Last reviewed: 20 October 2026
ISO 27001 in Nepal has moved from a "nice to have" to a question that boards, regulators and enterprise customers ask directly. Banks, insurers, fintechs and software exporters in Kathmandu are being asked the same thing: are you certified, and to which edition? This guide explains what ISO 27001 certification in Nepal involves, what drives the timeline, and how to choose a certification body you can rely on.
It is written for the people who have to make the decision: CISOs, IT heads, compliance officers and the executives who sign the budget.
What ISO/IEC 27001 actually is
ISO describes the standard plainly: ISO/IEC 27001 "is the world's best-known standard for information security management systems (ISMS). It defines requirements an ISMS must meet."
Two points in that sentence matter for planning.
First, it is a management system standard. It is not a product checklist or a penetration test. ISO says the standard gives organizations guidance "for establishing, implementing, maintaining and continually improving an information security management system." Certification therefore looks at whether your system for managing information security works over time, not only whether a set of tools is installed.
Second, the system is built on risk. ISO's own FAQ says the standard lets organizations "apply a risk management process that is adapted to their size and needs." Two organizations of different sizes can both be certified with very different control sets, because each is judged against its own assessed risks.
The current edition is ISO/IEC 27001:2022, the third edition, published in October 2022. ISO lists one amendment to it, ISO/IEC 27001:2022/Amd 1:2024, titled "Climate action changes." ISO also asks that certificates use the full reference, "for example 'certified to ISO/IEC 27001:2022' (not just 'certified to ISO 27001')." If a supplier tells you they are "ISO certified", ask which standard and which edition.
Certification is optional, and ISO does not issue it
Two facts surprise many first-time buyers.
Certification is a choice. ISO notes that "companies implementing ISO/IEC 27001 can decide whether they want to go through a certification process." Some organizations implement the standard for its practices alone. Others certify because customers, partners or regulators ask for independent evidence.
ISO itself never certifies anyone. ISO's certification page is direct: "ISO does not perform certification or issue certificates." Certification is carried out by independent certification bodies. Any claim of being "certified by ISO" is a red flag in a proposal.
The standard is also widely used. According to ISO, "as per the ISO Survey 2022, over 70 000 certificates were reported in 150 countries."
Why Nepali financial institutions ask about it
For banks, payment providers and other institutions licensed by Nepal Rastra Bank's Payment Systems Department, the NRB Cyber Resilience Guidelines (August 2023) expect institutions to periodically evaluate their cyber resilience framework. One of the options the guidelines list is "a third-party assessment such as a certification, accreditation or external audit."
The guidelines also say they are "not meant to serve as a check list for technical requirements or control requirements." ISO 27001 does not replace NRB's expectations. It gives you a recognized management system in which to run them, and independent evidence that the system is operating.
If you are regulated by NRB, read our companion guide on preparing for an NRB IS audit alongside this one.
How the certification process runs
Every certification body publishes its own procedure, so confirm the details with the body you choose. In broad terms, an ISO 27001 journey has three phases.
1. Build the management system
This is the implementation work, done by your team or with an implementation partner:
- Define the scope. Decide which business units, locations, systems and services the ISMS covers. A narrow, well-defined scope is easier to certify and easier to maintain than a vague one.
- Assess risk. Identify information assets and the threats to their confidentiality, integrity and availability. ISO frames this as the core of the standard: an ISMS "preserves the confidentiality, integrity and availability of information by applying a risk management process."
- Treat the risks. Select and implement controls that are proportionate to the risks you found.
- Run it. Operate the controls long enough to produce records: approvals, reviews, logs, training, incident handling. Auditors look for evidence that the system works in practice.
2. The certification audit
A certification body audits the management system you built against the requirements of the standard and your own policies. Ask each body to explain its audit stages, how findings are raised and closed, and how it reaches the certification decision, before you sign.
3. Keep it running
Certification is not a one-off event. The standard is about "continually improving" the ISMS, so ask your certification body how it audits you during the life of the certificate, and budget for the system's running cost, not only the first audit.
What drives the timeline
We do not quote durations in an article, because they depend on factors that only a scoping conversation can measure. These are the factors that move the timeline most:
- Scope size. Each additional site, business line or critical system adds assets to assess, owners to involve and evidence to collect.
- Starting maturity. An organization that already runs documented policies, access reviews and incident processes is mostly formalizing. One that does not is building from scratch.
- Ownership. Implementations stall when no senior person owns the ISMS. Board and management attention is the single most reliable accelerator.
- Evidence history. Auditors want to see controls operating, not just written down. If records do not exist yet, you need time to generate them.
- Suppliers and outsourcing. Outsourced IT, cloud services and software vendors bring their own risks and their own evidence requirements.
- Certification body availability. Audit dates depend on the body's calendar. Book early.
How to choose a certification body
This is the decision most organizations get wrong, because it looks like a procurement formality. ISO's certification guidance gives a short checklist. When choosing a certification body, ISO says you should:
- "Evaluate several certification bodies."
- "Check if the certification body uses the relevant CASCO standard." CASCO is ISO's Committee on Conformity Assessment, which ISO says "has produced a number of standards related to the certification process, which are used by certification bodies."
- "Check if it is accredited."
On accreditation, ISO is careful: "Accreditation provides independent confirmation of competence. However, accreditation is not compulsory, and non-accreditation does not necessarily mean the certification body is not reputable." For a regulated Nepali institution, though, an accredited certificate is the stronger evidence to put in front of a board, a regulator or a foreign partner.
Verifying a certificate
You can verify certificates as well as issue them. ISO points to the International Accreditation Forum's database, IAF CertSearch, which "aggregates data from accreditation bodies and certification bodies, allowing you to confirm certification and accreditation status in one place." ISO also notes that the Global Accreditation Cooperation (Global ACI) "has assumed the former roles of the International Accreditation Forum (IAF) and the International Laboratory Accreditation Cooperation (ILAC)."
Use the same check on your suppliers. When a vendor claims ISO 27001 certification, look the certificate up, and read its scope. A certificate that covers a vendor's head office does not cover the data centre that hosts your data.
Checklist: before you start
Use this list to decide whether you are ready to begin an ISO 27001 project.
| Question | Why it matters |
|---|---|
| Do we know why we want certification (regulator, customer, tender, board)? | The reason shapes the scope and the deadline. |
| Have we agreed a draft scope in writing? | Scope drives effort, cost and audit days. |
| Is there a named senior owner for the ISMS? | Ownership is the strongest predictor of progress. |
| Do we have an up-to-date asset inventory? | Risk assessment starts from assets. |
| Do we keep records of access reviews, changes and incidents? | Auditors look for operating evidence. |
| Have we listed our critical suppliers and outsourced services? | Supplier risk is part of the system. |
| Have we shortlisted at least two certification bodies and checked accreditation? | ISO recommends evaluating several bodies. |
| Is the budget approved for running the ISMS, not just the first audit? | Certification continues after the first certificate. |
Frequently asked questions
Does ISO certify organizations directly?
No. ISO states that it "does not perform certification or issue certificates." Certificates are issued by independent certification bodies, and you can verify accredited certificates through IAF CertSearch.
Is accreditation of the certification body mandatory?
No. ISO says "accreditation is not compulsory, and non-accreditation does not necessarily mean the certification body is not reputable." Accreditation does give independent confirmation of the body's competence, which is why regulated institutions usually prefer it.
Which edition should we certify to?
The current edition is ISO/IEC 27001:2022, with one published amendment (Amd 1:2024, climate action changes). Ask your certification body how it handles the amendment in audits.
Does ISO 27001 satisfy NRB's cyber resilience expectations?
Not on its own. NRB's Cyber Resilience Guidelines list "a third-party assessment such as a certification, accreditation or external audit" among the ways to evaluate your framework, but they set their own expectations for governance, testing and response. ISO 27001 gives you the management system to meet them in.
How long does certification take?
It depends on scope, current maturity, ownership and evidence history, so any honest answer comes after a scoping call. The factors listed above are where to look first.
Can a small organization get certified?
Yes. ISO says the standard serves "companies of any size and from all sectors of activity," and that the risk process is "adapted to their size and needs."
Next step
Trinity Technology runs ISO 27001 gap assessments, implementation and audit-readiness work for organizations in Nepal, alongside ISO 27701 and ISO 42001. See our ISO 27001 / 27701 / 42001 readiness service, or tell us your scope and deadline and we will reply within 24 hours.