Get audit-ready for ISO 27001
ISO/IEC 27001:2022 · Information Security Management System
The international standard for managing information security through a systematic approach to people, processes, and technology.
ISO 27001What is ISO 27001?
The international standard for managing information security through a systematic approach to people, processes, and technology.
Who it applies to
Any organisation that wants an independently certified information security management system. Most often reached for because an enterprise customer, a tender or an investor asked for the certificate by name.
How the standard is organised
A management-system clause set (4-10) carrying the certifiable requirements, plus Annex A, which the 2022 revision reorganised into 93 controls across four themes: organisational, people, physical and technological.
Framework names, marks and abbreviations (ISO, SOC 2, PCI DSS, TISAX, HIPAA, GDPR and others) are trademarks of their respective standards bodies and are used here only to describe what the Bitkosh Readiness Platform helps you track and prepare for. The badges shown are original Bitkosh artwork, not the official marks. Bitkosh Technologies is not affiliated with, sponsored by, or endorsed by ISO, AICPA, the PCI Security Standards Council, ENX/VDA, or any other framework owner, and using this platform does not by itself confer or guarantee certification — certification/attestation is granted only by the relevant accredited third-party body.
ISO 27001 on the Bitkosh platform
The 93 ISO 27001 controls sit in one workspace with gap assessment, evidence collection and your readiness score, and shared controls count towards the equivalent requirement in the other 47 ready frameworks at the same time — so a second framework costs a fraction of the first.
How the platform worksSample controls
Six controls from the platform's control library, chosen because they are the most specific to this framework.
- A.7.3Securing offices, rooms and facilities
Design and apply physical security for offices, rooms and facilities according to the value and sensitivity of what they hold.
Physical - A.5.31Legal, statutory, regulatory and contractual requirements
Identify the legal, regulatory and contractual obligations that apply to information security, document them and keep them current.
Organizational - A.7.7Clear desk and clear screen
Enforce clear desk rules for papers and removable media and clear screen rules for information processing facilities.
Physical - A.5.6Contact with special interest groups
Maintain relationships with security forums, professional bodies and specialist groups to stay informed on practices, alerts and emerging issues.
Organizational - A.8.18Use of privileged utility programs
Restrict and tightly control the use of utility programs able to override system and application controls.
Technological - A.6.4Disciplinary process
Establish and communicate a formal disciplinary process for dealing with personnel who breach security policy.
People
More information security & cybersecurity frameworks
Frequently Asked Questions
Who publishes ISO 27001, and who does it apply to?
How is ISO 27001 conformance demonstrated?
How is ISO 27001 structured?
Ready to get audit-ready for ISO 27001?
See how the Bitkosh Readiness Platform gets you audit-ready for ISO 27001 — and the other 47 ready frameworks — from a single control library.