Requirements & SoA
How applicability, implementation and evidence fit together.
FRAMEWORKS · ISO/IEC 27001
Implement and evidence ISO/IEC 27001:2022.
ISO/IEC 27001 defines what an information security management system has to achieve. Varmo maps the requirements for the management system in its modules and includes Annex A as a centrally maintained framework.
Annex A as a platform framework from the Starter plan
Annex A as a framework
All 93 controls from Annex A, grouped into organisational, people, physical and technological controls. Each requirement comes with our own explanation of its meaning and implementation guidance with possible evidence.
- Number and short title as in the standard
- Explanations in our own words, without the text of the standard
- Applicability, implementation and evidence per requirement
Clauses 4 to 10 in the modules
The requirements for the management system itself are not a checklist to tick off, but processes. There are dedicated modules for them.
- 4 Context: issues, interested parties, scope
- 5 Leadership: policy, roles, approvals
- 6 Planning: risk assessment, risk treatment, SoA, objectives
- 7 Support: training, acknowledgement, documents
- 8 Operation: measures, controls, security procedures
- 9 Performance evaluation: metrics, internal audit, management review
- 10 Improvement: findings and corrective actions
Statement of Applicability
The SoA is built from applicability, justifications, implementation and evidence. Every version is frozen and approved under the four-eyes principle.
Several standards
Mappings to NIST CSF 2.0, NIST SP 800-53 and NIS2 show where one implementation also covers requirements of other frameworks; equivalent or included requirements count as fulfilled. The coverage view compares frameworks by CSF function. Both are included from the Pro plan.
Readiness check before the audit
The ISO/IEC 27001 readiness check reviews clauses 4 to 10 including Annex A against your data and shows the gaps with a traffic light per chapter. It is a self-assessment and included from the Starter plan.
Related
ISO/IEC 27001 readiness check
How close you are to certification.
Frequently asked questions
Does Varmo include the text of the standard?
No. Number and short title correspond to the standard; explanations and implementation guidance are our own wording. For certification, you need the standard itself.
Is the 2013 version still supported?
The framework covers ISO/IEC 27001:2022. The transition period for certificates under the 2013 version ended on 31 October 2025.
FREE · ABOUT 5 MINUTES
How far along is your ISMS? Take the ISO 27001 self-assessment.
A traffic light per clause, your next steps and the right plan. No sign-up; your answers stay in your browser.
How close are you to ISO/IEC 27001?
In a personal demo, we show you the way to the readiness report, with no obligation. Or try it free for 30 days with every feature.