What is ISO 27001?
ISO 27001 (formally ISO/IEC 27001) is the international standard for information security management systems (ISMS). It specifies requirements for establishing, implementing, maintaining, and continually improving an ISMS — a systematic approach to managing sensitive information so it remains secure. Achieving ISO 27001 certification demonstrates to customers, partners, and regulators that your organisation manages information security to a rigorous, internationally recognised standard. The current version is ISO 27001:2022, which replaced the 2013 edition and added 11 new controls covering areas like threat intelligence, cloud security, and data masking.
The ISO 27001 standard is deliberately risk-based rather than prescriptive. It does not tell you which firewall to buy or how often to patch. Instead, it requires you to understand your information security risks, decide which of the 93 Annex A controls apply to your situation, document that decision in a Statement of Applicability, and then operate those controls with evidence that they work. Two certified organisations can look quite different technically — what they share is a disciplined, audited management system sitting above the technology.
That management-system approach is what separates ISO 27001 from a security checklist. An ISMS includes an information security policy approved by leadership, a documented risk assessment and treatment methodology, defined security objectives, internal audits, management reviews, and corrective action processes. The standard follows a continual improvement cycle — plan, do, check, act — so certification is not a one-off project but an operating rhythm the organisation commits to maintaining.
Is ISO 27001 mandatory for Australian businesses?
ISO 27001 is not legally mandated for most Australian businesses, but it is increasingly required by enterprise customers, government agencies, and insurers as a condition of doing business. Defence contractors working under DISP, businesses supplying to government, and organisations in financial services, healthcare, and legal sectors are increasingly expected to hold ISO 27001 certification or demonstrate equivalent controls. The Australian Prudential Regulation Authority (APRA) CPS 234 and CPS 230 requirements for financial services organisations are closely aligned with ISO 27001 principles.
The commercial pressure is usually the deciding factor. Enterprise procurement teams and government buyers use ISO 27001 certification as a shortcut in supplier risk assessments — a certified supplier answers most of a 200-question security questionnaire with a certificate number. Cyber insurers are moving the same direction, asking for evidence of an operating management system rather than a list of products. For businesses selling into these markets, certification frequently pays for itself in shortened sales cycles and insurance premiums alone.
How ISO 27001 relates to the Essential Eight
ISO 27001 and the Essential Eight both address information security but from different angles. The Essential Eight is a prescriptive list of eight technical controls developed by the ACSC specifically for Australian organisations. ISO 27001 is a broader international management system standard covering governance, risk management, and 93 controls across four themes. Many organisations pursue both — Essential Eight Maturity Level 2 satisfies several ISO 27001 Annex A controls, particularly around access control (A.8.3, A.8.5), vulnerability management (A.8.8), and backup (A.8.13). Mycelium 365 helps Australian businesses achieve both frameworks simultaneously, starting with the Essential Eight as the technical foundation and ISO 27001 as the governance layer above it.
For most Australian small and mid-sized businesses the sequencing matters. Pursuing Essential Eight compliance first builds the technical muscle — application control, patching, MFA, backups — that ISO 27001 auditors then expect to see operating. Layering the ISMS governance on top of an already-hardened Microsoft 365 environment is significantly faster than building both at once, and the evidence collected for Essential Eight assessments maps directly into the ISO 27001 audit trail.
How Microsoft 365 and Azure support ISO 27001 compliance
Microsoft 365 Business Premium and Azure support a significant portion of ISO 27001 Annex A controls:
- Access control (A.8.3, A.8.5): Entra ID Conditional Access enforces identity verification and least-privilege access
- Endpoint security (A.8.7): Microsoft Intune enforces device compliance policies and manages patch deployment
- Threat detection and incident management (A.5.25, A.5.26): Microsoft Defender for Business provides 24/7 threat detection with Huntress-powered SOC from Mycelium 365
- Data protection and classification (A.8.12): Microsoft Purview sensitivity labels classify and protect documents and emails
- Backup and recovery (A.8.13): Azure Backup provides geo-redundant backup with tested recovery procedures
- Supplier security (A.5.19): Microsoft 365 itself holds ISO 27001 certification, providing assurance for the supplier security control
- Cryptography (A.8.24): Microsoft 365 encrypts data at rest and in transit by default using AES-256
An organisation with a properly configured Microsoft 365 Business Premium environment managed by Mycelium 365 can demonstrate compliance with a substantial portion of ISO 27001 Annex A technological controls before any additional tooling is required.
The qualification in that sentence is "properly configured". Out of the box, Microsoft 365 tenants ship with permissive defaults — legacy authentication enabled, no Conditional Access policies, unmanaged device access. The platform capability covers the controls; the configuration, documentation, and operating evidence are what the auditor actually examines. This is where most DIY ISO 27001 efforts stall: the technology was available the whole time, but nobody wrote down what was configured, why, and how it is reviewed.
What does ISO 27001 certification involve?
ISO 27001 certification is awarded by an independent, JASANZ-accredited certification body after a two-stage audit. Stage 1 is a documentation review — the auditor assesses whether your ISMS documentation (information security policy, risk assessment, statement of applicability, and procedures) meets the standard. Stage 2 is an implementation audit — the auditor verifies that the documented controls are actually operating as described. Both stages must pass before certification is awarded. Certification is valid for three years, with annual surveillance audits in years one and two.
The Stage 2 audit is where preparation pays off. Auditors test whether the management system lives in the organisation rather than in a folder — they will ask to see minutes of management reviews that actually happened, risk assessments with real dates and owners, incident records, and evidence that controls like access reviews and patch reports are produced on schedule. Organisations that treat the ISMS as paperwork written the month before the audit consistently struggle at Stage 2.
Certification costs vary with scope and auditor day rates, but Australian small and mid-sized businesses typically budget for the certification body's audit fees across the initial two stages plus the annual surveillance visits, in addition to the internal or consulting effort to build the ISMS itself. Defining a tight, sensible scope — the systems and teams that actually handle sensitive information — is the single biggest lever on both cost and timeline.
How long does ISO 27001 certification take for an Australian business?
ISO 27001 certification typically takes 6–18 months for an Australian business, depending on size, current security posture, and how much of the ISMS needs to be built from scratch. Organisations with a mature Microsoft 365 and Azure environment already managed by Mycelium 365 typically reach certification readiness faster — most of the Annex A technological controls are already configured, documented, and operating. The remaining work is primarily governance documentation: the information security policy, risk treatment plan, and statement of applicability.
The variables that move the timeline most are scope breadth, leadership availability, and how much evidence already exists. A 40-person business with a single Microsoft 365 tenant, an existing Essential Eight assessment, and an engaged leadership team can realistically reach Stage 1 readiness inside six months. A multi-entity group with legacy systems and no documented processes should plan toward the longer end. Booking the certification body early also matters — JASANZ-accredited auditors in Australia often have lead times of several months for Stage 1 slots.
How Mycelium 365 helps Australian businesses with ISO 27001
Mycelium 365 helps Australian businesses prepare for ISO 27001 certification through its Governance and Compliance Readiness advisory service. This includes: a gap assessment against ISO 27001 Annex A controls mapped to your current Microsoft 365 and Azure environment; a prioritised remediation plan addressing missing controls; configuration of Entra ID, Intune, Defender, Purview, and Azure Backup to meet ISO 27001 Annex A requirements; preparation of evidence documentation for Stage 1 and Stage 2 auditors; and coordination with your chosen certification body. Contact Mycelium 365 for a no-obligation ISO 27001 readiness conversation.
Mycelium 365 holds ISO/IEC 27001:2022 certification itself — our information security management system is certified by QAS International under certificate AIT1045, covering our managed IT, cloud, cybersecurity, and helpdesk services. That means the team guiding your preparation has operated an audited ISMS, sat on the audited side of the table, and knows precisely what evidence a Stage 2 auditor asks to see. For organisations starting from an unknown posture, our Essential Eight baseline assessment is a practical first step that maps cleanly onto the ISO 27001 gap assessment.
How to prepare for ISO 27001 certification — step by step
Step 1 — Conduct a gap assessment
Assess your current information security posture against ISO 27001 Annex A controls. Identify which controls are already in place through Microsoft 365 and Azure, which are partially implemented, and which are absent. The output is a prioritised register of gaps with owners and effort estimates — this becomes the backbone of your certification project plan.
Step 2 — Define your ISMS scope
Define the boundaries of your Information Security Management System — which systems, data, processes, and locations are in scope. For most Australian businesses this includes Microsoft 365, Azure, and any systems handling sensitive customer or business data. A tightly drawn scope reduces audit cost and timeline; an over-broad scope is the most common cause of stalled certification programmes.
Step 3 — Implement missing controls
Address the gaps identified in your assessment. For Microsoft 365 environments this typically involves configuring Entra ID Conditional Access, Microsoft Purview sensitivity labels, Defender for Business, Intune compliance policies, and Azure Backup. Prioritise controls that protect your highest-risk information first, and document each control as it is implemented rather than retrospectively.
Step 4 — Document your ISMS policies and procedures
Create the documentation required by ISO 27001 — including an information security policy, risk assessment methodology, statement of applicability, and documented procedures for key controls. Auditors review this documentation in the Stage 1 audit. Keep documents concise and operational: auditors favour short procedures that are actually followed over comprehensive manuals that are not.
Step 5 — Engage an accredited certification body
Select a JASANZ-accredited certification body to conduct your ISO 27001 audit. The process involves a Stage 1 documentation review and Stage 2 implementation verification. Mycelium 365 can help prepare evidence and guide auditors through your Microsoft 365 and Azure control implementation, so the audit tests your security posture rather than your ability to translate it for an unfamiliar audience.
When ISO 27001 certification is in place, your organisation can answer any enterprise or government security questionnaire with a certificate, not a conversation.