ISO/IEC 27001 is the international standard for an Information Security Management System (ISMS). Certification is issued by accredited certification bodies after an audit.
ISO/IEC 27001 is the leading international standard for an Information Security Management System (ISMS) — a documented, risk-driven way of managing the security of information across people, processes, and technology. Unlike SOC 2, it results in an actual certification issued by an accredited certification body after a two-stage audit. The 2022 revision modernized Annex A into 93 controls across four themes and added attributes to help organize them.
Certification involves a Stage 1 (documentation) and Stage 2 (implementation) audit, followed by surveillance audits in the following years and recertification on a three-year cycle. Plan for an operating period long enough to demonstrate the ISMS is genuinely running.
Public information about the framework itself. We don't claim certifications, assessment status, or authorizations for our own product.
How the platform supports your ISO/IEC 27001 program — from first scope to ongoing monitoring.
Establish the boundaries of your ISMS and document the context, interested parties, and objectives.
Maintain a risk register that drives which Annex A controls you select and feeds your Statement of Applicability.
Map the selected controls to tests and evidence, reusing anything already collected for SOC 2.
Track ISMS activities, internal audits, and continual improvement so the program is demonstrably alive at audit time.
Public, high-level control or requirement areas — for orientation, not a complete control list.
ISO/IEC 27001 shares controls with frameworks you may already run. A passing test can satisfy requirements in more than one place — so adding the next framework means reusing work, not repeating it.
ISO 27001 is a certifiable management-system standard with a certificate from an accredited body; SOC 2 is a CPA attestation report. Their security controls overlap heavily, so evidence is largely reusable.
The 2022 revision lists 93 controls organized into Organizational, People, Physical, and Technological themes.
The SoA documents which Annex A controls apply, why, and their implementation status — it is a central artifact auditors review.
Get a guided demo, or start by scanning any domain for free.