ISO 27001
ISO/IEC 27001 — Information Security Management
The international information-security standard — managed end to end, audit-ready.
Overview
What is ISO 27001?
ISO/IEC 27001 is the international standard for an Information Security Management System (ISMS). Unlike GDPR, it is not a law — it is a certifiable framework. You build a management system for information security, an accredited external auditor assesses it, and you earn a certificate that you then maintain over a three-year cycle of surveillance audits.
The current revision, ISO/IEC 27001:2022, has two parts. The management-system clauses (4–10) set out how you run the ISMS: context and scope, leadership, risk assessment and treatment, support, operation, performance evaluation (internal audit and management review) and continual improvement. Annex A is a catalogue of 93 security controls grouped into four themes — organisational, people, physical and technological.
Certification is a journey, not a moment. A Stage 1 audit reviews your documentation and readiness; a Stage 2 audit tests whether the ISMS actually operates as described; and annual surveillance audits confirm it keeps working. Throughout, the auditor wants to see accumulated evidence — decisions made, reviews held, actions closed — not a binder assembled the week before.
Crucially, most of ISO 27001 is organisational: policies, risk decisions, reviews and human-owned evidence. A portion is technical and can be observed automatically. Audulate is honest about that split — it auto-derives the evidence it can scan, and gives you structured, audit-ready surfaces for everything else, so you can build the management system steadily over time.
Applicability
Who must comply?
- No organisation is legally required to hold ISO 27001 — but it is increasingly a commercial prerequisite, demanded by enterprise customers, procurement teams and partners.
- SaaS and technology companies selling to larger organisations, where a certificate short-cuts lengthy security due-diligence and vendor questionnaires.
- Service providers and processors that handle other organisations’ data and need to prove a credible, independently-audited security baseline.
- Any organisation that wants a recognised framework to structure its security programme, rather than inventing one from scratch.
- Teams pursuing related assurance (such as SOC 2, or heavyweight customer security reviews), since the ISO 27001 control set maps closely onto them.
Obligations
What you must maintain
A defined ISMS scope and context
What the management system covers — systems, locations and boundaries — plus the internal/external issues and interested parties that shape it (Clauses 4.1–4.3).
Leadership and security objectives
Top-management commitment, an information security policy, assigned roles, and measurable objectives with owners (Clauses 5 and 6.2).
A risk assessment and treatment plan
Identified risks, scored and treated, with risk owners and residual risk recorded (Clauses 6.1.2/6.1.3).
A Statement of Applicability (SoA)
Every Annex A control: applicable or not, the justification, its implementation status and its owner (Clause 6.1.3(d)).
Approved, acknowledged policies
Information security policies that are versioned, approved, and acknowledged by the people they apply to.
Competence, awareness and training
Evidence that staff are competent, trained, and aware of their security responsibilities (Clauses 7.2/7.3, Annex A.6.3).
Internal audits and management reviews
Evidence the ISMS is independently checked and steered by leadership at planned intervals (Clauses 9.2/9.3).
Corrective actions (CAPA)
A closed loop from nonconformity → root cause → corrective action → verification of effectiveness (Clause 10).
Operational evidence for the auditor
Access reviews, supplier and asset records, training, incidents and more — assembled and exportable on demand.
Coverage
How Audulate covers ISO 27001
Audit-ready attestation surfaces
The heart of ISO 27001. 118 Annex A + ISMS controls live on one Statement of Applicability, backed by dedicated modules so you can maintain evidence continuously, in one place.
- Statement of Applicability across 37 organisational, 8 people, 14 physical and 34 technological controls, plus the 25 ISMS clauses.
- Risk register (5×5), policy library with magic-link staff acknowledgement, and periodic access reviews.
- ISMS governance (scope, interested parties, objectives), internal audits, management reviews and CAPA.
- Asset inventory, incidents, training records, physical security and certification-cycle tracking.
Automated evidence where we can scan
15 controls get auto-derived evidence from your website, cloud and code scans — so the technical controls fill themselves in.
- Encryption in transit, security headers and secure development signals (TLS, CSP, SRI, outdated dependencies) from web scans.
- Environment separation and cloud posture from infrastructure scans.
- Authentication and supplier/transfer evidence cross-tagged from your privacy controls.
- Secrets and insecure patterns caught in pull requests feed the secure-development controls.
One-click audit package
When the auditor comes, export everything as a single, organised ZIP.
- SoA, risk register and findings as CSVs; policies, access reviews, internal audits, CAPA and management-review minutes as files.
- Evidence artefacts, asset inventory, training, incidents and people roster — all in one bundle.
- A read-only auditor portal with a forensic access log, so auditors can review without a login.
Automated controls feed the same compliance score and evidence trail as your other frameworks; the rest is tracked as audit-ready status on the SoA.
In-app modules
Statement of Applicability
All 118 controls with applicability, status, owner and review dates.
Risk register
5×5 likelihood × impact, treatment and residual scoring.
Policy library
Versioned policies with magic-link employee acknowledgement.
Internal audits & management reviews
Run the ISMS lifecycle (Clause 9).
CAPA
Closed-loop corrective and preventive actions (Clause 10).
Audit package & auditor portal
One-click evidence export and a read-only auditor view.
Get started
Up and running in 3 steps
Run a free scan
Start with a website scan — the automated technical controls begin populating immediately.
Build your SoA
Set applicability, owners and status across the 118 controls; add risks and policies.
Export for the auditor
Generate the one-click audit package when it’s time for assessment.
FAQ
ISO 27001 questions
Does Audulate make me ISO 27001 certified?
No — certification comes only from an accredited external auditor. Audulate is the audit-ready toolkit that gets you there: it auto-derives the evidence it can scan, gives you structured surfaces for the organisational controls, runs the ISMS lifecycle (risk, internal audit, management review, CAPA), and exports everything in one package for the auditor.
How much of ISO 27001 is actually automated?
In honest terms, most of ISO 27001 is organisational. Audulate auto-derives evidence for 15 of the 118 controls on its Statement of Applicability — the technical ones it can observe via website, cloud and code scans — and provides attestation and evidence surfaces for the rest. We don’t claim to auto-check controls we can’t actually see.
What is the Statement of Applicability (SoA)?
The SoA is the central ISO 27001 document. For every Annex A control you record whether it applies, the justification, its implementation status and its owner. Audulate maintains all 118 entries (Annex A plus the ISMS clauses) with a per-row audit trail and signed version snapshots for management sign-off.
How long does ISO 27001 certification take?
Typically several months to build and operate the ISMS before a Stage 1 and Stage 2 audit, because auditors want to see the management system running over time. Maintaining evidence continuously — rather than assembling it at the end — is the single biggest accelerator, which is what Audulate is built for.
Which version of the standard does this cover?
ISO/IEC 27001:2022 — the current revision, with the 93 Annex A controls organised into the four 2022 themes (organisational, people, physical, technological), plus the mandatory ISMS clauses 4–10.
Can I do GDPR and ISO 27001 together?
Yes, and they reinforce each other. Several of your GDPR and security controls cross-tag to ISO Annex A automatically, so evidence you create for one counts toward the other — and both feed the same compliance score and evidence trail.
This page is informational and not legal advice. Coverage describes Audulate’s current capabilities; your compliance obligations depend on your specific circumstances.
Get started today
Your compliance changes
every time you ship.
Audulate keeps up. Free to start.