ISO 27001:2022 requires 14 documents and records. See which ones Stage 1 reads first, the 3 tied to a named approver, and the Annex A extras your SoA adds.
ISO 27001 management review template: 10 agenda items mapped to the evidence behind each, the 2022 input auditors often find skipped, and NIS2 Art. 20 rows.
Vanta, Drata and ISMS.online automate evidence, not decisions: the 6 ISO 27001 choices you still own, Vendr’s $20K–$25K median prices, and when templates win.
Stage 1 can halt your ISO 27001 audit; a major not verified 6 months after Stage 2 forces a new Stage 2. Go/no-go checklists and a certification body check.
ISO 27001 information security policy template: clause 5.2’s seven requirements, the A.5.1 policy set, and the NIS2 elements a 5.2-only policy misses.
Article 14 names 8 documents due now, even for legacy products; Annex I Part II waits until 11 Dec 2027. A CRA template map, plus what a pack can’t cover.
CRA vulnerability handling requirements: Annex I Part II’s 8 duties set no deadline in days. Turn them into a 7-step PSIRT procedure with owners and records.
ENISA single reporting platform, screen by screen: register in six steps, why your deputy waits for CSIRT verification, and the private-draft trap to avoid.
Only one CRA duty applies today, and it reaches products you no longer sell. This CRA compliance checklist splits 25 items into due now vs 11 December 2027.
CRA for non-EU manufacturers: Article 18 makes the authorised representative optional, but Article 14(7)’s four-step ladder fixes which CSIRT gets your report.
