EN
Book an expert call

AnnexOps Compliance

ISO 27001 Compliance Automation: Controls You Already Run

AnnexOps tracks ISO/IEC 27001:2022 as 118 requirements, clauses 4 to 10 and the 93 Annex A controls, and rolls up assessed requirement coverage from controls you already run. Read-only connectors collect configuration metadata into a hash-chained evidence vault, and your Statement of Applicability exports from the same record. Versioned rules. Evidence your auditor can verify.

Book an ISO 27001 expert call

Clauses 4 to 10 tracked · All 93 Annex A controls · Exportable Statement of Applicability

How ISO 27001 automation works

Rules as data, evidence you can verify

Rules as data

Every ISO 27001 requirement, clauses 4 to 10 and the 93 Annex A controls, is a versioned rule that cites its clause. A second auditor re-running a check gets the same answer. No LLM decides a verdict.

Derivation, not judgment

Assessed requirement coverage is derived from recorded facts: which controls run, which evidence attaches, which risks are treated. The platform shows the gap. Scope (clause 4.3), risk acceptance (clauses 6.1.2 and 6.1.3 f) and Annex A exclusions (clause 6.1.3 d) stay human decisions.

Agents draft, you sign

Policies start from templates and agents draft the edits. Suggestions land in Approvals. Nothing counts until a named owner signs. Each approval, policy version and staff acknowledgement becomes an audit record, the documented information clause 7.5 asks for.

Evidence you can verify

Connectors to GitHub, AWS and Microsoft Entra ID read configuration metadata only. Each item is stored append-only and hash-chained per connection, so tampering is detectable and your auditor can check the chain rather than trust a screenshot.

Core capabilities

The ISMS record, from one place

Read-only evidence, automatically checked

Evidence from GitHub, AWS and Microsoft Entra ID lands in the vault read-only, append-only and hash-chained. 743 automated checks grade it against each framework you hold. ISO 27001 check mappings are AnnexOps-authored and under specialist review. Where a check maps to a control such as Annex A 8.5 or 8.8, a failing check shows as a named gap.

Requirements and Statement of Applicability

ISO/IEC 27001:2022 is pre-loaded as 118 requirements: clauses 4 to 10 and the 93 Annex A controls in four themes. You mark each control applicable or excluded, record the justification, and the clause 6.1.3 d) Statement of Applicability exports for your certification body.

One control library, many frameworks

A Common Control Library of 211 shared controls, 148 of them linked to ISO 27001. Evidence attaches to the control, not the framework, so an access review recorded once counts toward Annex A 5.18, SOC 2 CC6, NIS2 Article 21 and DORA.

Policies with versioned approvals

Start from templates for the information security policy (clause 5.2) and the topic-specific policies Annex A 5.1 expects. Each version is approved by a named owner, published to staff and acknowledged, with the acknowledgement stored as evidence for clause 7.3 awareness and Annex A 6.3.

Risk, asset, supplier and incident registers

A risk register for clause 6.1.2 assessment and 6.1.3 treatment, with owners and dates. Asset, supplier, people and incident registers hold the records behind Annex A 5.9, 5.19 to 5.22, 5.25 to 5.28 and 6.1, 6.2, 6.5 and 6.6. Access reviews on a quarterly cadence are recorded as evidence for Annex A 5.18, which asks for access rights to be reviewed at regular intervals.

Internal audits, reviews, Audit Room

Internal audits for clause 9.2 and management reviews for clause 9.3, on the record with owners, dates and findings. Your auditor gets a read-only Audit Room scoped to ISO 27001 that ends on a date you set, for stage 1, stage 2 and surveillance.

Integrations

Works With Your Existing Stack

  • GitHub
  • AWS
  • Microsoft Entra ID
  • Jira
  • SharePoint
  • GitLab (soon)
  • Microsoft Azure (soon)
  • Google Cloud (soon)
  • Okta (soon)
  • Google Workspace (soon)
  • Microsoft Intune (soon)
  • Jamf (soon)

FAQs

Some Frequently Asked Questions and Their Answers

Who issues the ISO 27001 certificate, and what does AnnexOps do in the audit?

AnnexOps is not a certification body. Certification is decided by an accredited certification body under ISO/IEC 17021-1 and ISO/IEC 27006-1. The cycle is a stage 1 documentation review, a stage 2 implementation audit, annual surveillance audits, and recertification before the three-year certificate expires. AnnexOps helps you prepare for certification and organise evidence for your auditor: requirements tracked, Statement of Applicability exported, and a read-only Audit Room for the fieldwork. It is not a guarantee of passing the audit.

How does AnnexOps handle the Statement of Applicability for the 93 Annex A controls?

Clause 6.1.3 d) requires a Statement of Applicability listing the necessary controls, the justification for including them, whether they are implemented, and the justification for excluding any Annex A control. AnnexOps pre-loads all 93 controls of the 2022 edition in four themes: organisational (37), people (8), physical (14) and technological (34). You record applicability and justification per control, evidence attaches to the implementing control, and the SoA exports for your certification body.

We already have SOC 2, or we are working on NIS2 and DORA. How much of ISO 27001 is already covered?

The Common Control Library holds 211 shared controls, 148 linked to ISO 27001 and 154 to SOC 2. An access review (Annex A 5.18), an incident record (5.25 to 5.28) or a supplier assessment (5.19 to 5.22) is recorded once and counted toward each framework. When you add ISO 27001, its framework card shows the percentage of requirements your existing evidence already covers, computed for your organisation. It can be low or zero. The figure is indicative: assessed requirement coverage, not a compliance score.

Is the ISO 27001 requirement content in AnnexOps reviewed by lawyers?

The ISO/IEC 27001 requirement content in AnnexOps is AnnexOps-authored, with specialist review in progress, and the product labels it that way. The 118 requirements follow the structure of the 2022 edition: clauses 4 to 10 and the 93 Annex A controls, each cited by identifier. The 2022 edition itself was amended in 2024 (Amendment 1: climate action considerations in clauses 4.1 and 4.2). The mapping from automated checks to Annex A controls is also draft. Rules are versioned data, so a second auditor re-running a check gets the same answer. EU AI Act and GDPR content is reviewed by counsel. None of it is legal advice.

News & Articles

Prepare for ISO 27001 certification from one record

Start with ISO 27001, add SOC 2, NIS2 or DORA as you grow, and bring your auditor into a read-only room.

Book an ISO 27001 expert callTalk to us
AI Analyzer