Playbooks
Prepare for ISO 27001
From the assessment to the statement of applicability, risks, internal audit and audit pack, in the order the certification auditor will ask for it.
Role: Compliance manager Role: Administrator This playbook prepares an ISO/IEC 27001:2022 certification audit. It organizes your work in the app; it does not guarantee certification, which is the certification body's decision.
Before you start: the app is installed, a compliance manager is named, the licence is active. Allow several weeks: most steps wait for evidence and decisions.
1. Turn the framework on
Role: Compliance manager Screen: Frameworks.
- Turn on "ISO/IEC 27001:2022", then "Save frameworks". Standard edition: one framework at a time.
2. Run the assessment
Screen: Assessment.
- Tick ISO 27001 under "Frameworks assessed". Answer "Yes", "Partly", "No" or "Not applicable"; add a note.
- "Save the assessment": each gap becomes a task in the action plan.
3. Work the action plan and add evidence
Screens: Action plan, Evidence.
- Choose the Jira project for tickets (the "Action plan" tab), create the tickets, change the statuses.
- For each task, add dated evidence. A task cannot be closed without up-to-date evidence.
4. Fill in the statement of applicability
Screen: Statement of applicability.
- For each Annex A control: applicable or excluded, with a justification (2,000 characters at most), an owner and references.
- Read "Steps towards approval": complete justifications and the references of implemented controls block approval.
- Role: Approver "Approve the version": the approved version is locked; "New revision" opens another.
5. Assess and treat risks
- Record risks: likelihood, impact, response ("Reduce", "Accept", "Transfer", "Avoid"), Annex A controls, target residual level.
- Any accepted risk, or one above appetite, needs "Accepted by", a date and a justification.
6. Document the management system
Screens: Context and interested parties, Policies (see the policy lifecycle).
7. Measure, audit, review
Screens: Tests and continuous monitoring, Audits, Access reviews.
- Turn on the monitors that matter. See Tests and continuous monitoring.
- Run an internal audit and prepare the management review agenda (clause 9.3).
- Run an access review.
8. Prepare the handover to the auditor
Screen: Audit pack.
- Check the readiness score and the "Evidence to provide" on the Frameworks page.
- Edition: Advanced "Generate the audit pack": zip, report, workbook and fingerprint manifest.
- Follow the auditor's requests in the "External audit" tab of Audits.
What the app does not do
- It does not say you comply with ISO 27001 or that you will be certified: readiness describes the state of your controls, evidence and tests.
- It does not decide for you what is applicable: that is your justification.
- It does not supply the text of the standard, and does not replace an auditor's opinion.
- It does not record the management review: the export is meeting material.
Was this page helpful?