Features / Standards
ISO/IEC 27001 software
Information security management. An information security management system: assess risks to information, choose controls, and prove they work.
Who it’s for
Software, IT, data and service companies — and anyone whose customers ask for proof that their information is protected.
Edition notes. The 2022 edition is current; transition from the 2013 edition ended on 31 October 2025. Annex A has 93 controls in four themes (organizational, people, physical, technological). You keep your own Statement of Applicability in Total ISO; the control wording comes from the standard.
What you still need
The official standard from ISO/IEC (iso.org or your national standards body), and — if you want a certificate — an accredited certification body to audit you. Total ISO helps you build, run and evidence the system; it doesn’t grant certification.
What Total ISO gives you for ISO/IEC 27001
Each requirement area below maps to a screen in the app. Your “Requirements” page shows what’s in place and what’s still to do. Coverage for ISO/IEC 27001: full requirements map with purpose-built records.
4Context and interested parties
Know the internal and external issues and the needs of interested parties that affect your system.
In the app: Relevant issues
4Scope of the system
Define the boundaries and applicability of your system.
In the app: Facilities & processes
5Roles, responsibilities and authorities
Assign and communicate who does what.
In the app: Org chart & people
5Policy
An information security policy set, communicated and maintained by top management. File it under the folder “Policy”.
In the app: Documents
6.1.2Information security risk assessment
Identify information security risks, assess them, and decide what to do about each.
In the app: Risks & opportunities
6Objectives and planning to achieve them
Set measurable objectives with owners, resources and dates.
In the app: Objectives
7Competence and training
Decide what competence people need and keep evidence.
In the app: Training matrix
7Communication
Decide what, when, with whom and how you communicate.
In the app: Communication plan
7Documented information
Create, control and keep the documents and records the system needs.
In the app: Documents
8Operational planning and control
Plan and control the processes that deliver your product or service. File procedures under “Procedures”.
In the app: Documents
9Monitoring and measurement
Decide what to monitor, how often, and evaluate the results.
In the app: Facility inspections
9Internal audit
Audit your system at planned intervals and report the results.
In the app: Internal audits
9Management review
Top management reviews the system at planned intervals.
In the app: Management review
10Nonconformity and corrective action
React to problems, find root causes, correct, and check it worked.
In the app: Corrective actions
6.1.3Risk treatment and Statement of Applicability
Choose controls, justify which apply, and record their implementation status.
In the app: Controls & Statement of Applicability
Inventory of information and other assets
Know which information and assets you protect, who owns them, and how critical they are.
In the app: Asset register
Supplier relationships and information security
Evaluate and control suppliers, contractors and outsourced processes.
In the app: Vendors
Legal, regulatory and contractual requirements
List the laws, permits and other requirements that apply and keep them current.
In the app: Compliance register
Information security incident management
Report, assess and respond to information security incidents.
In the app: Incidents
Emergency preparedness and response
Plan for credible emergencies and test the plans.
In the app: Emergency plans
Working to more than one standard?
Most requirements overlap, so you enter things once. One risk register, one set of documents, one audit programme, one corrective-action process — shared by every standard you choose. Your plan includes one standard; each extra is a simple monthly add-on (see pricing) — $20/month for ISO/IEC 27001 when it isn’t your included one. Try them all free during the trial.
Mapping follows ISO/IEC 27001 (2022) as publicly described. Clause numbers appear only where we are confident of them. Standards are revised periodically; check which edition your certification body audits against. ISO is a registered mark of the International Organization for Standardization. Total ISO is not affiliated with or endorsed by ISO/IEC.