ISO/IEC 27001, a management system you can see
The complete path to certification: risks, procedures, Statement of Applicability, internal audits and management review, all in one place.
Who needs ISO 27001
ISO/IEC 27001 is the international standard for the information security management system (ISMS). It is not a legal obligation: it is chosen by companies that find it required in contracts, tenders and customer questionnaires, or that want a recognised method for governing security.
It is also the most widely used reference for demonstrating compliance with obligations such as NIS2 and the GDPR: a well-built ISMS covers much of what those standards require.
Certification is issued by an accredited body after an audit. The work that comes before, and the work that has to continue afterwards, is all yours: and that is what Dottor Box organises.
ISO 27001 checklist: the main requirements
Clauses 4 to 10 describe the management system; Annex A lists the security controls, which in the 2022 version number 93, grouped into organisational, people, physical and technological controls.
- Context of the organisation and scope
- Leadership, security policy, roles and responsibilities
- Risk assessment and treatment (clauses 6.1 and 8.2)
- Statement of Applicability on the Annex A controls
- Competence, awareness and communication
- Documented information, controlled and versioned
- Operational planning and control
- Monitoring, measurement and internal audits
- Management review (clause 9.3)
- Nonconformities, corrective actions and continual improvement
The standard the Compliance module is built on
The self-assessment measures how much is missing. The Compliance and GRC module is modelled on ISO 27001 and covers the entire management system cycle.
| ISO 27001 requirement | How Dottor Box covers it |
|---|---|
| Initial gap analysis | ISO 27001 self-assessment on coverage and maturity, with a simulation of the services to activate |
| Risk (6.1, 8.2) | Risk Assessment in the style of ISO 27005: likelihood times impact, treatment plan, residual risk, dated campaigns |
| Policies and documented information | Compliance and GRC: procedures with an ISO-style cover page, comparable revisions, TLP classification |
| Statement of Applicability | SoA derived from the status of the linked tasks, with the customer's decision always taking precedence; exportable to PDF |
| Internal audits (9.2) | Audit cycles following ISO 19011, with a checklist generated from requirements and controls |
| Nonconformities (10) | Nonconformities opened from findings, with a cycle that does not close if the action is "not effective" |
| Management review (9.3) | Minutes with the inputs and outputs, approved by a person and then unchangeable |
| Awareness and competence | Training with a record of courses, and Cyber Awareness |
| Annex A technological controls | Vulnerability Assessment, Asset Management, Access logs and cloud postures |
| Suppliers | Supply Chain: qualification questionnaires with evidence attached |
An ISMS that keeps working after certification
Risks before and after
The comparison between inherent and residual risk that the auditor asks for, with an owner for every risk.
An SoA that stays aligned
The Statement of Applicability follows the real status of the tasks, and can be exported to PDF when you need it.
Audits that actually run
Checklists built on the standard, results point by point and nonconformities tracked through to closure.
Evidence that expires
Periodic tasks reopen on their own: evidence approved once is not valid for ever.
We have been down the same path ourselves
Dottor Marc, the company that develops and runs Dottor Box, is certified to ISO/IEC 27001 and ISO 9001. The provider of your platform is subject to the same controls the platform helps you build, with periodic audits by an independent body.
For you this counts twice: we know the path from the inside, and when one of your customers asks whether your ICT suppliers are certified, the answer is documented.
Getting certified is not writing procedures: it is proving that internal audits run, that nonconformities get closed and that management carries out its review.
Frequently asked questions about ISO/IEC 27001
How long does ISO 27001 certification last?
The certificate is valid for three years. During that period the certification body carries out surveillance audits, normally once a year, and a recertification audit when it expires. That is why the management system has to stay alive after the first audit too.
Which version of ISO 27001 applies today?
The current version is ISO/IEC 27001:2022. The transition period from the 2013 version ended on 31 October 2025, so certificates to the old edition are no longer valid. In 2024 an amendment was also published that requires climate change to be considered in the context of the organisation.
What is the difference between ISO 27001 and ISO 27002?
ISO 27001 contains the requirements for the management system and is the standard you get certified against. ISO 27002 is a guideline explaining how to implement each of the Annex A controls: it is not certifiable, but it is useful for writing procedures and choosing measures.
Does ISO 27001 help with NIS2 compliance?
A great deal. Risk analysis, incident handling, suppliers, business continuity, access control and training appear in both, so a well-built ISMS covers most of the measures. Some obligations specific to the directive remain, however, such as registration with ACN (Italy's National Cybersecurity Agency) and incident notification within the legal deadlines. NIS2 for important entities.
How often should internal audits be carried out?
The standard requires internal audits at planned intervals, covering the whole management system; many organisations carry out at least one a year. Before the certification audit, the body expects to find at least one completed internal audit cycle and a management review. You will find the list of steps in the ISO 27001 checklist.
The modules that work for ISO 27001
Compliance and GRC
Policies, procedures, audits and evidence for eight frameworks: one piece of work that counts for several standards.
Learn more GovernRisk Assessment
Risk analysis based on ISO/IEC 27005, with a treatment plan and residual risk.
Learn more ProveCompliance documents
SoA, management review minutes, evidence files, audit reports and registers.
Learn more GovernSupply Chain
Supplier assessment with questionnaires completed from a link, no accounts needed.
Learn more GovernTraining
E-learning for your staff, with a record of completed courses ready to show.
Learn more ComplianceISO/IEC 27017
Security controls specific to cloud services.
Learn moreDo you know what someone looking for a target can see of your company?
In a demo on your real systems we show you what is exposed, how much it matters and where to start. Then, if you need it, a tailored proposal.