Sightadel
Free 14-day trial

Certification · Information security

ISO 27001 without an endless project.
Control by control to certification.

Sightadel guides you through every requirement of ISO 27001:2022 – with industry templates drawn from years of consulting practice, AI that helps with the wording, and real consultants for the difficult parts.

Try free for 14 daysTalk to an expert

What it is about

ISO 27001 in brief

ISO 27001 describes how to establish, operate and continually improve an information security management system (ISMS). The standard does not tell you which firewall to buy. It requires you to know your risks, treat them appropriately and be able to prove that the system works in day-to-day operations.

The standard has two parts: clauses 4 to 10, which set out the requirements for the management system itself – context, leadership, planning, support, operation, performance evaluation and improvement – and Annex A, with 93 controls in four themes: organisational, people, physical and technological.

Organisations rarely fail the audit because of Annex A. They fail on clauses 9 and 10: internal audit, management review, corrective action. This is exactly where Sightadel guides you most closely – with dates rather than good intentions.

More on the matching software: ISO 27001 software, with features, rollout and prices.

01

Initial certification planned

Customers or tenders require the certificate. You need a scope, a risk methodology, a Statement of Applicability and an audit programme – in exactly that order.

02

Certified, but maintenance is a struggle

After the initial audit, the system came to a standstill. The surveillance audit will notice, because evidence carries a date. Sightadel reminds you before anything expires.

03

NIS2 or customer requirements looming

ISO 27001 carries over into other frameworks further than any other. If you build a solid foundation here, you have already covered a large part of NIS2, TISAX-style customer audits or DORA.

Evidence for technical controls

Vulnerabilities and network: the controls that need technology.

Among other things, Annex A requires management of technical vulnerabilities (A.8.8) and secured networks (A.8.20). Neither can be proven with a policy alone. Together with veyrisk and Valar, we provide the technology for this, and you file the results directly as evidence against the relevant control.

Vulnerability management · A.8.8

Regular scans and tests with traceable remediation

Network security · A.8.20–A.8.22

Firewall, segmentation and documented rule set

Both are optional and independent of your Sightadel licence. We will clarify what fits your scope in a short conversation.

Request a consultation

Requirements

What is required – and how Sightadel helps.

Summarised in our own words. The original text in its current version is always authoritative.

Clause 4

Context and scope

Internal and external issues, interested parties and a clearly defined scope.

In SightadelGuiding questions lead you to the scope. The industry template suggests typical parties and boundaries; you confirm or adjust them.

Clause 5

Leadership and policy

Top management takes responsibility, approves an information security policy and assigns roles.

In SightadelAI draft of the policy based on the industry template. Objectives and responsibilities remain explicitly your task – Sightadel flags these points.

Clause 6

Risk assessment and treatment

A repeatable method, documented assessment, a treatment plan and measurable security objectives.

In SightadelRisk register with assessment, treatment and links to measures. The same inputs lead to comparable results – precisely what the auditor checks.

Clause 6.1.3

Statement of Applicability

All 93 controls with decision, justification and implementation status.

In SightadelBuilt automatically as you work through it: applicability, justification, status and owner for each control – exportable for the auditor.

Clause 7

Resources, competence, awareness

Proof that those involved are qualified and aware, plus controlled documentation.

In SightadelTraining as recurring cycles with evidence. Documents with version, approval and expiry date in the evidence archive.

Clause 8

Operation

Planning and control of processes, regular risk assessment, implementation of the treatment plan.

In SightadelAction plans with owners and due dates, linked to risks, controls and evidence.

Clause 9

Internal audit and management review

An audit programme, completed internal audits and a documented review by top management.

In SightadelDates rather than good intentions: Sightadel schedules both as a cycle, provides the checklist and records the result as evidence.

Clause 10

Improvement

Nonconformities are addressed, causes eliminated and the system continually improved.

In SightadelDeviations become measures with a deadline. The activity log shows in full who did what and when.

Annex A

93 controls in four themes

37 organisational, 8 people, 14 physical and 34 technological controls.

In SightadelEvery control as a guided question with answer options, template, evidence link and comment. Control by control, with back and next.

Process

The path to the goal, phase by phase.

Three to six months if someone in-house really drives it. Alongside other work, more like nine to twelve.

  1. 1
    Weeks 1–2

    Define the scope

    Define the boundaries of sites, systems and processes. A scope that is too broad is the most common reason projects drag on.

  2. 2
    Weeks 2–5

    Assess risks

    Record assets, assess risks, decide on treatment. Only then can you make sensible decisions about the controls.

  3. 3
    Weeks 4–10

    Controls and Statement of Applicability

    Work through all 93 controls with guidance. Templates and AI provide drafts; you decide and link evidence.

  4. 4
    Weeks 6–14

    Policies and evidence

    Finalise the information security policy, topic-specific policies and procedures, deliver training, file evidence with expiry dates.

  5. 5
    Weeks 14–18

    Internal audit and management review

    Check the entire system yourself once and have it reviewed by top management – mandatory before the certification audit.

  6. 6
    Weeks 18–24

    Certification audit, stages 1 and 2

    An independent, accredited auditor first reviews the documentation, then the implementation. They work directly in Sightadel with their own role and can never delete anything.

Ready to start

10 points to settle before you begin.

Clarify these questions early and you save weeks later on. In Sightadel they are set up as your first tasks.

  1. Management has approved the project and appointed a responsible person
  2. This person's time budget is agreed, at least one day per week
  3. A copy of the ISO 27001:2022 standard is available in-house
  4. The scope is roughly defined: sites, processes, systems
  5. A list of the most important information assets and systems exists
  6. Existing policies and procedures have been collected
  7. Critical service providers and vendors are known
  8. Criteria for risk assessment have been discussed
  9. A target date for the certification audit is set, quotes from certification bodies have been requested
  10. Dates for the internal audit and management review are in the calendar

Division of work

Significantly less effort. But not zero.

If software filled everything in, the standard would not serve its purpose – and the auditor would notice. That is why it is clearly defined what stays with you.

Sightadel takes care of

  • Structure of all clauses and controls in a logical order
  • Industry templates for the information security policy, policies and procedures
  • AI drafts and drafting help
  • Statement of Applicability, always up to date
  • Deadlines, reminders and expiry dates for evidence
  • Auditor access included, no deletion rights

You decide

  • Define the scope and risk appetite
  • Assess risks and decide on treatment
  • Set objectives, roles and responsibilities
  • Actually implement measures in day-to-day operations
  • Carry out the internal audit and management review

From practice

Common mistakes – and how to avoid them.

From many years of consulting and certification practice: these are the points that cost the most time or lead to nonconformities in the audit.

1

Scope chosen too broadly

Certifying everything at once extends the project by months. Start with the area your customers actually ask about, and extend it later in a surveillance audit.

2

Off-the-shelf risk assessment

A borrowed risk list rarely fits your own organisation. The auditor asks about your assets, threats and criteria. Templates are a starting point; you do the assessment yourself.

3

Blanket exclusions in the Statement of Applicability

Ticking off a control as “not relevant” is not enough. Every exclusion needs a justification consistent with the scope and the risk assessment.

4

Policies that are not practised

An access control policy without a completed access review is a nonconformity. For every policy, plan the evidence that it is applied.

5

Internal audit as a formality

If you audit your own system, you will find little. Have the internal audit carried out by someone independent, internally from another department or externally.

6

Standstill after certification

Evidence expires, training is postponed. Set up recurring tasks with fixed dates and owners before the project team disbands.

One piece of evidence, several frameworks

What you build for ISO 27001 counts elsewhere too.

We deliberately do not give a percentage – it depends on your scope. Where requirements overlap, one piece of evidence is attached to all of them.

NIS2

The risk management measures under § 30 BSIG (German BSI Act) largely match Annex A. What is missing are mainly reporting channels, registration and management's responsibility for implementation and oversight.

ISO 42001

Same management system structure (clauses 4–10). Leadership, risk process, internal audit and management review can be run together.

ISO 9001

Same basic structure: document control, internal audit, management review and corrective action are set up once.

GDPR

Technical and organisational measures under Art. 32 can be proven with the same evidence as many Annex A controls.

DORA

ICT risk management, access control and incident handling build on the same foundations. The register of information has no equivalent in ISO 27001.

Audit and evidence

The audit is carried out by an independent auditor – not by us

Under ISO 17021, a certification body may not both consult and certify. That is why Sightadel does not certify. You choose an accredited auditor from our independent partner network or a body of your choice. No commission is paid for audits – neither to us nor to the partners.

The certification audit takes place in two stages: stage 1 reviews the documentation, stage 2 the implementation in operation. This is followed by two annual surveillance audits and recertification after three years. The auditor receives their own access in Sightadel: they see the audit scope, add comments and – once you approve – create or edit entries. They can never delete anything.

To the independent auditor network

What ISO 27001 really costs

The total cost is made up of three items that should be considered separately. First, the tool: the Sightadel licence for ISO 27001 is charged monthly per edition, with a minimum term of one year. ISO 27001 itself is not discounted. If you add frameworks such as NIS2 or the GDPR, each of them permanently costs less as long as ISO 27001 is licensed. ISO 9001 is excluded. You will find all prices and a calculator on our pricing page.

Second, the certification body. It invoices independently, based on audit days. How many days are needed depends mainly on the number of employees in scope, the number of sites and the complexity of the IT. Certification bodies determine this according to fixed rules for audit time. Obtain at least two quotes and compare the number of audit days for stage 1, stage 2, surveillance and recertification, not just the daily rate.

Third – and usually the largest item – the internal effort. One responsible person with at least one day per week is the minimum. On top of that come hours from IT, HR, the business units and management for risk assessment, policies and management review. Technical measures that are still missing, such as multi-factor authentication or a tested backup, cost extra. If in-house experience is lacking, you can add consulting in Sightadel as a package.

What the certificate does for sales

For most companies, the trigger is not the law but a customer. Larger clients, public tenders and insurers ask for an ISO 27001 certificate or send long security questionnaires. With a certificate, you answer many of these questions with a single document. Without one, you answer each questionnaire individually and hope the answers are consistent.

Pay attention to the scope. Customers read it closely. A certificate that only covers internal IT is of little help if the customer wants to know how your product or service is secured. Define the scope so that it covers what your customers actually buy.

A second benefit is often underestimated: the ISMS clarifies internal responsibilities. Afterwards, it is clear who is responsible for access rights, vendors or incidents. That saves time when something happens. It also eases the path to further requirements such as NIS2, which call for the same measures. In the Trust Center, you show customers your certificate, documents and security posture instead of sending attachments every time.

What documentation the auditor wants to see

The standard makes a manageable number of documents mandatory. These include the scope, the information security policy, the risk assessment and risk treatment method, the results of both, the Statement of Applicability, the security objectives, evidence of competence, the audit programme with results, the management review, and nonconformities and corrective actions. Many Annex A controls additionally require defined processes, for example for access rights, incidents or vendors.

More important than the number of documents is how they connect. The auditor picks a risk and asks: which measure treats it, who is responsible, where is the evidence that it works? This chain must be complete. A folder full of policies with no link to the risk register convinces nobody.

In Sightadel, this chain is created as you work: risks are linked to controls, controls to evidence, and evidence carries a version, approval and expiry date. The Statement of Applicability is not compiled at the end but grows with every answered question. Everything can be exported for the auditor or reviewed directly in the app.

Preparing for the certification audit

The audit takes place in two stages. In stage 1, the auditor checks whether the system is fully described and whether you are ready for stage 2. Typical findings here: unclear scope, a risk method without traceable criteria, a Statement of Applicability with generic justifications. There are usually a few weeks between the stages in which you can make improvements.

In stage 2, the auditor checks the implementation. They talk to employees, ask to be shown systems and take samples: an access review, a leaver, an incident, a vendor assessment. Anyone who only has documents but no evidence from operations will receive nonconformities.

Three things help. First, an honest internal audit a few weeks beforehand, carried out by someone who did not build the system themselves. Second, a management review that contains real decisions, not just acknowledgement. Third, prepared interviewees: anyone from IT, HR or the business units answering questions should know their role in the ISMS. Minor nonconformities are normal and do not prevent certification, as long as you submit a corrective action plan.

Life after certification

The certificate is valid for three years, but only if the system keeps running. In each of the two following years there is a surveillance audit, and in the third year recertification. The auditor wants to see that internal audits have taken place, the management review has been repeated, risks have been reassessed and corrective actions have been completed.

The most common mistake after the initial audit is standstill. The project team disbands, evidence expires, training is postponed. The surveillance audit spots this immediately, because evidence carries a date.

So plan a fixed annual rhythm: access reviews, training, vendor assessments, emergency tests, internal audit and management review on fixed dates. In Sightadel, these tasks run as recurring cycles. Evidence carries an expiry date, and Sightadel reminds you before it becomes invalid. The Security Score in the dashboard shows where things are slipping, and the activity log proves who did what and when. This keeps the annual effort predictable and considerably lower than during the build-up.

ISO 27001 as the foundation for further frameworks

An ISMS based on ISO 27001 is rarely the last framework. If you fall under NIS2, you must implement risk management measures under section 30 of the German BSI Act (BSIG), which largely match Annex A. Cloud providers seeking a C5 attestation will find in C5:2026 a catalogue aligned with ISO 27001:2022. Financial entities build DORA on the same foundations, and the technical and organisational measures under Art. 32 GDPR can be proven with the same evidence.

The practical lever lies in the evidence. An access review log, a backup test report or a training record proves requirements in several frameworks at once. In Sightadel, you link a piece of evidence once to all matching requirements and maintain it in just one place.

You should still know what each one adds: for NIS2, registration, reporting deadlines and management's duty to implement and oversee; for DORA, the register of information; for C5, cloud topics such as tenant separation; for the GDPR, legal bases and data subject rights. ISO 9001 and ISO 42001 also share the structure of clauses 4 to 10, so internal audit and management review can run together.

What it costs

A licence per framework – transparent and without surprises.

You only pay for the frameworks you actually need. The editions differ in capacity and response time, not in subject-matter scope. If you run several frameworks, you save permanently. All prices, discounts and a calculator are on the pricing page.

The certification or audit body invoices its fees directly to you. If needed, you can add consulting as a package in the app.

Prices and cost calculatorFree 14-day trial

Working materials

↓ISO 27001:2022 – Statement of Applicability and maturity levelWorkbook · XLSX, PDF

Practical aids, not legal advice.

Terms

The key terms for ISO 27001.

ISMS
Information security management system: the combination of rules, roles, processes and measures an organisation uses to manage its information security.
Annex A
Catalogue of 93 controls in four themes, from which you select the controls that match your risks.
Control
A single security measure, for example for access control or data backup.
Statement of Applicability
SoA for short. Lists all controls with decision, justification and implementation status.
Risk treatment plan
Defines how each assessed risk is handled: mitigate, avoid, transfer or accept.
Residual risk
The risk that remains after measures have been implemented. The risk owners must explicitly accept it.
Stage 1 audit
First part of the certification audit. Reviews documentation and audit readiness.
Stage 2 audit
Second part of the certification audit. Reviews implementation in operation through interviews and samples.
Surveillance audit
Annual audit between initial certification and recertification, in which the body checks whether the system remains effective.
Nonconformity
A requirement that is not met. It is addressed at its root cause and closed with a corrective action.
Management review
Regular, documented review of the ISMS by top management, with decisions on objectives, resources and improvements.

Questions and answers

Questions about ISO 27001

More in our FAQ or directly via our contact form.

Is ISO 27001 mandatory?

Legally, usually not. In practice, more and more customers, insurers and tenders require it. For entities subject to NIS2 it is not a must, but it is the most proven way to implement the required measures in a structured manner.

How long does it take to get certified?

Three to six months to audit readiness if a team works on it regularly. Alongside other work, more like nine to twelve. The certification audit itself takes a few days depending on size, spread over two stages.

What does certification cost in total?

Two items: the Sightadel licence for ISO 27001 (prices on our pricing page) and the certification body, which invoices independently. Its effort depends on headcount and number of sites. Internal time comes on top – Sightadel reduces it considerably.

Is the text of the standard included?

No, and it may not be. ISO standards are protected by copyright. Sightadel contains structure, controls, guiding questions, templates and its own explanations – not the wording. You need a copy of the standard in-house, whatever platform you use.

Does the AI fill in the documents completely?

No, deliberately so. The AI provides drafts from industry templates and helps with the wording. You describe objectives, risk assessment and responsibilities yourself – otherwise the ISMS does not serve its purpose, and the auditor will notice.

Is the certificate also valid outside Europe?

Yes. ISO 27001 is an international standard. The certificate is recognised worldwide if the certification body is accredited – in Germany by DAkkS.

We already have documents in Word and Excel. Do we start from scratch?

No. You upload existing documents to the evidence archive and link them to the matching controls. Sightadel then shows you where something is still missing.

What happens after certification?

Annual surveillance audits and recertification after three years. Sightadel keeps track of evidence with expiry dates, recurring cycles and dates for the internal audit and management review – so that the system does not fall asleep again.

Do I need a consultant for ISO 27001?

Not necessarily. Many organisations manage the implementation with one committed person in-house and a good structure. A consultant is worthwhile where experience is lacking, for example with the risk method, the scope or the internal audit. In Sightadel, you can add consulting as a package in the app when you need it.

What is the difference between ISO 27001 and BSI IT-Grundschutz?

ISO 27001 defines what an ISMS must achieve and leaves the choice of measures largely to your risk assessment. The IT-Grundschutz methodology of the Federal Office for Information Security (BSI) describes in much more detail what measures should look like. The BSI offers its own ISO 27001 certification based on IT-Grundschutz, which is common mainly in the public sector. For most companies, native ISO 27001 is the usual route.

Reviewed for accuracy on 8 October 2026 · Not legal advice. The standard or law in its current version is authoritative.

Start with ISO 27001.

14 days, full access, no payment details. Everything you set up carries over into the paid plan.

Try free for 14 daysTalk to us