Spreadsheet
Suitable at an early stage in a small organization. Document versions, review dates and evidence, however, require manual oversight, and the auditor receives many separate files.
ISO 27001
ISO 27001 software
Guardiso is a European GRC platform for implementing and maintaining an information security management system that conforms to ISO 27001. It covers all 93 Annex A controls, the risk register, the Statement of Applicability with justifications, policies and procedures in English and Polish, and the evidence for the audit. The controls are linked to the requirements of NIS2 and DORA, so the same work is not done twice.
What to expect from ISO 27001 software
The standard sets out management system requirements in clauses 4 to 10 and 93 controls in Annex A. The software should cover both, from defining the scope of the system to the evidence for the auditor.
- The scope of the system and the context of the organization (clause 4).
- Risk assessment and a risk treatment plan with acceptance criteria (clauses 6.1.2, 6.1.3, 8.2 and 8.3).
- A Statement of Applicability: a decision and a justification for each of the 93 controls.
- Policies and procedures with versions and approval (clause 7.5).
- Evidence that the controls are effective, ideally collected directly from the tools the organization uses.
- Internal audit, management review and corrective actions (clauses 9.2, 9.3 and 10.2).
- Access to the documentation for the certification body auditor, without sending files by email.
Spreadsheet, document pack or GRC platform
The choice depends on the size of the organization and on who will maintain the system after certification.
Document pack from a consultant
Supports the preparation for the first audit. Maintaining the system after certification, including reviews, the assessment of new risks and evidence for surveillance audits, remains with the organization.
GRC platform with ISO 27001
Brings together the requirements and controls of the standard, the risk register, the Statement of Applicability, documents and evidence in one place, with links to other standards. Guardiso is a platform of this kind.
What to ask a vendor before you buy
- Does the software hold all 93 controls of the 2022 edition and the requirements of clauses 4 to 10?
- Does the Statement of Applicability include a justification for each control?
- Are the documents available in English and Polish, and can they be edited?
- Which tools does the software collect evidence from?
- Can the auditor review the documentation directly in the software?
- Where is the data stored and who has access to it?
- Is the price list public, and can the software be tested without a sales call?
ISO 27001 in Guardiso
- The 93 Annex A controls of ISO 27001:2022 with descriptions and implementation status.
- A Statement of Applicability with a justification for each control, ready for the audit.
- Policies and procedures in English and Polish. The Guardiso assistant prepares drafts, which are approved by the responsible person.
- Evidence collected from tools such as AWS, Azure, Google Workspace and GitHub.
- Internal audit, management review and a portal for the certification body auditor.
- Controls linked to the requirements of NIS2 and DORA.
- Guardiso is ISO 27001 certified. We kept the documentation for our own audit in Guardiso.
- Data stored in the European Union. A free 14-day trial, with no payment card and no contact with sales required.
Questions and answers
Which ISO 27001 software should a small company choose?
Guardiso is a European GRC platform that covers all 93 ISO 27001 controls, the risk register, the Statement of Applicability, documents in English and Polish and the evidence for the audit. The free 14-day trial can be started without a payment card.
Can you prepare for ISO 27001 certification in a spreadsheet?
Yes, especially in a small organization. The difficulty arises after certification, when reviews, the assessment of new risks, document versions and evidence for surveillance audits require manual handling.
Does the software replace the certification body?
No. The certificate is issued by an accredited certification body after an audit. The software keeps the documentation and evidence in order so that the audit runs smoothly.
Does ISO 27001 help with NIS2?
Yes. Many of the risk management measures in Article 21 of NIS2 match ISO 27001 controls, such as risk analysis, incident handling, business continuity, cryptography and access control. Guardiso shows which requirements the organization already meets and supports the implementation of the rest.
How much does Guardiso cost?
Prices are published on the pricing page. The free 14-day trial can be started without a payment card.
Implementing ISO 27001 in Guardiso
The free trial lasts 14 days. The organization can also assess its preparation for certification with the free readiness check.