ISO 27001 readiness software for SMEs — audit-ready without the four-month project
You have a deal gated on ISO 27001, a team of five to fifty, and no ISMS manager. This is the workspace that takes you from a blank page to a Stage 2 audit: risk register, Annex A controls, policies, Statement of Applicability and evidence — one shared register, one shared control catalogue, one evidence base.
The certificate isn't the hard part. Assembling consistent evidence with a day job is.
- Procurement wants the certificate this quarter, and the CTO is also the de facto ISMS manager.
- Risk lives in one spreadsheet, controls in another, policies in a shared drive — and the Statement of Applicability reconciles to neither.
- Enterprise GRC quotes land at five or six figures with a four-month implementation and a consultant on retainer.
- Nobody knows which of the 93 Annex A controls are actually in scope, or what evidence the auditor will ask for.
See the workspace in 24 seconds
A single pass through the workspace: create risks, treat them with Annex A controls, attach evidence, and export the Statement of Applicability and management review pack your auditor expects.
- 1Risk register
Score inherent and residual risk on the 5×5 model, pick one of the four Ts, set an owner and a review date.
- 2Annex A control catalogue
All 93 ISO 27001:2022 controls pre-loaded. Mark in or out of scope with a justification — that justification becomes your SoA.
- 3Policy library
Clause 4–10 policies plus topic policies, with AI guided fill for the organisation-specific sections and branded PDF export.
- 4Evidence vault
Attach access reviews, scan reports, training records and supplier reviews to the exact control they evidence.
- 5Control health & Fix it
See which controls are failing or stale, then generate a plain-English remediation plan with owner, priority and suggested evidence.
- 6Audit & management review
Plan internal audits, log findings, drive CAPAs, and export the clause 9.3 management review pack.
Spreadsheets vs ISO-STANDARD.app
| The job | Spreadsheets & shared drive | ISO-STANDARD.app |
|---|---|---|
| Risk register | One tab per year, formulas drift, no history of who changed a score. | Versioned register with owners, review dates and an append-only audit trail. |
| Statement of Applicability | Hand-maintained and out of sync with the register by audit week. | Assembles itself from your in/out-of-scope decisions and justifications. |
| Evidence | A folder of screenshots nobody can map back to a control. | Evidence attached to the control it proves, with dates and expiry reminders. |
| Policies | Version confusion — v3_final_FINAL.docx. | Single source of truth with approver, effective date and acknowledgement tracking. |
| Audit week | Someone reconciling four files at 2am. | Export the pack; every claim traces risk → control → policy → evidence. |
Spreadsheets are fine for a 10-risk pilot. They stop being fine the moment an auditor asks for traceability.
Score your ISO 27001 readiness in about 20 minutes — free
Start a workspace, load the Annex A:2022 catalogue and mark what you already have in place. Control Health scores your gaps immediately, so you get a real readiness picture instead of a sales-qualified questionnaire.
- Annex A coverage: implemented, partial, missing
- Mandatory clause 4–10 documents you still owe
- Risk register maturity and treatment coverage
- Evidence gaps ranked by audit impact
What it costs
Published pricing, monthly, cancel any time. No 'contact sales' wall.
First ISMS: risks, assets, controls, policies.
Audit programme, CAPA, SoA, Trust Center and AI ‘Fix this’ remediation.
Microsoft 365 evidence automation, Jira and service-desk integrations, SSO.
Full feature-by-feature breakdown on the pricing page. No sales call required to start.
I've spent 25 years aligning technology, controls and compliance with what the business is actually trying to do — mostly for organisations without a GRC department. Every screen in this product exists because an auditor or an enterprise buyer asked for it, and nothing exists because it demoed well.
Read the founder storyWhere to go next
Compare the wider platform on ISO 27001 software, see the full GRC workspace, or read the certification cost guide.
Answers buyers, procurement and auditors want
How long does ISO 27001 readiness take with this?+
Most SMEs reach a credible Stage 1 position in 30–60 days and Stage 2 in 60–120 days, depending on how much evidence already exists. The workspace is usable the hour you sign up — there is no implementation project.
Do you issue the certificate?+
No. Certification is issued by an accredited certification body after Stage 1 and Stage 2 audits. This platform gets your ISMS, evidence and exports into the shape those auditors expect.
Is the readiness assessment really free?+
Yes. You start a workspace, load the Annex A catalogue and get your gap score without a sales call or a card.
Can we move off spreadsheets we already maintain?+
Yes — CSV import with templates covers risks, assets, controls, policies and evidence, so your existing register comes across in minutes.
Start your ISO 27001 readiness today
Load the catalogue, score your gaps, and see exactly what stands between you and a Stage 2 audit — before you spend a penny on a certification body.
Prefer a conversation? Email hello@iso-standard.app — a practitioner responds within one business day.