The ISO 27001 tool to run your ISMS risk management

ISO/IEC 27001 is the requirements standard: it sets out what an ISMS must contain, and it is the one you are certified against. ISO/IEC 27002 is a guidance document that explains, control by control, how to implement what Annex A of ISO 27001 lists. No body issues an ISO 27002 certificate. In practice the audit is conducted against ISO 27001, while your team works from ISO 27002 as the implementation handbook.

The ISO/IEC 27001:2022 edition reorganised Annex A into 93 controls grouped under four themes: organisational, people, physical and technological. The 2013 edition listed 114 controls across 14 clauses. None of them applies automatically: you select the controls your risk assessment justifies and record the reasoning for every exclusion in the statement of applicability, usually the first document an auditor opens.

No. ISO 27001 is a voluntary standard and no general law requires certification. What makes it necessary is usually commercial: contract clauses, tenders and customer security questionnaires. The organisations that need it first are therefore those selling to large accounts, regulated firms or the public sector. It also gives you a documented base when answering NIS2 or DORA, though a certificate is not in itself evidence of compliance with them: their own obligations still have to be demonstrated separately.

The initial audit is carried out by an accredited certification body and comes in two stages. Stage 1 is largely documentary: it checks that the ISMS exists and that the statement of applicability holds together. Stage 2 examines whether the selected controls actually work. The certificate then runs on a three-year cycle, with surveillance audits in between and a recertification audit at the end, so the ISMS has to stay current all year rather than wake up before each visit.

None in particular. The standard asks for a defined, documented and repeatable risk assessment process with explicit acceptance criteria, but leaves the choice of method open. ISO/IEC 27005 offers guidelines, and the EBIOS Risk Manager method, published by the French national cybersecurity agency ANSSI, is widely practised in France. What the auditor tests is not the method itself, but whether you apply it consistently from one year to the next.

Enough to start, rarely enough to sustain. A current ISMS means keeping risks, selected controls, the treatment plan and the supporting evidence connected at all times. Once those links are spread across separate workbooks, the statement of applicability drifts out of step and the evidence gathered for the initial audit quietly ages without anyone noticing. A dedicated tool also keeps a dated trail of who decided what, which a shared file cannot produce on demand.

In Vailor, it works on the risk assessment: the AI reads your documents (architecture, policies, contracts) and prefills the analysis fields from excerpts, which cuts the matching and copying work. The compliance side does not rely on generative AI: your controls, evidence and actions stay in your teams' hands. The judgement stays human: you decide the exclusions and defend them in front of the auditor. It should not be confused with ISO/IEC 42001, published in 2023, which covers the management of AI systems themselves.