All IT Is Now ISO 27001 Certified: What It Is, Why We Did It and What It Means for You

Every day, our clients trust us with admin access to their systems, their data and their staff accounts. All IT is now certified to ISO/IEC 27001:2022, the international standard for information security, so the way we protect that access has been checked by an independent auditor instead of just described by us.

The certification was issued by InterCert, an independent certification body, and it builds on our existing SMB1001 Gold certification. Here is what the standard is, why we did it, and how we can help if you are considering it for your own business.

What is ISO 27001?

ISO/IEC 27001 is published jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). It sets out the requirements for an information security management system, usually shortened to ISMS. ISO calls it the world's best-known standard for this kind of system.

An ISMS sounds technical, but the idea is simple. It is the way a business decides which information matters, works out what could put it at risk, puts sensible protections in place, and keeps checking that those protections still work. It covers people and processes as much as technology.

The 2022 version includes a reference set of 93 security controls in four groups: organisational, people, physical and technological. A business can't simply tick them all off. It has to assess its own risks and justify which controls apply and why.

Who actually certifies a business?

ISO writes the standard, but it doesn't certify anyone. Certification comes from independent certification bodies that audit a business against the standard. A certificate runs for three years, with surveillance audits every year in between, so it has to be earned again on a regular basis.

ISO 27001 and SMB1001 at a glance

	ISO/IEC 27001	SMB1001
Where it comes from	International standard (ISO and IEC)	Australian standard
Who it's built for	Organisations of any size and industry	Small and medium businesses
How it works	A full management system built on your own risk assessment	Tiered levels from Bronze to Diamond
All IT's status	Certified	Gold certified

Why we decided to get certified

SMB1001 Gold remains a practical benchmark for a business like ours. We went further with ISO 27001 for two reasons.

The first is trust. When a business picks an IT provider, it is also picking who holds the keys. The Australian Signals Directorate's Annual Cyber Threat Report 2024-25 describes an organisation's supply chain as often its weakest link. Meanwhile, the Office of the Australian Information Commissioner received 1,205 data breach notifications in 2025, the highest on record, and most were caused by malicious or criminal activity. Our clients deserve evidence that their IT provider isn't the weak link.

The second is recognition. ISO 27001 is recognised internationally and regularly comes up in tenders, supplier questionnaires and due diligence reviews. Holding it means our clients can answer questions about their IT provider with a certificate instead of a promise.

What the process involved for us

Certification was a whole-team project, not a paperwork exercise. We mapped the risks to our own and our clients' information, then tightened the rules for who gets access to what. We wrote down how we handle everything from onboarding a new engineer to responding to an incident, so the process is the same no matter who picks up the ticket.

Our team completed security awareness training, we ran our own internal audit to find the gaps, and we fixed them before InterCert carried out the independent audit. Parts of it were uncomfortable, which is the point. An audit that finds nothing to improve isn't looking hard enough.

What the certification is for

The purpose of ISO 27001 isn't a logo for the website. It is a working system that makes security part of how we run the business every day, with clear owners, regular reviews and a requirement to keep improving.

No standard can guarantee that nothing will ever go wrong. What ISO 27001 does show is that we manage risk in a structured way and have tested plans for when something does.

What changes for our clients

You don't need to do anything, and your support team, contacts and response times stay the same. What changes is the assurance behind the service you already receive.

• It is independently checked. How we protect your data has been audited by a third party, not just described in a proposal.
• The process stays consistent. Access, changes and incidents are handled the same documented way, whichever engineer you deal with.
• Supplier reviews get easier. When your board, insurer, auditor or one of your own clients asks how your IT provider protects information, you can point to our certificate.
• The checks keep happening. We only keep the certificate by passing an audit every year.

Thinking about ISO 27001 for your own business? We can help

Having just been through certification ourselves, we know where the time goes and where businesses tend to get stuck. If your clients, a tender or your insurer are asking for ISO 27001, we can help you get there.

• We start with a gap assessment. We compare how you work today against the standard.
• We build a practical roadmap. You get a prioritised plan that fits your size and budget, instead of a wall of requirements.
• We help write your policies. We document the processes the standard asks for, in plain language your team will actually follow.
• We put the technical controls in place. Access management, device security, backups and monitoring are set up and evidenced.
• We support you through the audit. We help you prepare for the certification audit and the yearly checks that follow.

ISO 27001 isn't the right fit for every business. For many smaller organisations, SMB1001 or the Essential Eight is a more practical place to start, and we will tell you honestly which one suits you.

What happens next

We will be audited again every year, with full recertification every three years. In the meantime, we will keep reviewing and improving how we protect the information our clients trust us with. If you would like a copy of our certificate, just ask us.

All IT is a Sydney-based managed IT provider supporting small and medium businesses across Australia.

---

---