Scope and context
Write the scope statement, list internal and external issues and interested parties.
See howSolutions · ISO 27001
ISO 27001 certification, without the binder.
Everything the standard asks for, from the scope statement to the surveillance audit, in one place your team actually uses. A typical company reaches Stage 2 in five to six months. Watch the road on the right.
What the standard asks for
Seven clauses and 93 controls, all covered
Clauses 4 to 10 define the management system. Annex A lists the controls. Hover a clause to see where it lives in CompliLens.
Clause 4ContextContext & Interested PartiesClause 5LeadershipPolicies · roles & permissionsClause 6PlanningRisk register · objectivesClause 7SupportTraining · awareness · documentsClause 8OperationControls · evidence · vendorsClause 9PerformanceAudits · management reviewClause 10ImprovementNCRs · CAPA
Organisational37 controls
People8 controls
Physical14 controls
Technological34 controls
Documented information
The binder you no longer need
ISO 27001 requires fourteen pieces of documented information. In most companies they live in a shared drive and go stale between audits. In CompliLens each one is a live record, so it is current the day the auditor asks.
- Every document has an owner and a version history
- Exported as one pack for Stage 1
- Nothing to rebuild for surveillance audits
ISMS · documented information 14 / 14 current
4.3Scope of the ISMSContext register
5.2Information security policyPolicies
6.1.2Risk assessment processRisk register
6.1.3Risk treatment processRisk register
6.1.3 dStatement of ApplicabilityControls
6.2Information security objectivesObjectives & KPIs
7.2Evidence of competenceTraining records
8.1Operational planning and controlTasks · controls
8.2Risk assessment resultsRisk register
8.3Risk treatment resultsResidual risk
9.1Monitoring and measurement resultsDashboard · analytics
9.2Internal audit programme and resultsAudits
9.3Management review resultsManagement review
10.2Nonconformities and corrective actionsNCRs · CAPA
The road to certification
Nine stages, one workspace
Risk assessment
Identify and score risks with one method, then choose a treatment for each.
See howStatement of Applicability
Activate the 93 controls, mark what applies and justify exclusions.
See howPolicies
Write, approve and publish the policy set, with timed acknowledgement.
See howAwareness training
Train every employee and run a baseline phishing simulation.
See howEvidence
Connect cloud and identity systems so proof collects itself.
See howInternal audit
Plan the audit, sample, raise findings and fix root causes.
See howManagement review
Review performance with leadership using a live snapshot.
See howStage 1 and Stage 2
Documentation review, then the implementation audit. Certificate recorded.
See howAudit day
What the auditor asks, and where the answer lives
Every question below is answered from a record in CompliLens, not a folder search.
“Show me your ISMS scope.”Context & Interested Parties “How did you identify and assess risks?”Risk Register “Why is control 8.30 excluded?”Statement of Applicability “How do staff learn about security?”Security training “Prove staff read the Acceptable Use Policy.”Policy acknowledgement “Show your last internal audit and its findings.”Audits & NCRs “How did you sample those records?”Audit Sampling Log “Did the corrective action work?”CAPA effectiveness check “When did leadership last review the ISMS?”Management Review “Who has admin access, and was it reviewed?”Access Review Log “Show me backup restore evidence.”Evidence Repository “How do you manage supplier risk?”Vendors and evaluations
The certification audit
Stage 1 and Stage 2, prepared
Scope and context
Scope statement, exclusions and interested parties, exported as one document.
Risk method
Your scoring method and the full register with treatments.
Statement of Applicability
All 93 controls, applicability and justifications.
Policy set
Approved policies with version history and owners.
Objectives
Measurable objectives with live values.
Internal audit
The audit plan, findings and corrective actions.
Evidence on request
Auditors raise requests in CompliLens and owners answer with files.
Sampling
A log of what was sampled and what was found.
Training records
Completion, scores, simulations and acknowledgements per person.
Incident handling
Incidents with timelines, root causes and effectiveness checks.
Access reviews
Every account, every decision, every reviewer.
Supplier control
Evaluations, documents and DPAs for each vendor.
Surveillance reminders
Alerts well before each surveillance audit.
Audit programme
A three-year plan covering every area before recertification.
Always current
Evidence keeps collecting, so nothing goes stale between audits.
Recertification
Year three runs from the same records, not a new project.
Management review
Yearly reviews prepared from live data.
Trust Center
Share your certificate with customers the day it arrives.
Questions
ISO 27001, answered
How long does certification take?
It depends on your size and starting point. Companies that already have some controls in place commonly reach Stage 2 in five to six months; CompliLens shortens the documentation and evidence work, not the auditor's timetable.
Do we still need a certification body?
Yes. An accredited certification body runs Stage 1 and Stage 2 and issues the certificate. CompliLens prepares you and gives the auditor what they ask for.
Do we need all 93 controls?
You must consider all 93 and justify any you exclude. CompliLens records applicability and justification for each, which becomes your Statement of Applicability.
Can we reuse the work for SOC 2?
Yes. Map your ISO controls to the SOC 2 criteria and most of the evidence counts for both.