ISO/IEC 27001 readiness check
Know your gaps before the certification audit.
FEATURES · AUDITS & ISMS GOVERNANCE
Steer, review, improve.
Context, objectives, training, internal audits, findings and the management review work hand in hand. Management sees at a glance where the ISMS stands and what needs attention.
WHAT YOU GET
- Context 4.1/4.2 including climate change (Amd 1:2024)
- Objectives under 6.2 with key figures and measurements
- Training under 7.2/7.3 with participation
- Management review with a traffic light per topic, as a report
Context and scope
Internal and external issues with their impact on the ISMS, interested parties with their requirements and an approved scope. Whether climate change is a relevant issue is assessed with a justification, as ISO/IEC 27001:2022/Amd 1:2024 requires.
Objectives and training
Information security objectives with a key figure, baseline and target value, measurement interval and due date. Training with a target group, mandatory participation and evidence; the participation rate appears on the dashboard.
- Measurements with reminders, evaluation with a justification
- Linked measures
- Mandatory participation per training session
Internal audit
Plan internal and external audits with scope, criteria and period. The lead auditor confirms their independence, and the audit report is filed as a PDF.
- Audit programme with status
- Declaration of independence
- Completed audits cannot be changed
Findings
Nonconformities, observations and opportunities for improvement from audits, incidents and internal controls in one register. The cause, corrective actions and effectiveness are reviewed, by someone other than the responsible person.
- Major and minor nonconformities
- Cause mandatory for nonconformities
- Effectiveness review under the four-eyes principle
Management review
The inputs under ISO/IEC 27001 9.3 are compiled from the system and frozen: findings, audits, risks, objectives, incidents, exceptions, context and more. Management receives an overview with a traffic light per topic.
- Distribution list with feedback before the meeting
- Decisions with measures
- Printable detailed report
Related
Security incidents
Lessons learned from incidents as findings.
Frequently asked questions
Who may carry out the internal audit?
A person who confirms their independence from the area being audited. Varmo records the declaration of independence; the “Internal audit” role can read everything but change nothing.
How often is a management review needed?
ISO/IEC 27001 requires it at planned intervals, in practice usually once a year. Varmo compiles the inputs as of the reference date and freezes them so that the report remains traceable.
How close are you to ISO/IEC 27001?
In a personal demo, we show you the way to the readiness report, with no obligation. Or try it free for 30 days with every feature.