ISO/IEC 27001 specifies requirements for an information security management system that helps an organisation manage risks to the confidentiality, integrity and availability of information.

The period depends on scope, system complexity, number of locations, existing controls, risk-assessment maturity and the availability of evidence. A readiness assessment is needed before setting a reliable schedule. For Iran, the estimate should also account for large industrial facilities and domestic supply-chain complexity where relevant.

No. Technical testing may support risk evaluation, but ISO 27001 also requires governance, risk treatment, roles, competence, supplier controls, incident management, internal audit and management review.

It is a controlled document that records which information-security controls are applicable, their implementation status and the justification for inclusion or exclusion.

Yes. A multi-site ISMS can be considered when the central system, shared controls, site responsibilities and interfaces are clearly defined.

Not necessarily. The organisation defines a justified ISMS scope, but exclusions and interfaces must be clear so that important risks are not omitted.

Yes. Common management-system elements such as document control, internal audit, management review, objectives and corrective action can be integrated.

Auditors may review risk records, the Statement of Applicability, access reviews, incident records, supplier evaluations, monitoring results, internal audits, management reviews and corrective actions.

An independent certification body conducts the certification audit and makes the certification decision. Consultancy support should remain separate from that decision.

Yes. The organisation must maintain the ISMS and undergo periodic surveillance assessments during the certification cycle.