Data breaches lead to financial losses and serious damage to reputation. ISO 27001 offers an effective way to manage information security risk, so your organisation’s information and reputation are appropriately protected.
years testing for government and enterprise
CREST-accredited through CREST ANZ
dotSec is ISO 27001 certified, a PCI DSS-compliant service provider, and Australian owned and staffed.
We build information security management systems that reduce the likelihood and impact of compromise, not check-the-box exercises. Fixed and capped pricing is available.
ISO/IEC 27001:2022 is the internationally recognised standard for establishing, implementing and maintaining an information security management system (ISMS). It defines the frameworks, processes and organisational structures needed to manage information security risk, and suits organisations of all sizes and industries.
A defining feature is continual improvement, as opposed to a set-and-forget approach that relies on must-have security products.
financial information
intellectual property
employee details
information entrusted to you by third parties
We have more than 25 years of experience delivering practical security advice for government, APRA-regulated entities, financial institutions, utilities and national retailers, and we focus on ISO 27001 compliance that builds an ISMS which reduces the likelihood and impact of compromise.
We achieved ISO/IEC 27001:2022 certification in 2024 and have since completed our first surveillance audit. Our journey to certification meant allocating key roles and responsibilities, building a risk identification and treatment plan, setting security objectives and implementing controls for the risks we found.
Having managed our own certification project from start to finish, we know first-hand that timely, affordable certification depends on leadership, project resourcing, documentation, ongoing monitoring and continual improvement. Our advice to clients comes from that experience.
The consequences of data breaches can be severe. ISO 27001 benefits your business in four ways that go beyond compliance.
A single data breach can cost far more than implementing ISO 27001: investigation, containment, privacy fines, legal fees, higher insurance premiums and lost customers. ISO 27001 finds weaknesses before they become incidents, removes redundant processes and makes costs more predictable.
Certification shows customers, partners and procurement teams independently verified security. Many organisations require it of suppliers, so it opens opportunities and reduces friction in tenders, and it supports retention because clients know their data is handled to an international standard.
An ISMS defines clear roles, responsibilities and decision-making, so security does not depend on individual knowledge or ad hoc practice. Monitoring, internal audits, management reviews and continual improvement mean risks are revisited regularly, with better visibility for executives.
Privacy legislation, financial regulation and supplier due diligence all expect consistent controls and documentation. ISO 27001 produces those artefacts, so audits, customer questionnaires and regulatory reviews become easier, and one baseline can satisfy several frameworks at once.
Cost depends on three things: two you can budget for easily, and one that is harder.
We quote fixed-fee for well-scoped work, or capped time and materials when scope is genuinely uncertain, so you always know your upper bound. We do not run open-ended implementation retainers; surveillance support after certification is usually a small monthly retainer or a fixed annual block. If we can reduce your scope, and with it your audit fee, we will.
Paid to your certification body (such as BSI, Intertek SAI Global or NCS International). It scales with staff numbers, sites in scope and the breadth of the ISMS, and is usually the smaller cost.
Paid to whoever helps you build the ISMS, and the larger cost for most first-time certifications. An organisation with a working risk register, documented policies and a security-aware culture needs far less help than one starting from a clean sheet.
If your gap analysis finds controls you do not meet (and it will), the cost depends on which controls and how far off they are. A missing access review is cheap to fix; re-architecting how you handle production data is not. Our first job is usually to forecast this before you commit.
Implementation follows the same six phases across most engagements, mapped to the Plan-Do-Check-Act cycle. From scope to the Stage 2 audit usually takes 3 to 9 months for Australian organisations, depending on starting maturity, resourcing, and how many phases your team can carry internally.
Define the ISMS boundary: the products, services, sites and information assets in scope, and what is out. Identify interested parties and their obligations. Scope is the highest-leverage decision in the whole process.
Identify assets, threats and vulnerabilities, and score the risks. Treat, transfer, avoid or accept each one. The output is a Risk Treatment Plan.
Document which of the 93 Annex A controls apply, which do not, and why. It is the most-scrutinised document at Stage 1; justify every exclusion and you save weeks of back-and-forth.
Roll out the policies, procedures, controls and evidence collection. This is the longest phase, where organisations strong on paper slip on doing the work consistently, and where help pays back most.
Audit yourself before the certification body does, remediate and re-test, then hold a management review of ISMS performance. Both are checked (clauses 9.2 and 9.3).
Stage 1 reviews documentation; Stage 2 tests whether you do what you say you do. Pass both for a three-year certificate, with annual surveillance audits.
ISO 27001 sits alongside several frameworks Australian organisations often need to satisfy. They overlap, but they are not interchangeable.
A prescriptive technical baseline: which eight mitigations to implement, and to what maturity level. ISO 27001 tells you how to run security, not which controls to use. The Essential Eight is mandatory for non-corporate Commonwealth entities and common in government-aligned procurement; ISO 27001 is often required by enterprise customers.
Mandatory for APRA-regulated entities such as banks, insurers and super funds. It shares much of ISO 27001’s DNA: risk-based security, board accountability, third-party assurance and incident notification. ISO 27001 alone does not make you CPS 234 compliant (APRA notification, for example), but it gives you most of the evidence base.
Required by the card schemes, through acquiring banks, for anyone who stores, processes or transmits cardholder data. PCI DSS prescribes controls and evidence; ISO 27001 covers all information assets and asks you to choose controls proportionate to risk. The overlap is substantial: access control, logging, vulnerability management, incident response and segmentation.
Many clients need more than one. We deliver ISO 27001 with the Essential Eight, CPS 234 or PCI DSS as a single engagement, which avoids duplicating evidence collection and control testing.
Our recommendations come from implementing and maintaining an ISMS ourselves.
We have walked the compliance walk, so we know what it takes to implement and maintain a compliant ISMS.
Our team holds certifications including PCI DSS QSA, ISO 27001, CISA and CISM.
Recommendations are grounded in our implementation and compliance experience, and we have helped clients recover from inappropriate controls and impractical advice.
ISO/IEC 27001:2022 is the international standard for an information security management system. Compliance means you have established, documented and operate an ISMS that meets clauses 4 to 10, and have selected, justified and implemented Annex A controls. In simple terms: you identify your risks, decide which to fix, and prove the controls work over time.
Australia adopts ISO/IEC 27001:2022 unchanged; there is no Australian variant. Certification is issued by JAS-ANZ-accredited certification bodies and is recognised globally. For APRA-regulated entities, ISO 27001 supports CPS 234 readiness but does not replace it.
There are two main parts: consulting and the certification audit, plus any remediation. We quote fixed-fee or capped time and materials, so you know your upper bound. Typical dotSec engagements start from A$15K, and first-time certifications sit higher in the range. We give a fixed quote after a no-cost scoping conversation.
No. The 2022 revision is current. It reorganised Annex A into 93 controls under four themes (organisational, people, physical and technological) and added controls including threat intelligence, cloud services, secure coding, data masking and ICT readiness for business continuity. The 2013 version can no longer be certified; the transition ended on 31 October 2025.
Compliance is the state; certification is independent confirmation of it, by a JAS-ANZ-accredited certification body whose auditor has tested your ISMS against the standard. Many customers, agencies and procurement teams require certification, not self-attested compliance, before doing business.
Yes, and some organisations do, particularly those with an in-house GRC team and prior compliance experience. External help pays back most for first-time certification and for internal audit when your team is too close to operations. We will tell you honestly whether you need us, partial help or just an internal-audit review.
If you want help with ISO 27001 implementation or assessment, our ISMS specialists can guide you through the whole process and reduce scope and audit costs wherever possible.
Lower costs for you mean a longer working relationship for us, which is the kind of work we want.
