Software · ISO 27001
ISO 27001 software should support the information security management system: clauses 4 to 10, the 93 controls from Annex A, risks, evidence and the annual cycle of internal audit and management review. This page shows what the standard requires, what to look for when choosing ISMS software and how Sightadel covers it.
Starting point
ISO/IEC 27001:2022 requires a management system, not a document package. Clauses 4 to 10 govern context and scope, leadership, risk assessment and treatment, resources and competence, operation, evaluation and improvement. Annex A contains 93 controls in four themes: 37 organisational, 8 people, 14 physical and 34 technological. For each control, you record in the Statement of Applicability whether it applies, why and how far it is implemented.
ISMS software must map this structure and hold it together: risk, control, measure and evidence belong together. The auditor checks whether the risk method is repeatable, whether evidence is up to date and whether internal audit and management review have taken place. The certificate is valid for three years, with two annual surveillance audits. Above all, the software must therefore support operation after the initial audit.
What the software does not take over are the decisions. Management sets the scope, information security objectives, risk acceptance, the selection of controls and the roles. Good ISMS software makes these points visible and documents who decided what and when.
Why now
Customers or tenders require the certificate. You need scope, risk method, Statement of Applicability and an audit programme, in that order.
After the certificate, the system stood still. Evidence carries a date, and the surveillance audit reveals what has not been reviewed for a year.
Statement of Applicability, risk list and vendor list sit in separate files. Links between risk, control and record exist only in the information security officer's head.
ISO 27001 carries furthest into other frameworks. If you run the ISMS in software, you use the same evidence for the additional obligations.
Relevant frameworks
Summarised in our own words, not legal advice. The original text in its current version is authoritative.
Clauses 4 to 10 and all 93 controls from Annex A in the 2022 version. The result is a certificate from an accredited body, valid for three years. Reaching audit readiness typically takes three to six months.
View framework →The measures under section 30 of the German BSI Act (BSIG) largely match Annex A. On top come the reporting chain, registration with the Federal Office for Information Security (BSI) and management responsibility under section 38.
View framework →The technical and organisational measures under Art. 32 can be proven with the same evidence as many controls from Annex A.
View framework →For cloud providers with customers from the public sector or regulated industries. The BSI criteria catalogue builds on ISO 27001; the result is an attestation by an independent auditor (certified public accountant).
View framework →Recommended order
Delimit sites, systems and processes, identify interested parties. Guiding questions and the industry template suggest boundaries; you confirm or adjust them.
Record assets, assess risks with a fixed method, decide on treatment. Only then can the controls be decided sensibly.
Answer all 93 controls step by step. This produces the Statement of Applicability with decision, justification, status and owner for each control.
Finalise the information security policy, topic-specific policies and procedures, carry out training, upload records with a validity date to the evidence archive and map them to the controls.
Check the whole system yourself once and have management review it. Both are mandatory before the certification audit and recur annually afterwards.
An independent, accredited auditor checks the documentation in stage 1 and the implementation in stage 2. They work directly in Sightadel with their own role and can never delete anything.
Selection
Almost every ISMS software lists the 93 controls. What matters is how well it holds together risk, control and evidence and how much maintenance operation costs.
The Statement of Applicability should emerge as you work through the controls, not be maintained as a separate spreadsheet. Check whether it can be exported for the auditor.
The same inputs must lead to comparable results. Risks should be linked to treatment, owner and measures, not just assessed.
A restore test from 14 months ago no longer counts as evidence in the surveillance audit. Look for a validity date and a reminder before expiry.
These are the two points where systems most often show weaknesses in the audit. The software should manage them as recurring dates with a result.
The auditor should be able to view requirements, answers, records and the change log themselves and comment on them, but never delete anything. That saves sending files and follow-up questions.
When NIS2, DORA or the GDPR are added, existing evidence should continue to count. Ask whether a record can be linked to controls from several frameworks.
How Sightadel helps
Clauses 4 to 10 and each of the 93 controls as a guided question with answer options, explanation and comment. This builds the Statement of Applicability, exportable for the auditor.
Learn more →Industry templates from many years of consulting and certification practice provide drafts for the information security policy and topic-specific policies. The AI makes suggestions from data you have already entered or imported. You accept, change or add to them.
Learn more →Records with version, validity date and a reminder before expiry. One piece of evidence is linked to all the controls it covers, including beyond ISO 27001.
Learn more →Gaps from the assessment, findings from internal audits and nonconformities from the certification audit become measures with an owner and a deadline.
Learn more →Service providers with criticality, questionnaires and evidence, with a reminder of the reassessment. This covers the supplier controls in Annex A.
Learn more →The Security Score rates the externally visible attack surface of your domains with a grade from 0 to 100 and lists concrete issues. That provides material for vulnerability management under Annex A.
Learn more →Effort and duration
The ranges are based on experience, not a commitment. The biggest factors are the size of the scope, your starting point and the time of the person responsible.
What you license · typically Professional
An ISMS with several people involved from IT, HR and purchasing typically runs with ISO 27001 in the Professional edition. If NIS2, the GDPR or C5 are added, they permanently cost less because ISO 27001 is already licensed.
Licence per framework, minimum term one year, payable monthly or annually. You will find all prices, discounts and a calculator on the pricing page. Fees of a certification or audit body are charged separately.
Questions and answers
More in our FAQ or directly via our contact form.
The standard does not prescribe software. It requires a controlled, traceable system. For small scopes, documents and spreadsheets will do. ISMS software pays off as soon as several people are involved, evidence expires and surveillance audits ask the same questions every year.
Excel holds lists, but not links. Risk, control, measure and evidence are then only connected through cross-references, and nobody monitors deadlines. Existing spreadsheets can be imported into Sightadel and keep their content.
Sightadel is licensed per framework and edition, annually. The current amounts are on the pricing page. On top come the costs of the certification body and, if you wish, a consultant. You can try it free for 14 days, without payment details.
No. Sightadel guides you through the requirements. You choose consultants from the partner network in the app or bring your own; they work in your account with the Consultant role. The certification audit is carried out by an independent, accredited body. Sightadel does not certify and receives no commission.
The scope, information security objectives, risk acceptance, the decision on the controls and the roles. The standard requires these decisions from management. Sightadel flags these points and records who decided what and when.
It emerges as you work through the 93 controls: applicability, justification, status and owner for each control. You decide the content. The software puts it together and exports it for the auditor.
Yes. You bring your own certification body or choose one from the partner network. The auditor gets a role of their own, sees requirements, answers and records in context and can comment, but never delete.
14 days, full access, no payment details. Everything you set up carries over into the paid plan.
