Prepare for ISO 27001 certification in one system.
ISO/IEC 27001:2022 is the international standard for an information security management system. Install it in Alvor and every Annex A control arrives with its ISO 27002 attributes, ready for an owner, an applicability decision and evidence. Audits, findings and the Statement of Applicability work from the same record.
ISO 27001 overview
The global benchmark for information security
93
Annex A controls in the 2022 edition
4
Annex A control themes
3 years
Certificate cycle, audited yearly
ISO/IEC 27001 is the international standard for an information security management system (ISMS): the policies, risk process and controls an organization uses to protect the information it holds. Certification by an accredited body shows customers, partners and regulators that the ISMS exists and operates, with documented controls behind it.
Domain coverage
93 controls across four themes
ISO 27001:2022 reorganised its controls into four categories, down from 14 in the 2013 version.
Organizational Controls
Policies, roles, asset management, access control, supplier relationships, and information security event management across 37 controls.
People Controls
Screening, terms of employment, awareness training, disciplinary processes, and responsibilities after termination across 8 controls.
Physical Controls
Security perimeters, entry controls, equipment protection, secure disposal, and clear desk/screen policies across 14 controls.
Technological Controls
Authentication, encryption, vulnerability management, logging, network security, and secure development across 34 controls.
ISMS Core (Clauses 4–10)
Context of the organization, leadership commitment, planning, support, operational procedures, performance evaluation, and continual improvement.
Risk Assessment & Treatment
Systematic identification, analysis, and evaluation of information security risks with documented treatment plans and acceptance criteria.
Common challenges
Where ISO 27001 preparation slows down, and how Alvor helps
The problem
Manually mapping 93 controls to policies, procedures, and evidence across disconnected spreadsheets
How Alvor helps
Every Annex A control is installed with its ISO 27002 attributes. You name its owner, link the policies that cover it from the policy side, and attach evidence once for every control it supports.
The problem
Scrambling for weeks before the Stage 2 audit to locate and organize evidence artifacts
How Alvor helps
Evidence is uploaded once and linked to every control it supports, with a valid-until date and a notice to the person who uploaded it 30 days before it expires. Inside an audit, request evidence from control owners with a due date and track each request until it is assessed.
The problem
No visibility into which controls are implemented, partially met, or completely missing
How Alvor helps
The compliance dashboard shows posture, the next audit, open findings and evidence health, and every tile opens the list behind it. Findings become remediation tasks with an owner.
The problem
Building an ISMS from scratch without knowing what a good Statement of Applicability looks like
How Alvor helps
Record whether each control applies and why. The Statement of Applicability reads those decisions, so it matches the controls you actually run, and exports to CSV.
The problem
Annual surveillance audits feel like starting from scratch every time
How Alvor helps
Evidence expiry dates, scheduled checks and a daily posture snapshot show what changed since the last audit, so a surveillance audit starts from the current record.
What you get
ISO 27001 compliance, end to end
Every Annex A control, installed
Install ISO 27001:2022 after a license attestation and every Annex A control appears with its five ISO 27002 attributes. Each control takes an owner, an applicability decision, implementation notes and evidence.
Statement of Applicability from the record
Each control carries an applicability decision (applicable, not applicable, inherited or out of scope) with its rationale. The Statement of Applicability reads those decisions with each control's status and exports to CSV.
Automated control checks
Connect AWS, Okta, Microsoft Entra ID, GitHub or GitLab and bind checks such as root MFA, admin MFA or branch protection to the controls they prove. Each check runs hourly, every four hours, daily or weekly, writes a finding for every failing resource and sets the control's status.
Risk assessment workflow
Assess risks for clause 6.1.2 on likelihood and impact scales you define, with a named owner, a treatment, a verdict against your appetite and acceptance recorded with conditions and an expiry. The XLSX export carries the criteria sheet behind every score.
Internal audit management
Scope an internal audit to the controls it covers, with dates and named auditors. Starting it creates an assessment for each control and notifies its owner. Findings carry severity, an assignee and a due date, and become remediation tasks or risks: the record clauses 9.2 and 10.2 ask for.
Cross-framework mapping
Install NIST CSF 2.0 beside ISO 27001 and crosswalks from NIST's informative references appear between them, typed Related. Map other frameworks such as SOC 2 by hand. Evidence uploaded once links to every control it supports, and each control is still assessed on its own evidence.
Other frameworks
Alvor maps controls across all major security and privacy frameworks with cross-framework intelligence.
Frequently asked
Common questions about ISO 27001
Practical answers to the questions teams ask when scoping, preparing for, and maintaining ISO 27001 certification.
It depends on how much of the ISMS already runs. The deciding factor is evidence: the Stage 2 auditor needs to see controls operating over time, so the clock starts when your controls and records do. In Alvor, each piece of evidence is uploaded once, linked to every control it supports and tracked to its expiry date.
Get started
See how Alvor works for your role
Whether you lead security, run IT, manage compliance, or sit in the C-suite - we'll show you your view.