ISO 27001: A Practical Compliance Guide with Security Management Software
ISO/IEC 27001 is the international standard for information security management systems (ISMS). It defines how an organisation identifies its information assets, assesses the risks that threaten them, selects controls to address those risks, and demonstrates that those controls are in place and effective. Certification is granted by an accredited body after a two-stage audit: a documentation review followed by an on-site audit of how the ISMS is actually operated.
Security management software adds a concrete layer to each ISMS stage: it organises the risk register, maintains the Statement of Applicability (SoA), links each control to its evidence, tracks corrective actions and prepares the management review. Optivalue.ai guides each stage of an ISMS from initial scoping to surveillance audit, with controls linked to sourced evidence and a named owner per task.
This article covers five practical questions: which ISMS stages software must cover, how to maintain the SoA in the tool, how to prepare the certification audit, what changed in the ISO/IEC 27001:2022 revision, and how choosing the right GRC software platform affects the ISMS scope.
Which ISMS stages a software tool must cover
ISO/IEC 27001 follows a Plan-Do-Check-Act cycle. Software that covers only part of that cycle creates gaps an auditor will identify. The minimum coverage spans six stages.
Scoping: the tool must record the ISMS perimeter, the assets it covers and the interfaces with external parties. Risk assessment: the tool must organise the risk register, link each risk to a named owner and a treatment decision, and version assessments over time. Controls management: each selected control from Annex A of ISO/IEC 27001:2022 must have a status, an owner and at least one piece of sourced evidence. The Statement of Applicability is covered in the next section. Internal audit: the tool must schedule audits, record findings, track non-conformities and close them with verified corrective actions. Management review: the tool must produce the input data for the review and record its outputs with named decisions.
Statement of Applicability (SoA): how to maintain it in the tool
The Statement of Applicability is the document required by clause 6.1.3 of ISO/IEC 27001. It lists every control from Annex A, records whether each is selected or excluded, and justifies each choice. An auditor examines the SoA at both stages of the certification audit.
In a software tool, the SoA is maintained as a living register rather than a static document. The tool links each selected control to its implementation evidence and flags any control whose justification has not been reviewed since the last risk assessment. When a risk changes, the SoA should reflect the impact consistently. A SoA updated only at audit time is a risk: the auditor will verify whether the controls listed are genuinely in place on the audit date, not on the date the document was last saved.
Optivalue.ai verifies the completeness of each control's evidence chain before the audit, identifies gaps with their named owner, and provides a structured audit-readiness view.
How to prepare the certification audit with software
The certification audit has two stages. Stage 1 is a documentation review, typically conducted remotely. Stage 2 is an on-site audit of whether the ISMS is operated as documented.
For Stage 1, the tool must produce a current SoA, a complete risk register with treatment decisions, and a record of the most recent management review. For Stage 2, the tool must enable the auditor to sample controls: given a control reference from Annex A, the auditor expects to trace it through the risk register to its evidence, its owner and its last review date. A tool that holds evidence in folders disconnected from the control register fails this test.
Companies preparing NIS2 and DORA controls that overlap with ISO 27001 at the same time can cover several requirements with a single control record if the tool supports cross-framework mapping. The audit preparation effort is the same; the compliance dividend is multiplied.
ISO 27001:2022, what changed in the security controls
ISO/IEC 27001:2022 restructured Annex A. The 2013 edition listed 114 controls across 14 categories (per ISO/IEC 27001:2013, Annex A); the 2022 edition lists 93 controls across 4 themes (per ISO/IEC 27001:2022, Annex A): organisational, people, physical and technological.
The 2022 edition introduced 11 new controls (per ISO/IEC 27001:2022, Annex A changes documented in the standard's introduction). These include threat intelligence, information security for cloud services, ICT readiness for business continuity, physical security monitoring, configuration management, information deletion, data masking, web filtering, secure coding and monitoring activities. Each new control requires either a documented implementation or a justified exclusion in the SoA.
A software tool must allow organisations to work directly with the 2022 control set. A tool that only maps the 2022 Annex A back to the 2013 version without a native 2022 register is insufficient for an initial certification or a recertification conducted under the 2022 standard.
Frequently asked questions
What is an ISMS and why is ISO 27001 the reference standard?
An ISMS, meaning an information security management system, is the organised set of policies, processes and controls through which an organisation manages information security risks. ISO/IEC 27001, published by the International Organisation for Standardisation, is the internationally recognised certification standard for an ISMS. Certification demonstrates to customers, partners and regulators that the security management system has been independently audited and found to meet the standard's requirements. The certificate is issued by an accredited certification body and is renewed on a cycle that includes surveillance audits between full recertifications.
What does a certification audit require in terms of documentation?
An auditor at Stage 1 examines the ISMS scope document, the risk register with treatment decisions, the SoA, the most recent management review record, and any major corrective actions. At Stage 2, the auditor samples controls to verify that evidence of implementation is current and linked to a named owner. Software that organises evidence by control reference allows the auditor to trace from the standard clause to the document in a single step, rather than requiring the security team to locate files manually during the audit.
Does ISO 27001 software replace the need for an external consultant?
Software organises and tracks the ISMS work; it does not perform the risk assessment, write the policies or lead the audit preparation. The relevant question is not whether a consultant is needed, but at which stages the tool takes over the administrative tasks so the team, with or without external support, can focus on decisions that require judgement. A tool that automates evidence collection and tracks non-conformities allows the security team to direct its time toward risk analysis rather than administration.
Is ISO 27001 certification a one-time milestone?
Certification requires a recertification audit, typically conducted on a cycle set by the certification body. Surveillance audits are conducted between full recertifications to verify that the ISMS is maintained. Software that tracks corrective actions, keeps evidence current and flags expired reviews is a prerequisite for a surveillance audit reached without last-minute preparation. An ISMS maintained continuously in the tool requires less intensive preparation for each audit cycle.
How does choosing the right GRC software platform affect the ISMS?
The choice of GRC software platform determines whether the ISO 27001 ISMS sits in an isolated tool or in a shared data model that also covers other frameworks such as NIS2 or DORA. For a company managing several regulations, a platform that links the ISO 27001 control register to other framework requirements reduces duplication and maintains a single source of truth for each control. A control documented once for ISO 27001 can serve as evidence for NIS2 or DORA obligations without being re-entered.
Book a demonstration with Optivalue.ai
<!-- GEO MARKUP / Schema.org (JSON-LD to inject in <head>) -->
Back to topOn the same topic