Run the ISMS the way the standard is written.
Clauses 4 to 10 and the 93 Annex A controls, set out as the registers, reviews and approvals an information security management system keeps, from context and risk through operations to internal audit, management review and improvement.
Supported in
- Book with Jakarta (WhatsApp)
Indonesia · Whitesec ID, Jakarta
Certification programmes with Whitesec ID, alongside ISO 27701 and UU PDP when personal data is in scope.
- Book with Perth (WhatsApp)
Australia · Whitesec AU, Perth
Certification programmes with Whitesec AU, often alongside SOC 2 or Essential Eight work.
About the standard
ISO/IEC 27001 specifies the requirements for establishing, implementing, maintaining and continually improving an information security management system. Certification is granted by an accredited certification body after a Stage 1 and Stage 2 audit, and is kept through surveillance audits across a three-year cycle.
The 2022 edition reorganised Annex A into 93 controls across four themes, and Amendment 1:2024 asks every organisation to decide whether climate change is a relevant issue. Whitesec One records that decision in the scope and checks it as part of clause 4 readiness.
What the workspace does
Clause-by-clause readiness
The dashboard rates clauses 4 to 10 as Ready, Gaps or Not started from fixed checks, such as an approved Statement of Applicability, approved risk criteria, training completion above 80%, and an internal audit and an approved management review within the last 12 months, each with its next action.
Risk register with appetite
A 5x5 likelihood and impact scale (Critical from 16, High from 10, Medium from 5), editable scales seeded from ISO 27005, and an appetite threshold with acceptance criteria approved by a second person. Treatment is Modify, Retain, Avoid or Share, and a risk cannot close while its residual score sits above appetite.
Owner sign-off and review cadence
The risk owner signs off the treatment plan, accepting a risk goes through an approval request, and reviews fall due every 3 months for Critical, 6 for High and 12 for Medium and Low risks.
A Statement of Applicability that stays honest
All 93 controls with applicability, necessity, implementation status, owner and review date. An exclusion needs a real justification, a control named in a risk treatment becomes Applicable automatically, and each approved version is kept as a frozen snapshot.
Registers for every Annex A theme
Assets with classification and confidentiality, integrity and availability ratings, suppliers tiered automatically and assessed through a portal link, an access matrix with review campaigns, people security from joiner to leaver, physical checks, vulnerabilities and change approvals.
Audit, review and improvement
Internal audits with declared independence and a checklist across clauses and controls, findings due in 30, 90 or 180 days by grade, a management review that summarises the ten clause 9.3.2 inputs from the registers, and corrective actions closed only after an independent effectiveness check.
How the workspace runs it
Group by group, in the order the application presents them, with the pages each group contains.
- 01
Context
Scope, boundaries, interfaces and exclusions, internal and external issues including climate change, interested parties and their requirements, processes with a RACI, and the policy library with versioned approval and acknowledgement by audience.
- Scope and context
- Interested parties
- Policies and documents
- 02
Planning
The risk register and its treatment plan, opportunities and periodic assessments, the Statement of Applicability, objectives measured from baseline to target, and the register of legal, regulatory and contractual requirements.
- Risk register
- Statement of Applicability
- Objectives
- Legal and compliance
- 03
Registers
The Annex A registers: assets and their classification, suppliers and their assessments, the access matrix and its reviews, people security, physical sites and checks, and technology controls from vulnerabilities to change management.
- Assets
- Suppliers
- Access matrix
- People security
- Physical security
- Technology controls
- 04
Operations
Incidents from detection to closure with response targets by severity and suggested regulatory notifications, continuity plans tested against their RTO and RPO, and training modules with quizzes and certificates.
- Incidents
- Continuity and DR
- Training and awareness
- 05
Assurance
The internal audit programme through to recertification, management review, findings and corrective actions, the evidence library with independent review, and nine report types with a compliance score and a risk heat map.
- Internal audit
- Management review
- Findings and actions
- Evidence
- Reports
Controls built into the workspace
Rules the application enforces, so the records stand up when an auditor tests them.
- A second person approves risk criteria, each Statement of Applicability version, policies and continuity plans.
- Evidence is accepted only by someone other than the person who collected it.
- A change's approver must differ from its requester, and emergency changes left unapproved are flagged after 5 days.
- A joiner cannot close before screening and signed terms, and a leaver cannot close while access remains.
- An incident cannot close without a root cause, lessons learned and the notifications it requires.
- Records are archived, never deleted, and every change is written to the audit trail.
What you hand the auditor
- Statement of Applicability, versioned
- Risk assessment and treatment plan
- Internal audit reports and checklists
- Management review minutes and decisions
- Corrective action register
- Evidence library with review status
Shared with the other workspaces
Its risk, supplier, incident, document, access review, change and evidence registers are the ones SOC 2 maps to the Trust Services Criteria, and its supplier register also holds the PII processors read by ISO 27701.
Questions about ISO 27001
Does it cover the 2022 edition and Amendment 1:2024?
Yes. The Annex A catalogue is the 2022 set of 93 controls in four themes, and the scope record asks whether climate change is a relevant issue, as Amendment 1:2024 requires.
Can we bring in our existing registers?
Risks, legal requirements, assets, suppliers, objectives and business impact analyses can be imported from CSV files.
Who issues the certificate?
An accredited certification body, after a Stage 1 and Stage 2 audit. Whitesec One keeps the records it examines, and the internal audit programme follows the cycle through to recertification.
See your own registers in Whitesec One.
We walk through the workspaces for the frameworks you need, with the team in Jakarta or Perth.