ISO/IEC 27001:2022 Readiness
Be ISO 27001 audit ready, clause by clause.
A guided path through every clause and Annex A control, scoped to how your organisation actually works. Your business liaison answers, your GRC liaison reviews, and each stage ends in a document your auditor asks for.
At a glance
- Standard
- ISO/IEC 27001:2022
- Clauses covered
- 4 to 10 + Annex A
- Annex A controls mapped
- 93
- Document templates
- 69
- Risk scenarios in the library
- 102
- Seats included
- 1 GRC + 2 business
How it works
Six stages, each one ends in a document.
Stages unlock in order. Implementation and management review run in parallel once your Statement of Applicability is complete.
Context
Clause 4
Nineteen guided questions about your organisation. A formal scope statement drafted from your answers, which you approve.
You produce
A documented context and an agreed ISMS scope statement
Statement of Applicability
Annex A
Decide which of the 93 Annex A controls apply, and justify each one. Seventeen baseline controls arrive pre-justified.
You produce
A complete, justified SoA in Word and Excel
Risk management
Clause 6
Assess from a library of 102 scenarios, 36 of which apply to every organisation. Score on a 5×5 grid. Treat each risk down.
You produce
A scored inherent and residual risk register with treatment decisions
Documents
Clause 7
A 38-item worklist, 31 of them mandatory, assembled from 69 templates and merged with your answers. Edit offline and re-upload your own.
You produce
A complete, audit-ready set of ISMS policies and records
Control implementation
Clause 8
Capture evidence per control, assign owners, and take each control through your internal audit with findings, corrective actions and target dates.
You produce
Every applicable control audited, with evidence and findings on record
Management review
Clause 9.3
Author the minutes. Seven of twelve agenda items pre-fill from your live assessment.
You produce
A dated, immutable management-review record, exported to Word
Then the auditor
Hand your certification body the internal audit record: every applicable control with its evidence, findings and corrective actions, alongside the SoA, risk register, policies and minutes. Export the pack, or open two read-only seats once the assessment is in maintenance.
Always oriented
Know you are ready before your auditor does.
Every assessment opens on one dashboard. Six honest numbers, and no invented score. When all six read complete, you are ready.
Controls applicable
78 / 93
justified in the SoA
Risks identified
34
scored inherent and residual
Residual within threshold
31 / 34
3 accepted with rationale
Documents ready
27 / 31
mandatory items generated
Controls audited
61 / 78
evidence and findings on record
Reviews on file
1
immutable, exported to Word
Illustrative figures. Real dashboard.
The output
Everything your certification body will ask for.
Statement of Applicability
Cover page and control-by-control justification across all four Annex A themes. Exported to Word and Excel.
Risk register
Inherent and residual scores with rationale on both sides, control mapping and a treatment register. Word or Excel.
ISMS document set
Policies and records generated from your answers. Every version stored, yours to edit and replace.
Management-review minutes
Immutable per cycle, with the agenda rolled up from the assessment itself.
AI, with a leash
Compliance lives in the nuance. Your team decides what is true for your organisation. Your GRC lead signs off. The scope drafter and the minutes refiner use only the facts in your answers, and are forbidden from inventing numbers, findings, documents or decisions.
The library
Everything is already drafted.
69 templates, so you write none from scratch.
69
document templates
38
worklist items, 31 mandatory
102
risk scenarios, sector-aware
93
Annex A controls
Template · Clause 5
MandatoryInformation Security Policy
The top-level policy your certification body reads first. Merged with your scope and context answers.
Template · Clause 6
MandatoryRisk Treatment Plan
Generated from your live risk register. Treatments, owners and dates, not boilerplate.
Template · Annex A 5.15
RecommendedAccess Control Policy
One of the curated Annex A priority documents in Section B of the worklist.
Who does what
Two roles. One assessment.
Business side
Creator and business liaison
Answer the context questions. Decide applicability. Run the risk register. Upload evidence and own controls. Stages one to four are yours.
GRC side
ISMS manager
Owns the audit panel: findings, notes and required actions on every control. Working alone? Solo mode lets one person hold both roles honestly.
Optional
RegXpert partner
No ISMS manager in-house? Invite a RegXpert into the GRC seat. They review your answers and guide your team.
Each assessment carries one GRC seat and two business seats. Seats are counted live from who actually holds a role. Clear an owner and the seat frees immediately.
Demo video
See a stage end to end.
A short walkthrough of the workspace.
Nineteen context questions and the scope statement they produce
Justifying an Annex A control in the SoA
Scoring and treating a risk from the library
A generated policy, edited and re-uploaded
Pricing
One flat rate per assessment.
Your first assessment is free for its first month, with no card. After that, every assessment carries one flat USD rate, monthly or annual. Cancel any time, effective at the end of the period. Your records remain yours to export.
Per assessment
US$199
per month per assessment
1 GRC seat and 2 business seats
All six stages and every export
AI drafting, evidence storage and the full template library
Annual
US$1,990
per year per assessment
Pay for 10 months, receive 12
Charged up front, no refund of the unused term
Same seats, stages and exports
Maintenance
US$49.00
per month, once complete
25% of the active rate
2 read-only seats for auditors and reviewers
Reopen any time, and the full rate resumes next period
Bringing in an external GRC consultant? That is charged on top of the platform fee: US$1,500 a month during implementation, and on request for ongoing maintenance and surveillance. The rate covers up to 20 hours a month of review and feedback, and depends on the nature of the work.
One USD price in every region. Up to 3 active assessments self-service.
Need more than 3? Contact salesBook a demo
Want to see it on your own scope?
We will walk through the six stages and the documents they produce for an organisation like yours.