Openlane
ISO 27001 logo

ISO 27001 compliance

Run your ISMS from one record: the risk register, the Statement of Applicability, and the 93 Annex A controls, each connected to the evidence behind it.

No credit card. 30-day free trial.

An ISMS your auditor can read end to end

Build the ISMS once and let the Stage 2 auditor find each control's evidence where you left it, with the same controls serving SOC 2 and every other standard that shares them.

ISMS documentation

Start from templates for the documents ISO 27001 requires, from the scope statement and information security policy to the risk methodology and Statement of Applicability, and link each one to the controls it governs.

  • Policy and procedure templates
  • Each document linked to the controls it governs

Risk assessment

Keep one risk register for the ISMS. Score each risk by impact and likelihood, record the treatment decision and its rationale, and watch the residual score move as remediations close.

  • Impact-and-likelihood scoring
  • Treatment decisions kept with their rationale

Annex A control tracking

Track all 93 Annex A controls across the four themes of ISO 27001:2022, each with an owner, a written implementation, and the evidence behind it.

  • Organizational, people, physical, and technological themes
  • Owner and implementation on every control

Evidence management

Connect AWS, GCP, and Azure, push from your pipeline with the Openlane client, or upload by hand for controls that live offline. Every artifact stays tied to the control it demonstrates.

  • AWS, GCP, and Azure integrations
  • Renewal dates on every artifact

Certification audit support

Walk into Stage 1 and Stage 2 with the evidence organized by control, and give your auditor a read-only role instead of an export folder.

  • Auditor access (read-only role)
  • Evidence export on request

One ISMS, several standards

Most Annex A controls have a counterpart in SOC 2, NIST CSF, or PCI DSS. Map each control once and the same evidence satisfies every framework that shares it, at no added charge per standard.

  • Cross-framework control mapping
  • Unlimited frameworks, no per-standard fee
Part of Compliance

Build the ISMS your certification body will audit

Define your scope and connect each Annex A control to its evidence before Stage 1.

Request a Framework

No credit card. 30-day free trial.

Frequently asked questions

ISO 27001 basics

What is ISO 27001?

ISO/IEC 27001:2022 is the international standard for an Information Security Management System (ISMS). It sets out how an organization identifies information security risks and manages them through people, processes, and technology. It is published jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC).

Who needs ISO 27001 certification?

Any organization that handles sensitive information benefits from an ISMS, and certification is often a contractual expectation for companies operating internationally, government contractors, healthcare and financial services organizations, and B2B SaaS companies selling into European markets.

What is an Information Security Management System (ISMS)?

An ISMS is the set of policies, procedures, and controls an organization uses to manage information security risk. It includes the risk assessment process, security policies, asset management, access control, incident response, and the review cycle that keeps it improving. ISO 27001 specifies the requirements for establishing, operating, and improving one.

How is ISO 27001 different from SOC 2?

ISO 27001 is an international standard for a management system and results in a certificate issued by an accredited certification body. SOC 2 is an AICPA attestation framework in which a CPA firm reports on your controls against the Trust Services Criteria. ISO 27001 is more prescriptive about risk management; SOC 2 is scoped to the criteria you select. Many companies pursue both, and most controls serve both.

Certification process

How long does ISO 27001 certification take?

The timeline depends on the scope of the ISMS, the size of the organization, and how much of the program already exists. The path runs through gap assessment, ISMS implementation, an internal audit, management review, and the Stage 1 and Stage 2 certification audits. Certificates are valid for three years, with surveillance audits each year in between.

What are the main phases of ISO 27001 implementation?

Start with a gap analysis against the standard. Design the ISMS: policies, procedures, and the risk treatment plan. Implement the controls and train staff. Run an internal audit to verify the ISMS works. Hold a management review. Then the accredited certification body performs the Stage 1 and Stage 2 audits.

What is Annex A and why is it important?

Annex A of ISO 27001:2022 lists 93 controls in four themes: organizational, people, physical, and technological. You select the controls your risk assessment calls for and justify any you exclude. That reasoning becomes the Statement of Applicability (SoA), one of the documents the auditor reads first.

What evidence is required for ISO 27001?

The standard requires documented information including the ISMS scope, the information security policy, the risk assessment methodology and results, the Statement of Applicability, the risk treatment plan, competence records, operating procedures, monitoring results, internal audit reports, management review records, and corrective action records. In Openlane, each document links to the controls it governs and each control carries its own evidence.

Openlane for ISO 27001

How does Openlane help with ISO 27001 compliance?

Openlane holds your ISMS in one record: the risk register, the Statement of Applicability, and each Annex A control with its owner and evidence. When the Stage 2 auditor asks how a control operates, the implementation and the proof are already attached. The certification decision stays with the certification body.

Can Openlane help with both ISO 27001 and SOC 2?

Most Annex A controls have a counterpart in the Trust Services Criteria, so a control you implement once can be mapped to both and its evidence serves both. Adding SOC 2 to an existing ISMS expands the program instead of restarting it, at no added charge per standard.

Does Openlane support the risk assessment process?

Openlane keeps your risk register, scores each risk by impact and likelihood, records the treatment decision with its rationale, and shows the residual score as remediations close. The history of each risk stays on the record, which is what an auditor asks for when testing the risk-based approach ISO 27001 requires.

© Copyright theopenlane, Inc. All Rights Reserved.

Openlane on Product Hunt
California Consumer Privacy Act (CCPA) Opt-Out IconYour Privacy ChoicesNotice at Collection