ISO/IEC 27001:2022
Go into your certification audit with the evidence in place
The audit is in March and the evidence is spread across ten folders. In Almenara every control has its evidence, its owner and its date, and you know what is missing before the certification body’s auditor arrives.
Who it’s for
For organisations that want to certify their information security management system (ISMS), keep the certificate year after year or, without certifying, use the standard as a guide to put their security in order.
- Organisations of any size and sector certifying for the first time
- Certified organisations that want to move off spreadsheets
- Technology providers whose customers require the certificate
If this sounds familiar
Every audit is a week chasing evidence in folders and spreadsheets.
Your whole information security management system (ISMS) in one place, with the evidence ready when you are asked for it.
What ISO 27001 requires
The standard rests on clauses 4 to 10 and the 93 controls in Annex A. These are the points where most hours go:
- Clauses 6.1.2 and 8.2Risk assessment
- Identify, analyse and evaluate information security risks in a repeatable way, and review them at planned intervals.
- Clause 6.1.3Statement of Applicability
- Justify which Annex A controls apply and which are excluded, and the status of each one.
- Controls 5.19–5.23Suppliers and cloud
- Security in supplier relationships, agreements, the ICT supply chain and the use of cloud services, with ongoing monitoring.
- Controls 5.24–5.28Incidents
- Plan incident management, assess events, respond, learn from what happened and preserve evidence.
- Controls 5.29–5.30ICT continuity
- Maintain security during disruption and keep ICT ready for business continuity.
- Clauses 9.2 and 9.3Internal audit and management review
- Audit the system at planned intervals and have management review it with real data.
Platform · modules
How Almenara helps with ISO 27001
The modules that save you the most work, in order.
- ComplianceRisk, Statement of Applicability, internal audit, nonconformities and management review.
- Third partiesControls 5.19 to 5.23: inventory, criticality, questionnaires and monitoring of suppliers and cloud services.
- IncidentsControls 5.24 to 5.28: logging, response, lessons learned and evidence.
- ContinuityControls 5.29 and 5.30: BIA, plans and ICT continuity tests.
Framework catalogue
What you prove for ISO 27001 counts for the next framework
Every ISO 27001 requirement is mapped to Almenara’s common controls, like the rest of the catalogue. When you are asked for another framework or a customer’s questionnaire, you start from what you have already proven.
Service · where to start
Pre-certification audit
We review your ISMS the way the certification auditor would and give you a findings report to fix before the real audit. If you haven’t started yet, the first step is a gap analysis against the standard.
Request a pre-certification auditRecommended services
- Service · Once
Gap analysis against a framework
We measure where you stand against ISO 27001, the ENS or DORA and what you still need to comply.
- Service · Every year
The annual risk assessment of your security system, with MAGERIT and PILAR when it is for the ENS.
- Service · Every year
We audit your system the way the certification body would, so you can fix things before the real audit.
Our boundary: Almenara does not issue certificates (accredited certification bodies do) and does not carry out the internal audit of a system it has implemented or manages.
ISO 27001 FAQ
- Does Almenara issue the ISO 27001 certificate?
- No. The certificate is issued by an accredited certification body. Almenara helps you implement and maintain the ISMS and reach the audit with everything ready.
- Does it work for the 2022 version of the standard?
- Yes. We work with the ISO/IEC 27001:2022 structure and its 93 Annex A controls, grouped into organisational, people, physical and technological controls.
- Can I import my Statement of Applicability and risk assessment from spreadsheets?
- Yes, with the data migration service: we bring into the platform what you have in spreadsheets or another tool.
- Do you also do the internal audit?
- Yes, as long as we are not the ones who implemented or manage that system: an auditor cannot audit their own work.
Shall we prepare for ISO 27001 together?
We’ll show you what your system would look like in Almenara, with your own data.