What ISO 27001 means in practice
ISO 27001 differs from the Essential Eight in kind rather than degree. The Essential Eight prescribes specific technical mitigations. ISO 27001 specifies a management system: a documented, risk-driven way of deciding which controls apply, implementing them, checking that they work, and improving them. Two certified organisations can have quite different control sets, both legitimately.
The core requirements cover context and scope, leadership commitment, information security objectives, risk assessment and treatment methodology, a statement of applicability recording which Annex A controls apply and why any are excluded, competence and awareness, documented operating procedures, performance monitoring, internal audit, management review, and corrective action.
Certification involves a certification body performing a Stage 1 documentation review and a Stage 2 implementation audit, followed by annual surveillance audits and recertification on a three-year cycle. The audit tests whether the management system is being operated, which means evidence of reviews actually held, risks actually assessed and incidents actually processed — not a folder of policies written the month before.
The commercial driver is usually procurement. Enterprise and government buyers, and increasingly large corporate clients, ask for certification as a precondition rather than a preference, and it shortens security questionnaires considerably. For organisations selling into those markets the certification pays for itself in sales cycle time.
Mycelium 365 holds this certification itself: our information security management system is certified to ISO/IEC 27001:2022 by QAS International under certificate AIT1045, valid to 20 August 2027, covering our managed IT, cloud, cybersecurity and helpdesk services. Clients running supplier assurance on us can request the certificate and Statement of Applicability.
Scope definition is the decision that determines cost. A scope covering one product line and the teams supporting it is achievable; a scope covering an entire diversified group is a much larger programme. Related standards worth knowing are ISO 27017 and 27018 for cloud, and ISO 42001 for AI management systems, which is becoming relevant as organisations deploy AI tooling into regulated processes.
For a full guide to ISO 27001 certification for Australian businesses, including how Microsoft 365 supports ISO 27001 Annex A controls, see our ISO 27001 certification guide for Australian businesses.
What is ISO 27001?
ISO 27001 is the international standard for information security management systems (ISMS). Published jointly by the International Organisation for Standardisation (ISO) and the International Electrotechnical Commission (IEC), it defines a systematic approach to managing sensitive company information — covering people, processes, and technology. An organisation certified to ISO 27001 has demonstrated to an independent auditor that it has identified its information security risks and implemented controls to manage them. For Australian businesses, ISO 27001 certification is increasingly required by enterprise customers, government procurement panels, and cyber insurers as evidence of a managed approach to security.
ISO 27001 vs Essential Eight — what's the difference?
The Essential Eight is an Australian government framework (published by ASD/ACSC) specifying eight specific technical controls. ISO 27001 is a broader international management system standard covering governance, risk, people, and technology. They are complementary: implementing the Essential Eight satisfies some of the technical control requirements in ISO 27001, but ISO 27001 certification requires additional governance evidence (documented policies, risk register, management review) that the Essential Eight does not. Many Australian businesses pursue Essential Eight first (faster, lower cost) and use it as a foundation toward ISO 27001 certification.
How much does ISO 27001 certification cost in Australia?
ISO 27001 certification for an Australian SMB typically costs $25,000–$80,000 in total — covering gap analysis, remediation, documentation, and the Stage 1 and Stage 2 audits by an accredited certification body. Annual surveillance audits add $5,000–$15,000. Costs vary significantly by organisation size, existing security maturity, and the scope of the ISMS. Mycelium 365 supports the pre-certification technical implementation — contact us to discuss your readiness.
How we help with this
Related terms
- Essential EightThe Essential Eight is a set of eight baseline cyber security mitigation strategies published by the Australian Signals Directorate.
- Zero TrustZero Trust is a security model that assumes no user, device or network location is inherently trustworthy.
- APRA CPS 230CPS 230 is the APRA prudential standard on operational risk management.
- APRA CPS 234CPS 234 is the APRA prudential standard on information security.
Ready to simplify and secure your technology?
Book a free, no-obligation Discovery Call to talk through your Microsoft 365, Azure, security, or support needs — no sales pitch, just a straight conversation.
We respond to every enquiry within 4 business hours. Monday to Friday, 7am–7pm AEST.