What is it
The world's leading standard for information security management systems (ISMS). It confirms that the company systematically protects data — its own and that of customers and partners. Critical for IT companies, banks and everyone working with sensitive information.
Who needs ISO/IEC 27001:2022
- IT companies and software developers working with foreign customers
- Banks, payment systems, fintech
- Companies processing personal data
- Telecom operators and data centres
- Companies whose customers require an ISMS certificate
What your company gets
- Trust of foreign customers — often a mandatory contract requirement
- Systematic management of data leak and cyberattack risks
- Compliance with data protection requirements
- Competitive advantage in IT exports
- Clear incident response procedures
How implementation works
Timeline — from 25 days to 3 months, depending on your company's current readiness. We set the exact timeline after the Gap analysis.
Gap analysis
We assess the current state and deliver a nonconformity map and work plan
Documentation
We develop the required documentation tailored to your practice
Implementation
We train staff, launch processes and conduct an internal audit
Audit
We support the certification audit until you receive the certificate
ISO 27001 in Uzbekistan: a closer look at information security certification
ISO 27001 in Uzbekistan is becoming a mandatory attribute of IT exports: foreign customers from Europe, the US and the Gulf states increasingly include an ISMS certificate among the mandatory requirements of a contract. Information security certification confirms that a company manages risks systematically — from personal data leaks to targeted cyberattacks. For banks, fintech, telecom operators and software developers this is no longer an advantage but a condition for entering serious deals.
How an information security management system is built
ISO/IEC 27001:2022 is built around risk management. The company identifies information assets (data, systems, equipment, people, reputation), assesses threats and vulnerabilities for each asset, and selects safeguards from Annex A of the standard — in the 2022 edition these are 93 controls grouped into four blocks: organisational, people, physical and technological. The key documents of the system: the ISMS policy, risk assessment methodology, the Statement of Applicability, the risk treatment plan, and procedures for incident management, access control, backup and business continuity.
Stages of ISO 27001 certification
Stage 1. Gap analysis. We assess the current maturity of your security processes: what assets exist, how they are protected, which procedures actually work and which exist only on paper. The result is a nonconformity map and a project plan.
Stage 2. Risk assessment and documentation. Together with your team we run the asset inventory and risk assessment, and develop policies and procedures around real practice — from password policy to remote access rules.
Stage 3. Implementation and training. We launch the controls and train staff — from general awareness of phishing and social engineering to specialised preparation of internal auditors. In ISO 27001, training people matters no less than technical tools: most incidents start with the human factor.
Stage 4. Internal audit and certification. We conduct the internal audit and management review, then support the two-stage audit of an accredited certification body until the certificate is issued.
How the 2022 version differs from 2013
If you hold a certificate against the 2013 version, it must be updated before the end of the transition period. Key changes in the 2022 edition: controls were regrouped from 114 in 14 clauses to 93 in 4 thematic blocks; new controls were added (threat intelligence, cloud services security, secure development, data masking); and there is stronger emphasis on change management and supply chains. We help both with a transition to the new version and with implementation from scratch.
ISO 27001 training: whom to train and in what
The standard explicitly requires personnel competence. Our projects include three levels of training: a general course for all employees (awareness, phishing, passwords, data handling), advanced preparation for the IT and security team (risks, controls, incident response), and an internal ISMS auditor course. Training is confirmed by records — auditors request them first.
Timeline and cost of ISO 27001 certification in Uzbekistan
The timeline is from 25 days to 3 months depending on company size and the current maturity of security processes. The cost depends on headcount, number of sites and the volume of information assets. An exact estimate follows the gap analysis — free of charge. For IT companies that already practise secure development, the project moves noticeably faster.
Why it is safer with us
We have been implementing management systems for over 15 years and understand the specifics of security projects: we do not turn the ISMS into bureaucracy, but build procedures that really work and do not hinder development. We write documents for your infrastructure, prepare the team to pass the audit without prompts, and stay in touch after certification — for surveillance audits and further development of the system.
What it costs
The cost depends on your company's scale — number of employees, sites and processes. Leave a request and within a day we will calculate the exact cost and timeline for your case. The estimate is free and non-binding.