Scope first
Legal entity, locations, products, and suppliers. Out of scope needs a reason.
Resources · ISO 27001 guide
The ISMS is the work. The mark is a body.
ISO/IEC 27001 certification is an independent audit against a scoped management system. ReadyComply holds the clauses and Annex A themes. It does not certify you.
The distinction
A policy pack is not an ISMS.
Certification bodies look for a living system: scope, risk, competence, internal audit, management review, and improvement. A folder of templates with last year’s date is a finding. The register has to stay current through the cycle.
The work
What readiness actually is.
Risk-based Annex A
You apply themes because the risk treatment says so, not because a vendor dumped 93 rows.
Evaluate and improve
Internal audit and management review are clause 9 and 10, not optional extras.
Then a body
Stage 1 and stage 2 are theirs. ReadyComply is the file they should not have to hunt.
Where ReadyComply stops
It does not issue the certificate.
There is no passing grade for an Annex A theme in the product. Status is a human field. Connectors, when they exist, attach evidence to a clause or theme. They do not close a nonconformity, and they do not stand in for the auditor's stage 1 and stage 2 visits. If a page on this site sounds like a mark you can buy, it is wrong.
Framework
The ISO 27001 product page.
Workspace
The four records.
Controls
Scope SOC 2, ISO 27001, HIPAA, and GDPR families to each system. Track status, owner, and why something is out of scope.
Evidence
File what you have against a control. Manual upload or a read-only connector.
Policies
Versioned drafts next to the controls they support. Know which text is current.
Checklist
Run it in order.
Open the workspace. Keep the register current.
Sign in. Create the first system. Start with what you can already prove.
Sign in