العربيةVerifyGet a Quote
For organisationsManagement System CertificationISO/IEC 17021-1
For claims and reportsValidation and VerificationISO/IEC 17029 · ISO 14065
For professionalsPersonnel CertificationISO/IEC 17024
For equipment and productsInspectionISO/IEC 17020
About
Industries
Trust Centre

Not sure where to start?

Compare the four services side by side

Help Me Choose
Verify a certificateGet a quote
Get a Quoteالعربية
Fibre-optic cables in a network patch panel
Information Security Management System Certification

ISO/IEC 27001:2022 Certification in the UAE

Accredited ISO/IEC 27001 certification that gives clients, partners and regulators confidence that information is protected through a risk-based, independently audited management system.

Request a QuotationAsk an Advisor
  • Accredited by EGAC
  • Quotation within one business day
  • Audits in Arabic or English
Member of Dubai SME
Certificate validity, with annual surveillance audits
3 years
Initial certification audit: Stage 1 and Stage 2
2 stages
Accreditation body, signatory to the IAF MLA
EGAC
From single-site businesses to multi-site groups
Any size
ISO/IEC17021-1Management systemsAccredited
Accreditation

Accredited by EGAC, the Egyptian Accreditation Council

Management System Certification · ISO/IEC 17021-1

ISO 9001, ISO 14001, ISO 45001, ISO/IEC 27001, ISO 22000, ISO 50001 and ISO 21001, audited in accordance with ISO/IEC 17021-1 and the applicable sector rules: ISO/IEC 17021-2, ISO/IEC 17021-3, ISO/IEC 17021-10, ISO 22003-1, ISO 50003 and ISO/IEC 27006-1.

Accreditation details

Schedule number to be added

Overview

What is ISO/IEC 27001:2022?

ISO/IEC 27001 specifies the requirements for establishing, implementing, maintaining and continually improving an information security management system. It protects the confidentiality, integrity and availability of information through a systematic process of risk assessment and risk treatment.

The 2022 edition sets out 93 reference controls in Annex A, grouped into organisational, people, physical and technological themes. Certification confirms that the system conforms to the standard and that the selected controls are implemented and effective.

Accredited certification is independent evidence that your management system conforms to the standard and is effective in practice.

Padlock on a laptop keyboard
Benefits

The value of ISO/IEC 27001 certification

The outcomes organisations most commonly seek from certification.

  • TrustMeet client security requirementsBanks, government entities and multinationals increasingly require ISO/IEC 27001 certification from service providers.
  • RiskReduce information security riskA risk-based approach directs resources to the threats and vulnerabilities that matter most.
  • ComplianceSupport data protection obligationsA certified system supports compliance with data protection legislation, including the UAE Personal Data Protection Law.
  • EfficiencyShorten due diligenceAn accredited certificate answers a large part of client security questionnaires and supplier assessments.
Applicability

Who ISO/IEC 27001 is for

The standard applies to organisations of any size and sector. Certification is particularly valuable if you:

  • Provide IT, cloud, software or data services
  • Process client or personal data
  • Supply banks, government or healthcare providers
  • Receive security questionnaires in tenders
Readiness self-assessment

How ready are you for ISO/IEC 27001?

Answer six questions to assess your readiness for the certification audit.

  1. The scope and policy of our ISMS are defined and communicated
  2. Risks, opportunities and applicable requirements are identified
  3. Objectives are set, measured and reviewed
  4. The documented information required by the standard is maintained
  5. A complete internal audit has been carried out
  6. Top management has conducted a management review
Requirements

What the standard requires

The requirements are set out in clauses 4 to 10, following the Plan, Do, Check, Act cycle. Auditors will expect to see the following documented information.

Key documented information

  • Scope of the information security management system
  • Information security policy
  • Information security risk assessment and risk treatment process
  • Statement of Applicability
  • Risk treatment plan and results
  • Evidence of competence and awareness
  • Internal audit and management review results
  • Information security incident records
Process

The path to ISO/IEC 27001 certification

Each stage is planned and confirmed with you in advance.

  1. Step 01

    Application and quotation

    You provide details of your scope, personnel and sites. We determine the audit time and issue a fixed quotation and certification agreement.

    You: complete a short application. We: respond within one business day.

  2. Step 02

    Stage 1 audit

    The audit team reviews your documented information, site conditions and readiness, and confirms the plan for Stage 2.

    You: provide your documentation. We: report any areas of concern.

  3. Step 03

    Stage 2 audit

    The audit team evaluates on site how effectively the management system is implemented.

    You: host the audit. We: present findings at the closing meeting.

  4. Step 04

    Certification decision

    A competent reviewer, independent of the audit team, reviews the audit and makes the certification decision.

    You: address any nonconformities. We: issue your certificate.

  • Year 1Initial certification audit and certificate issued
  • Years 2 and 3Annual surveillance audits maintain certification
  • End of year 3Recertification audit renews the certificate for a new cycle
Cost

What does ISO/IEC 27001 certification cost?

The fee is determined mainly by audit time, which is calculated in accordance with IAF MD 5 from the number of personnel, the number of sites and the complexity of your activities. This approach keeps fees consistent and comparable.

  • Number of personnelThe principal factor in determining audit days.
  • Number of sitesAdditional sites may require sampling or separate visits.
  • Scope and complexityDesign, high-risk or regulated activities increase audit time.
  • Integrated systemsAn integrated audit of several standards can reduce total audit time.
Fixed quotation

The full cost of the cycle, confirmed before you commit

Stage 1 and Stage 2 audits. Issue of the certificate. Two annual surveillance audits. No undisclosed charges.

Request a Fixed Quotation
Integration

Combine standards in one audit programme

ISO/IEC 27001 follows the harmonised structure of ISO management system standards, so it can be audited together with other standards.

Already certified?

Transfer your ISO/IEC 27001 certificate to GQCL

A valid accredited certificate held with another certification body can be transferred to GQCL after a pre-transfer review, in accordance with IAF MD 2, without restarting your certification cycle.

How Transfers Work
FAQ

Questions about ISO/IEC 27001

What is the Statement of Applicability?

It is a mandatory document that lists the Annex A controls, states whether each is applied and justifies its inclusion or exclusion. Auditors use it, together with your risk assessment, to plan which controls to evaluate.

We are certified to ISO/IEC 27001:2013. What should we do?

The transition period to the 2022 edition ended on 31 October 2025, and certificates to the 2013 edition are no longer valid. Certification must now be to ISO/IEC 27001:2022, and we can audit your system against the current edition.

How is the audit time for ISO/IEC 27001 calculated?

Audit time is determined in accordance with ISO/IEC 27006-1, based on the number of persons doing work under the control of the organisation and on the complexity of the management system and the business.

Will the auditors test our technical controls?

Auditors evaluate evidence that controls are implemented and effective, through records, interviews, observation and sampling. Certification is not a penetration test, and auditors do not require access to confidential information beyond what the audit needs.

Can organisations that operate largely online be certified?

Yes. Where activities are largely online or there is no permanent physical site, the audit may be conducted partly or wholly by remote means, provided the audit objectives can be achieved, in line with IAF MD 4.

How long does the certification process take?

Once your management system is implemented and has operated long enough to produce records, including a complete internal audit and a management review, the certification process normally takes six to ten weeks from application to certificate. Your quotation sets out the proposed timeline.

How long is the certificate valid?

Three years from the certification decision, subject to satisfactory annual surveillance audits. A recertification audit before expiry renews the certificate for a further three years.

Can GQCL help us implement the standard?

No. As an accredited certification body, GQCL does not provide consultancy on the management systems it certifies, as ISO/IEC 17021-1 requires. We explain the requirements and the certification process clearly, and the Stage 1 audit identifies any areas of concern before Stage 2.

Can the audit be conducted in Arabic?

Yes. Audits, meetings and audit communication can be conducted in Arabic or English, according to your preference.

Get a QuoteAsk an Advisor