ISO/IEC 27001
International standard for information security management systems, and how to build your ISMS and Statement of Applicability in cSquare.
Updated 2026-10-21
ISO/IEC 27001:2022 specifies an information security management system (ISMS): clauses 4 to 10 plus the Annex A controls. Certification is by an accredited body in two stages.
Set up ISO 27001 in cSquare
- Create the program from the ISO 27001 template. It includes all 93 Annex A controls in four themes: organizational, people, physical and technological.
- Define ISMS scope (clause 4): locations, teams, systems and interfaces.
- Run your risk assessment in the risk register (clause 6). ISO expects risk to drive control selection.
- Build your Statement of Applicability with the Control Applicability Wizard. Every exclusion keeps its justification.
- Approve ISMS documents: scope, information security policy, risk methodology, risk treatment plan.
- Run an internal audit and management review (clause 9) before stage 1.
AI prompt
Draft our ISO 27001 ISMS scope statement based on our organization profile, including in-scope locations, systems and exclusions with justifications.
AI prompt
Review my Statement of Applicability: list excluded Annex A controls whose justification is weak, and controls included without a linked risk.
Certification stages
- Stage 1: documentation review of the ISMS.
- Stage 2: evidence that controls operate as documented.
- Surveillance audits follow yearly, with recertification every three years.
Reuse
Map to SOC 2 to reuse evidence. See Control mapping.
Was this helpful?