Skip to content
Varmo
DeutschSign inRequest a demo
SOLUTIONS · ISO 27001 CERTIFICATION

ISO 27001 certification: from readiness check to external audit.

Certification to ISO/IEC 27001 is granted by an accredited certification body after an external audit. Varmo guides you to the evidence required there and shows beforehand where gaps remain.

Request a demoTry it free
WHAT YOU GET
  • Clauses 4 to 10 and Annex A in one workflow
  • Statement of Applicability (SoA) with approval, print and CSV
  • Internal audit and management review in the same system
  • Readiness check before the certification audit (from Starter)

1. Lay the foundations

You define and approve the scope, context, interested parties and the information security policy. The setup assistant guides you through these steps.

  • Scope with four-eyes approval
  • Policy and topic-specific policies with versions and acknowledgement
  • Roles and responsibilities via functional roles

2. Assess and treat risks

You assess risks according to your methodology and acceptance criteria, decide on treatment and select the Annex A requirements. This produces the Statement of Applicability (SoA), which you approve and record as a version.

Approved version 1 of the Statement of Applicability (SoA) for ISO/IEC 27001 Annex A: approval by top management, key figures on applicability and implementation, reason and approver.
Every version is immutable, with date and approver; export as PDF and CSV.

3. Implement and evidence

For each requirement you record how it is implemented and what proves it. Measures, controls and documents are linked to the requirements, and tasks remind you of due dates.

4. Internal audit and management review

You run the internal audit with findings, corrections and effectiveness checks, and the management review with the inputs under ISO/IEC 27001 9.3, in the same system. Completed audits and reviews cannot be changed.

5. Ready for the certification audit?

From the Starter plan, the readiness check uses your data to show where gaps remain before the certification audit and records each status as a report. The free self-assessment on the website gives a first impression.

Overall status in the readiness check report: 81 per cent, 0 expected major and 7 minor nonconformities, below it the status for each of clauses 4 to 10 and for Annex A with icon and text.
Overall grade, expected nonconformities and a traffic light per clause, from the data of the demo organisation.

What stays outside the software

The certification audit is carried out by the certification body in two stages: first a review of the documentation, then a review of the implementation. Annual surveillance audits follow, and recertification after three years. Approvals under the four-eyes principle require at least two people.

Related

Frequently asked questions

Does Varmo certify our ISMS?

No. The certificate is granted by an accredited certification body after the certification audit. The software helps you build and run the ISMS and keep the evidence ready for the audit.

What evidence does the certification audit require?

Among other things the scope, the policy, the risk assessment and treatment plan, the Statement of Applicability, objectives, evidence of competence, results of monitoring and internal audit, the management review and how nonconformities were handled. This evidence is created in the software as part of the workflow.

Can we check beforehand where we stand?

Yes. The free self-assessment on the website gives a first impression. In the software, the readiness check from the Starter plan uses your own data to show which points are still open before the audit.

How close are you to ISO/IEC 27001?

In a personal demo, we show you the way to the readiness report, with no obligation. Or try it free for 30 days with every feature.

Request a demoTry it free