Framework · ISO/IEC 27001:2022
To an information security management system under ISO/IEC 27001:2022, guided and with IT and production in view.
ISO/IEC 27001 is the international standard for information security management systems (ISMS). It specifies how a company plans, implements, monitors and improves information security based on risk; Annex A contains 93 controls whose applicability is justified in the Statement of Applicability.
Content as of:
ISO/IEC 27001 is a voluntary standard. Companies implement it because customers require certification, because they want a recognised framework for NIS2 or to manage their information security systematically.
Complass explains the requirements in its own words and refers to the clauses of the standard. For the certification audit you should own the standard yourself; you can store your own excerpts in the portal.
This overview does not replace legal advice. The legal or normative text is authoritative; in Complass you check applicability with guidance based on the references.
There are no statutory deadlines for ISO/IEC 27001. The schedule is set by your certification audit or your customers’ requirements; you enter audit dates in the project plan, and the dashboard shows the countdown and whether you are on track.
Project start, context, leadership, planning with risk assessment, support, operation, evaluation, improvement and audit preparation.
All Annex A controls with applicability, justification, status and evidence, exportable as Excel or PDF.
Plan internal audits across the certification cycle, with an audit plan, a checklist per clause and Annex A control and an overview of what has already been audited.
Including scope, policy, risk assessment methodology, risk register, risk treatment plan, internal audit programme and management review.
Assets, software, licences and contracts with owners, deadlines and evidence in the asset management module, as the basis for the inventory and licensed use.
Implemented controls also count for NIS2, IEC 62443 and the CRA through linking.
Catalogue: Annex A – Controls / Statement of Applicability
If your customers require ISO 27001, this selection covers the requirements in Complass.
minimum selection ISO 27001 / 27002
€199 net per month
Recommended
€590 net per month
More impact with Asset management and zones, Supplier Management and Business continuity management (BCM), room for 10 users and 2 frameworks.
With annual payment, 12 months minimum term. Monthly payment with a 15 % surcharge. All prices net plus VAT, as of 6 November 2026. All packages and modules in the price overview
You can also meet the requirements without Complass. Complass supports implementation and evidence and does not replace legal advice. Legal information
The Statement of Applicability (SoA) is a mandatory document under ISO/IEC 27001:2022, clause 6.1.3 d. It names the necessary controls with a justification, records whether they are implemented and justifies why Annex A controls are excluded.
The starting point is risk treatment: it shows which controls are necessary. You compare these with all 93 Annex A controls and record for each one whether it applies, why, and how far it is implemented. Controls from sector rules or contracts are added. When risks or the scope change, you update the statement.
The Annex A catalogue is your Statement of Applicability: for each control you record applicability, justification, status and evidence, add your own controls and release the state as a version. Release is possible only once every entry is decided and justified. You can export it as Word, Excel or PDF.
No. Certification is carried out by an accredited certification body. Complass prepares you with documents, the Statement of Applicability and evidence.
No, standards are protected by copyright. Complass explains the requirements and refers to the clause; you can store your own excerpts from your licensed copy.
Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.
