ISO/IEC 27001 is the certificate clients ask for when they hand you their data. We build an information security management system around the risks you actually carry, take it through internal audit and management review, and prepare you for an accredited certification body.
ISO 27001 certification in the UAE and Dubai with ESGweise: gap analysis, information security risk assessment and treatment, Statement of Applicability, implementation of the Annex A controls you select, internal audit, management review and Stage 1 and Stage 2 audit support. Systems are built to ISO/IEC 27001:2022 with its 2024 climate action amendment. ESGweise is not a certification body.
What is ISO 27001 certification?
ISO 27001 certification is an accredited body's confirmation that your information security management system meets ISO/IEC 27001:2022, the current edition of the standard.
The standard sets the requirements for managing information security as a system: deciding what to protect, assessing the risks to its confidentiality, integrity and availability, and treating those risks with controls that are owned, operated and checked.
ISO and IEC published the third edition in October 2022. Its Annex A lists 93 controls in four themes: organisational, people, physical and technological. Amendment 1 of 2024 adds climate action: the organisation determines whether climate change is a relevant issue for its system, and interested parties can hold climate-related requirements. The standard shares its clause structure with ISO 9001, ISO 14001 and ISO 22301, so organisations certifying to more than one can run them as a single integrated system.
Who needs ISO 27001 in the UAE and GCC?
Any organisation whose clients, tenders or regulators ask for proof that information is managed securely; no UAE law mandates the certificate itself.
- Technology, cloud and managed service providers that host, process or support client systems and data.
- Outsourcing and shared service providers working for banks, insurers and other regulated firms, which pass their own obligations down the supply chain.
- Suppliers to government entities, where information security certification appears in prequalification and tender criteria.
- Organisations handling sensitive personal or commercial data that want one recognised answer to repeated security questionnaires.
The 2013 edition is finished. The transition period under IAF MD 26 ended on 31 October 2025, ISO has withdrawn ISO/IEC 27001:2013, and every certification now is to the 2022 edition.
How do you get ISO 27001 certified?
In six steps over six to twelve months: scope and gap analysis, risk assessment, the Statement of Applicability and controls, a period of operation, internal audit and management review, then the certification audit.
Scope and gap analysis
The boundary of the system set to match what clients actually buy from you, where you stand against every clause, and a fixed quote for the rest including expected certification body fees.
Risk assessment and treatment
Information assets, threats and vulnerabilities assessed against criteria your management sets, with a treatment plan and named risk owners who accept the residual risk.
Statement of Applicability and controls
All 93 Annex A controls compared with the treatment plan, each one included or excluded with a reason, and the chosen controls put in place across policy, people, premises and technology.
Run it and build the records
Awareness training, access reviews, supplier checks, incident handling and change control operating long enough to produce the evidence an auditor will sample.
Internal audit and management review
An impartial internal audit of the clauses and the applicable controls, and a management review on real data, both required before Stage 2.
Certification audit
Help choosing an accredited certification body, then support through Stage 1 and Stage 2 and the closure of any findings.
How much does ISO 27001 certification cost in the UAE?
Certification body fees typically run from AED 10,000 to AED 20,000 for initial certification and AED 7,000 to AED 15,000 for recertification; our own work is quoted as a fixed scope after a short call.
- Certification body, initial certification: typically AED 10,000 to AED 20,000
- Surveillance audits: smaller annual audits in years two and three
- Recertification: typically AED 7,000 to AED 15,000 every third year
- ESGweise: quoted as a fixed scope after a short call. Contact us for a quote.
How long does ISO 27001 certification take?
Six to twelve months, because the certification body needs evidence that the controls have been operating, not only written.
Policies can be drafted in weeks. Access reviews, supplier assessments, backup tests and incident records only exist once the system has run for a period, and Stage 2 samples them.
Who certifies you, and what does ESGweise do?
ESGweise prepares you; an accredited certification body, operating under ISO/IEC 17021-1, audits the system and issues the certificate.
Consultancy and certification are kept apart by the accreditation rules, and that separation is what gives the certificate its value. We have no commercial tie to any certification body, so we can help you compare them on accreditation, scope and fees across the full three-year cycle. See ISO certification in the UAE for how the audits run and ISO implementation for how the system is built.
Once you are certified, ISO certification maintenance keeps the system running between audits, and internal audit is available on its own. Running your own audit before Stage 2? Use our free ISO 27001 internal audit checklist, with every clause and all 93 Annex A controls.
ISO 27001 Certification: questions we hear most
Is ISO 27001 mandatory in the UAE?
Not as a general legal requirement. No UAE law requires a private organisation to hold an ISO/IEC 27001 certificate. It becomes a requirement through contracts: banks, government entities and large buyers ask for it in tenders and vendor due diligence, particularly from technology, cloud, outsourcing and managed service providers. Sector regulators set their own information security rules, and a certified information security management system is strong evidence against them, but it does not replace them.
What is the difference between ISO 27001 implementation and certification?
Implementation is building and running the information security management system: the scope, the risk assessment and treatment, the Statement of Applicability, policies, controls, internal audit and management review. Your organisation does it, often with a consultant. Certification is the independent two-stage audit of that system by an accredited certification body, which issues a certificate valid for three years and kept through annual surveillance audits. Under ISO/IEC 17021-1 the two stay separate. ESGweise implements and prepares; an accredited body certifies.
How much does ISO 27001 certification cost in the UAE?
There are two parts. Certification body fees typically run from AED 10,000 to AED 20,000 for initial certification, with smaller surveillance audits in years two and three and recertification at AED 7,000 to AED 15,000. Headcount, number of sites and the risk of what you do decide where you sit in each range. The second part is building the system. ESGweise quotes that as a fixed scope after a short call, with the expected certification body fees shown alongside, so the total is known before work starts. Contact us for a quote.
How long does ISO 27001 certification take?
Six to twelve months from a standing start. Writing policies is the quick part. The certification body needs to see the controls in your Statement of Applicability operating, with records, plus a completed internal audit and a management review, before Stage 2 can succeed. A narrow scope with mature IT controls sits at the shorter end; a broad scope across several sites and outsourced services sits at the longer end.
Can we still certify to ISO/IEC 27001:2013?
No. ISO/IEC 27001:2022 is the current edition, published in October 2022, and ISO has withdrawn the 2013 edition. The transition period set by IAF MD 26 ended on 31 October 2025, and certificates to the 2013 edition expired or were withdrawn at that point. Every certification now is to the 2022 edition, read together with its 2024 climate action amendment, and an organisation whose 2013 certificate lapsed certifies again to the 2022 edition.
Do we have to apply all 93 Annex A controls?
No. Annex A of the 2022 edition lists 93 controls in four themes: organisational, people, physical and technological. You compare your risk treatment against all of them and record in the Statement of Applicability which controls apply, which do not and why, and whether each is implemented. Excluding a control is acceptable when the justification holds. The auditor tests that justification, so it has to come from the risk assessment, not from convenience.
What is the difference between ISO 27001 and SOC 2?
ISO/IEC 27001 certifies a management system: an accredited certification body confirms that you assess information security risks, choose controls against them and keep the system improving, and issues a certificate. SOC 2 is an attestation report by a licensed CPA firm under AICPA standards, describing your controls against the Trust Services Criteria at a point in time (Type 1) or over a period (Type 2). Which you need depends on what your customers ask for. The risk assessment and controls built for ISO 27001 cover much of the ground a SOC 2 examination tests.
Tell us the scope: people, sites and systems.
Headcount, locations, cloud services in use and any customer asking for the certificate. We set the scope, the Statement of Applicability work and a fixed fee.