annex A. Organisations still need to assess risks and select the controls required for their ISMS. 02 11 New Annex A Controls ISO 27001:2022 adds 11 controls covering areas such as threat intelligence, cloud security, data protection, and secure development. Examples include: ⌕ Threat Awareness Threat Intelligence Gather and analyse information about information security threats. ☁ Cloud Security Information Security for Use of Cloud Services Define security practices for acquiring, using, managing, and exiting cloud services. ▤ Data Protection Data Masking Mask sensitive data where appropriate to reduce unnecessary exposure. ⇥ Data Protection Data Leakage Prevention Apply measures to help prevent unauthorised disclosure or transfer of information. ◎ Online Security Web Filtering Manage access to external websites to help reduce online security risks. ⌘ Development Secure Coding Integrate security practices into software development and coding activities. ✓ Organisations should assess risks and document their control choices in the Statement of Applicability (SoA). Not every Annex A control automatically applies to every organisation. 03 2024 Climate Action Amendment ♻ Considering Climate Change in the ISMS Context The 2024 amendment asks organisations to determine whether climate change is a relevant issue in their organisational context. They must also consider whether interested parties have climate-related requirements. This does not automatically mean every organisation must introduce climate-specific information security controls. 04 ISO 27001:2022 Requirements To pursue certification, an organisation must establish, implement, maintain, and continually improve an effective Information Security Management System (ISMS). Key requirements include: 01 Define the ISMS Scope Decide which departments, locations, systems, services, and business activities will be included within the ISMS scope. 02 Conduct Risk Assessment Identify risks to important information, evaluate their likelihood and impact, and determine how those risks will be managed. 03 Prepare Policies and Documentation Maintain an information security policy, risk assessment records, a risk treatment plan, and the documented information required for the ISMS. 04 Implement Security Controls Select and apply appropriate controls based on risk assessment. Record the applicable controls, their inclusion or exclusion, and the reasons in the Statement of Applicability. Statement of Applicability (SoA) 05 Conduct Internal Audit and Management Review Evaluate whether the ISMS conforms to the standard and operates effectively. Address identified gaps and complete management reviews as part of continual improvement. Build a Structured Information Security Management System Understanding the updated controls and ISMS requirements helps your organisation prepare for the ISO 27001 certification process and maintain a risk-based approach to information security. Certification Roadmap ISO 27001 Certification Process: Step by Step Follow these six key steps to prepare your Information Security Management System (ISMS), address security gaps, and proceed towards an external ISO 27001 certification audit. Step 01 Assess Current State Gap Analysis Review your current information security practices against the standard’s requirements. Identify existing gaps, areas that

OCCUPATIONAL HEALTH & SAFETY ISO 45001 Certification in India How to Build a Safer Workplace Create a safer work environment, identify workplace hazards and manage occupational health and safety risks with an effective ISO 45001 management system. Explore ISO 45001 ↗ Talk to Our Team → ✓ Hazard Prevention ✓ Risk Management ✓ Worker Safety SAFETY FIRST. ALWAYS. ✓ Building Safer Workplaces A proactive approach to workplace safety ✚ ISO 45001 Occupational Safety ● ✓ Protect Your People Make safety a priority PANCHAL GROUP TRUST · QUALITY · GROWTH Occupational Health & Safety What Is ISO 45001 Certification? ISO 45001 is an international standard for an Occupational Health and Safety Management System (OH&S MS). It helps organisations prevent work-related injuries and ill health while improving workplace safety performance. The standard is ISO 45001:2018, with Amendment 1:2024 adding climate-change considerations. It provides a flexible framework that organisations can adapt to their size, activities and risks. ✓ Leadership and worker participation ✓ Hazard identification and risk assessment ✓ Operational controls and emergency readiness ✓ Performance monitoring and improvement SAFETY MANAGEMENT 2018 + Amd 1:2024 Workplace Safety. Better Managed. A structured approach to identifying hazards, managing risks and continually improving occupational health and safety. Risk Prevention Continual Improvement Want to Learn More About ISO 45001? Explore your organisation’s occupational health and safety management and compliance needs with Panchal Group. Visit Panchal Group ISO 45001 • BUSINESS BENEFITS Why Is ISO 45001 Important for Businesses? Using ISO 45001 can help companies shift from reacting to safety problems to planning risk prevention. It provides a structured approach to protecting workers, managing workplace risks and improving safety practices. 01 Identify Hazards Before Accidents Occur Companies can systematically spot hazards and act to prevent them. For example, a factory might identify machinery hazards, electrical dangers or unsafe material handling and introduce appropriate controls. Proactive Prevention 02 Improve Risk Management A clear risk-assessment process helps companies rank risks according to their potential impact and decide which preventive measures to implement first. Better Risk Control 03 Strengthen Employee Safety Awareness Clear safety rules, regular training and worker participation help employees understand their responsibilities and report unsafe conditions before they lead to incidents. Safety Culture 04 Support Legal and Regulatory Compliance ISO 45001 helps companies identify applicable health and safety laws and establish processes to monitor their obligations. Certification alone does not guarantee legal compliance. Compliance Management 05 Improve Business Credibility A certified management system can demonstrate a company’s commitment to occupational health and safety. This may help when customers, contractors or business partners assess suppliers. Business Confidence 06 Support Operational Continuity Identifying hazards and preparing for emergencies can help companies reduce avoidable disruptions and respond to safety incidents in a more organised and consistent way. Business Resilience ✓ Make Workplace Safety a Business Priority A systematic approach to occupational health and safety helps organisations protect their people and improve how workplace risks are managed. Contact Panchal Group ↗ INDUSTRIES • ISO 45001 Who Needs ISO 45001 Certification in India? ISO 45001 can help companies of all sizes across many industries manage occupational health and safety risks. From manufacturing plants to offices, every workplace can benefit from a systematic approach to employee safety. 01 Manufacturing & Industrial Units Control workplace risks associated with machinery, electricity, chemicals and production processes. ISO 45001 helps establish safety controls and consistent operating procedures. Machinery Production Safety 02 Construction Companies Manage hazards involving work at heights, heavy equipment, site movement and contractors. A structured safety system supports safer project planning and site operations. Site Safety Height Work 03 Warehousing & Logistics Improve safety in material handling, loading, unloading, vehicle movement and storage operations. Clear procedures can help reduce workplace hazards across warehouses and distribution centres. Material Handling Vehicle Safety 04 Healthcare Organisations Address occupational risks related to staff, medical equipment, hazardous materials and emergencies. A planned safety approach supports healthcare workers in their daily responsibilities. Staff Safety Emergency Planning 05 Engineering & Infrastructure Establish consistent safety rules across engineering projects, infrastructure developments and multiple work sites. Risk assessment and operational controls help teams work more safely. Project Safety Site Management 06 Service & Office Businesses Manage risks involving ergonomics, electrical safety, emergency exits and workplace conditions. Even office-based organisations can benefit from identifying and controlling occupational risks. Office Safety Ergonomics ✓ Suitable for Small, Medium & Large Businesses ISO 45001 is not restricted to large organisations. Small and medium-sized businesses can also implement a health and safety management system suited to their operations, workforce and workplace risks. Talk to Panchal Group ↗ Occupational Health & Safety ISO 45001 Requirements Explained The main requirements of ISO 45001 are covered in Clauses 4 to 10. Understanding these clauses helps organisations prepare for implementation, improve workplace safety and work towards certification. Clause 04 Context of the Organization Identify internal and external issues, understand interested parties and define the scope of the occupational health and safety management system. Practical Example A construction company considers its job sites, subcontractors, site conditions and workers when defining the scope of its safety system. Clause 05 Leadership & Worker Participation Top management demonstrates commitment to workplace safety, assigns responsibilities and supports worker consultation and participation. Practical Example Employees have clear ways to report hazards and participate in workplace safety discussions. Clause 06 Planning Identify hazards, assess OH&S risks and opportunities, determine applicable requirements and set workplace safety objectives. Practical Example A warehouse assesses forklift movement, falling goods, manual lifting and pedestrian traffic risks. Clause 07 Support Provide the resources, competence, awareness, communication and documented information needed to support the safety system. Practical Example Workers operating machinery receive appropriate training and their competence is verified and documented. Clause 08 Operation Plan and control daily operations, apply risk controls and prepare for potential emergencies. Practical Example A factory establishes machine operating procedures, maintenance checks and emergency evacuation plans. Clause 09 Performance Evaluation Monitor safety performance, evaluate compliance, conduct internal audits and carry out management reviews. Practical Example Management reviews incident reports, training completion, inspection