Manage ISO 27001 in one structured ISMS

ISO 27001 Clause 4.3 requires organisations to define the scope of the ISMS by considering internal and external issues, interested party requirements, and interfaces and dependencies. The scope document sets the boundary of the ISMS, specifying which parts of the organisation, systems, and locations are covered. A clear scope is a prerequisite for certification. ISOPlanner™ includes a scope definition template that guides you through the Clause 4 context analysis step by step.

The Statement of Applicability is a mandatory document under ISO 27001 Clause 6.1.3 that lists all 93 Annex A controls, states whether each is applicable or excluded, and provides the justification. The SoA bridges risk assessment and control implementation, and is always the first document auditors request. In ISOPlanner™ you can generate and maintains the SoA as controls are implemented and risk treatment decisions are recorded.

ISO 27001 Clause 6.1 requires identifying information security risks, analysing and evaluating their likelihood and impact, and producing a risk treatment plan that addresses accepted risks. Organisations must define their own risk assessment methodology and apply it consistently. ISOPlanner™ provides a built-in risk register and treatment plan that walks you through the full risk process and links each risk to the relevant Annex A controls.

Corrective action (Clause 10.1) addresses identified nonconformities: finding root causes, implementing fixes, and verifying effectiveness. Continual improvement (Clause 10.2) is an ongoing commitment to enhance the ISMS over time, driven by monitoring results, internal audits, and management reviews. ISOPlanner™ provides a nonconformity register for corrective actions and an annual improvement plan linked to management review outputs.

For most organisations starting from scratch, the full journey takes six to twelve months: gap assessment, risk assessment, control implementation, internal audit, management review, and a two-stage certification audit. Organisations with strong existing security practices or an ISO 9001 base can move faster. ISOPlanner™ accelerates the process with pre-built templates, automated evidence collection, and a structured implementation roadmap.

ISO 27001 Clause 9.3 requires top management to review the ISMS at planned intervals. The review must cover ISMS performance, risk assessment results, audit findings, stakeholder feedback, incidents and nonconformities, and opportunities for improvement. Auditors look for direct evidence of management engagement. ISOPlanner™ includes a management review template that captures all required inputs and outputs in a single session.

Certification is not a one-time event. ISOPlanner™ keeps your ISMS active between audits by automating evidence collection across all 93 Annex A controls, scheduling internal audit cycles, tracking corrective actions and their deadlines, and generating management review inputs. Surveillance audits are required in years 1 and 2, with recertification in year 3. ISOPlanner™ ensures your ISMS stays audit-ready throughout the full three-year cycle.