ISO/IEC 27001:2022 · Information security
Keep your ISMS current between audits, not just before them.
Risks, controls, policies, suppliers and audit findings change all year. ILSERIS keeps them as linked records, so the applicability of a control, the risk it treats and the finding raised against it stay in step.
Requirements
What ISO 27001 asks of you
ISO/IEC 27001 specifies the requirements for an information security management system (ISMS). In broad terms, it covers six areas.
ISMS context and scope
Understand your organisation, its interested parties and their requirements, and define the scope of the ISMS.
ILSERIS modules
Risk assessment and treatment, Statement of Applicability
Assess information security risks, choose how to treat them and record in a Statement of Applicability which controls apply and why.
ILSERIS modules
Annex A controls
A reference set of 93 controls in four themes (organisational, people, physical and technological), compared against the controls you select.
ILSERIS modules
Internal audit and management review
Audit the ISMS at planned intervals and have top management review its suitability, adequacy and effectiveness.
ILSERIS modules
Nonconformity and corrective action
React to nonconformities, find their causes, take corrective action and check that it worked.
ILSERIS modules
Supplier relationships
Manage information security in supplier relationships and agreements, and monitor supplier service delivery.
ILSERIS modules
Mapping
How ILSERIS maps to ISO 27001
Five steps, each in a module you already use, all on the same records.
- Step 01
Set up the standard
Record ISO/IEC 27001 in Govern's frameworks and set which controls apply to your scope.
- Step 02
Assess and treat risks
Score information security risks in the register, see them on heat maps and plan their treatment.
- Step 03
Link controls, policies and suppliers
Connect each control to its policies, procedures, owners and the suppliers in scope, and approve exceptions with the risk you accept.
- Step 04
Audit and correct
Plan internal audits from the audit universe, record findings and follow corrective and preventive actions to closure.
- Step 05
Review and report
Bring coverage, open gaps and findings to management review with reports drawn from the same records.
Outputs
What you can show
To top management and your certification auditor.
- Applicability per control, with the policies and owners linked to it.
- A risk register with scoring, heat maps and treatment plans.
- Audit engagements, findings and the status of every corrective action.
- A full audit trail: who changed what, with the values before and after.
ILSERIS supports your compliance programme. It does not provide legal advice or certify compliance.
See ILSERIS in action.
A focused walkthrough, built around your regulatory landscape and operating model.