ISO 27001, with the Statement of Applicability generated

Clauses 4 to 10 and all 93 Annex A controls, adopted as a program with owners, evidence and applicability decisions attached to each one. The artifact your certification body opens first comes out of the live state rather than being maintained beside it.

  • The Statement of Applicability, generated from live state
  • All 93 Annex A controls, with owners and evidence
  • Exclusions carry the justification an auditor will test
  • A scoped certificate modelled as a target, not a caveat

Runs alongside

See ISO 27001 in Cyberwiz

A walkthrough built around your stack, your scope, and the ISO 27001 evidence you have to produce.

We use your details to arrange the demo and follow up about Cyberwiz. Read the privacy policy.

ISO 27001

Organization-wide · 2022 · 92 controls

Adopted
Readiness
86%
Controls in scope
92
Evidence current
212
Open tasks
6

ISO 27001 coverage

4–10The management systemImplemented
A.5Organizational controlsIn progress
A.6People controlsImplemented
A.7Physical controlsEvidence expiring
A.8Technological controlsIn progress
Published by
ISO and IEC
Structure
Clauses 4–10, 93 Annex A controls
Signed by
An accredited certification body
Cycle
Three years, with surveillance audits

  • 01

    Adopt it, don't rebuild it

    Adopt ISO 27001 once for the organization, and again for a product or a region when your certificate is scoped that way. Each program carries its own boundary, its own owners and its own readiness rather than sharing one number.

  • 02

    Evidence with a date on it

    Annex A controls hold evidence with an owner and an expiry. A surveillance audit looks at the year rather than the week before it, so a review that lapses surfaces on the day it lapses.

  • 03

    What the assessor leaves with

    The Statement of Applicability exports from the live program: every control, its applicability, its justification and its status. Your certification body reads the controls in place, scoped to the frameworks and dates you granted them.

What you adopt

ISO 27001, in its own numbering

  • 4–10The management system
  • A.5Organizational controls
  • A.6People controls
  • A.7Physical controls
  • A.8Technological controls

37 organizational, 8 people, 14 physical and 34 technological controls, on top of the clauses that describe the ISMS itself.

What you show

What an assessor will ask to see

  • Risk assessment and treatment plan

    Clauses 6.1.2 and 6.1.3. The method you used, the risks it produced, and what you decided to do about each one.

  • The Statement of Applicability

    Clause 6.1.3 d). All 93 Annex A controls, in or out, each with a reason and a current status.

  • Management review

    Clause 9.3. Minutes that cover the inputs the clause lists, on the interval you said you would hold them.

  • Internal audit

    Clause 9.2. An audit programme, the audits it produced, and the findings closed out.

  • Corrective action

    Clause 10.2. Nonconformities with a root cause, an action, and evidence the action worked.

  • Annex A evidence

    Access reviews, supplier assessments, backups and restores, logging, onboarding and offboarding: the operational proof behind the controls you kept.

How it runs

  1. Step 1

    Adopt ISO 27001

    Your organization gets its own copy of every control in ISO 27001, already mapped to the common controls you may satisfy for something else.

  2. Step 2

    Scope it

    Organization-wide, or against a product, region or business line. Controls you scope out carry the reason you scoped them out.

  3. Step 3

    Collect the evidence

    Connect a system or upload a document. Each piece is read, matched to the control it proves, dated, and given an expiry.

  4. Step 4

    Prove it

    Invite your assessor to these frameworks and these dates, and nothing else. They leave with the Statement of Applicability, generated from the live program.

Book a ISO 27001 walkthrough
See the platform

The standard

What ISO 27001 asks for

ISO 27001 certifies a management system rather than a product. Clauses 4 to 10 describe the ISMS itself (context, leadership, planning, support, operation, evaluation and improvement), and Annex A lists the 93 controls you select from to treat the risks you found.

The 2022 revision reorganised Annex A into four themes: 37 organizational controls, 8 people, 14 physical and 34 technological. Certification runs on a three-year cycle: a Stage 1 documentation review, a Stage 2 audit of the system in operation, then surveillance audits until recertification.

The Statement of Applicability is where the work shows. Every Annex A control is in or out, each exclusion carries a justification an auditor has to accept, and the document has to agree with what the rest of your system actually does, which is exactly the agreement a spreadsheet maintained on the side cannot hold.

Questions

Do we have to implement all 93 Annex A controls?
No. You select controls to treat the risks your assessment found, and exclude the rest with a justification recorded in the Statement of Applicability. What an auditor tests is whether the exclusions are defensible, not whether the list is complete.
Can one certificate cover only part of the company?
Yes, and most do. The scope statement on the certificate is the boundary. Cyberwiz models that as a target (a product, a business line, a region), so the program, its controls and its readiness are counted over that boundary rather than over everything you run.
Does ISO 27001 evidence count towards SOC 2?
Most of it. Both frameworks sit on the same common controls here, so an access review, a supplier assessment or a backup test is done once and counts against every framework control that references it.

Also supported

Provable today, not at audit time.

Run it yourself or have Bindsec run it for you. Either way, the evidence is current and the posture is one place.

Get a demo
Open the app