ISO 27001:2022 Documentation Toolkit

Description

Every mandatory document ISO/IEC 27001:2022 requires — and the audit system that proves your ISMS actually runs. 71 editable templates, a Statement of Applicability pre-loaded with all 93 Annex A controls, and the internal-audit and management-review packs that take you through Stage 1 and Stage 2.

The blank-page problem, solved

Most ISO 27001 projects stall in the same place: not the firewall settings, but the documentation. The standard requires documented information for every management-system clause — scope, policy, risk methodology, objectives, competence, audits, management review — plus a justified decision on every one of the 93 Annex A controls. Written from scratch, that is months of work before your first internal audit. Written badly, it is the reason Stage 1 audits come back with a list of nonconformities.

This toolkit gives you the complete documented skeleton of a certifiable ISMS: you adapt documents to your organisation instead of writing them, and every template tells you which clause or control it satisfies and what the auditor will look for.

What’s inside — 71 templates + 10 implementation guides

Built for the audit, not just the binder

Certification bodies do not certify binders — they sample evidence that your ISMS operates. That is why this toolkit ships as a working system, not a document dump:

• Gap analysis that scores itself. 20 clause requirements + all 93 controls, with maturity and severity dropdowns and an auto-calculated gap score (0–25) and maturity dashboard — your prioritised roadmap in one afternoon.
• An internal audit you can actually run. The mandatory clause 9.2 cycle comes complete: programme, plan template with auditor-independence check, 60 paraphrased auditor questions tagged to clauses and controls, conformance scoring, report template.
• Management review with no missing inputs. The agenda and minutes are structured around every input clause 9.3.2 names — the classic minor nonconformity, designed out.
• A go/no-go gate before you pay for an audit. The certification-readiness checklist walks the mandatory-document list and Stage 2 evidence pack so you book the audit when you are ready — not before.

Every mandatory document, covered

Bonus: the NIS2 bridge (included free)

If your organisation also falls under the NIS2 Directive, the included NIS2–ISO 27001 Delta & Mapping Pack maps every NIS2 Article 21 measure to its ISO clause and Annex A controls in both directions, and gives you the action plan for either journey — ISO-certified adding NIS2 compliance, or NIS2-compliant heading for certification. We publish compliance template libraries for both frameworks; this bridge exists nowhere else in this form.

Toolkit vs. the alternatives

Honest note: a toolkit replaces the drafting, not the implementing. You still operate the controls, run the audit cycle and generate real records — the toolkit is built to make exactly that operating work visible and audit-sampleable.

See the quality before you buy

Download three complete files from the toolkit — no email required:

• Implementation Guide (Word) — the phased path from zero to Stage 2
• ISMS Scope Statement (Word) — clauses 4.1–4.4 with interested-parties tables
• Competence Matrix (Excel) — the clause 7.2/7.3 records workbook

<!– REVIEWED-BY SLOT: intentionally empty at launch (founder decision D1).
When a real reviewer is contracted, insert:

Independent review: [NAME], [CREDENTIAL] — [DATE]

–>

Frequently asked questions

Does this guarantee certification?

No, and be wary of anything that claims to. Certification is granted by an accredited certification body after Stage 1 and Stage 2 audits of your implemented ISMS. This toolkit gives you the complete, correctly structured documentation and the evaluation system (audits, reviews, measurements) auditors sample — the implementing is yours.

Is the text of the ISO standard included?

No. ISO/IEC 27001:2022 is copyrighted; you purchase it from ISO or your national standards body. The templates paraphrase the requirements, tell you which clause each document satisfies, and never reproduce the standard’s text.

Which version of the standard does it follow?

ISO/IEC 27001:2022 — the current version, with the 93-control Annex A (organizational, people, physical, technological themes). It is not a 2013-control-set toolkit with a new cover.

How is this different from the NIS2 toolkit you sell?

They are different management frameworks with different documents: NIS2 is EU law with notification duties and penalties; ISO 27001 is a certifiable management-system standard. This toolkit is ISO-native throughout — and includes the Delta & Mapping Pack for organisations covered by both.

What formats do I get?

58 Word documents and 13 Excel workbooks (plus 10 Word implementation guides). Registers, the SoA, gap analysis, audit checklist, BIA questionnaire, competence matrix and trackers are genuine spreadsheets with dropdowns, formulas and dashboards — not tables pasted into Word.

Can consultants use it for clients?

The standard licence covers one legal entity. For multi-entity groups or client delivery, contact us about an Enterprise Licence.

How do updates work?

Every file carries a version history, and the pack has a changelog. If ISO amends the standard or we improve documents, you get updated files — and the 30-day update-or-add pledge covers fit problems in your environment.

Templates are general working documents, not legal or professional advice, and do not guarantee certification or regulatory compliance. Adapt them to your organisation and have them reviewed by a qualified adviser where appropriate. ISO and ISO/IEC 27001 are trademarks of the International Organization for Standardization; this product is an independent documentation toolkit and is not affiliated with or endorsed by ISO.

<!– ============================================================