ISO 27001 compliance software
What it is
ISO 27001 is the international standard for an information security management system (ISMS), published by ISO and IEC. The 2022 edition is the current version. It sets out how an organisation identifies information security risks, chooses controls and keeps improving its protection of information. Annex A lists 93 controls across four themes. They are organisational, people, physical and technological. A Statement of Applicability records which controls apply and why.
Who needs it
ISO 27001 is a voluntary standard. Any organisation can adopt it, whatever its size or sector. Cloud providers, software vendors, financial firms and public bodies often use it to show that their security is managed. Enterprise procurement teams add it to vendor questionnaires. A certificate from an accredited certification body gives buyers independent proof of the ISMS. Regulators in some sectors and countries also point to it.
What auditors check
- A defined scope for the ISMS that names the locations, teams, systems and services it covers.
- An information security policy that top management approves and reviews at planned intervals.
- A risk assessment method, a risk register and a risk treatment plan with an owner for each risk.
- A Statement of Applicability that lists each Annex A control, whether it applies and the reason for that decision.
- Access control that gives each user only the access the role needs, reviewed regularly and removed at exit.
- An asset inventory that records each information asset, its owner and its classification.
- Awareness training for staff, with records that show who completed it.
- Logging and monitoring that record security events and support review of unusual activity.
- Supplier security reviews for the third parties that handle the organisation's information.
- Incident management that records, assesses and responds to information security events.
- Internal audits and a management review of the ISMS, with records of findings and actions.
How Oncrypt gets you ready
Oncrypt builds your ISO 27001 readiness from the Annex A controls auditors test first. Our scans cover your website and its trackers. We also check your email and domain settings and the cloud accounts where company data lives. Each finding lands in your score with a clear fix and an owner. Our in house pentest team tests the systems that matter most. Our compliance lead checks the evidence. The evidence vault keeps each control record ready for your next review. An accredited certification body audits your ISMS and issues the certificate after its Stage 1 and Stage 2 audits. Oncrypt gets you audit ready for that review.
Overlap with other frameworks
Questions
What is ISO 27001?
ISO 27001 is the international standard for an information security management system. The 2022 edition sets out 93 Annex A controls in four themes. It asks you to manage information security risk across all of them.
What is the difference between ISO 27001 and SOC 2?
ISO 27001 is a standard for an ISMS. An accredited certification body issues its certificate. SOC 2 is an attestation report from a licensed CPA firm that tests the controls you describe to buyers. Many companies pursue both.
How long does an ISO 27001 certificate last?
An ISO 27001 certificate is valid for three years. Surveillance audits take place during that cycle, usually each year. The full recertification audit comes at the end of the cycle.
Does Oncrypt give us an ISO 27001 certificate?
No. Oncrypt does not issue ISO 27001 certificates. Oncrypt gets you audit ready. An accredited certification body performs the Stage 1 and Stage 2 audits and issues the certificate.
What is a Statement of Applicability?
The Statement of Applicability lists every Annex A control. For each control it records whether the control applies, the reason for that decision and how the control is implemented. Auditors read it early.
Start with the gaps that matter most
Talk to us about your framework. We will show you what to fix first and what your auditor will ask for.