Swiss ISO 27001 Compliance Software

ISMS foundation

Information Security Policy

The ISO/IEC 27001 Information Security Policy is a top-level, senior-management document that commits to protecting information by defining objectives, scope, principles, and the overall approach for managing risk, controls, and ongoing improvement. It establishes leadership support, enables risk-based decisions, ensures roles and expectations, supports compliance, and guides behaviour, implementation, and monitoring of the information security program.

Key points:

Leadership commitment, resource allocation, and accountability.
Foundation for risk management and continual improvement (Plan-Do-Check-Act).
Defines scope, objectives, and guiding principles/controls.
Guides behaviour (roles, responsibilities, incident reporting, acceptable use).
Supports compliance with legal, regulatory, and contractual obligations and informs procedures, training, and audits.

Threat analysis

Risk Evaluation

The ISO/IEC 27001 risk evaluation process involves identifying information assets, threats and vulnerabilities, and then assessing the potential impact and likelihood of each risk to determine its level. This evaluation uses defined risk criteria (severity, probability, and tolerable risk) to produce a risk rating (e.g., high, medium, low) for each threat–vulnerability pair, considering both inherent and residual risk after existing controls. The results inform decisions on risk treatment options, acceptance, and prioritization, and they form the basis for the organization's risk treatment plan and ongoing monitoring.

Control selection

Statement of Applicablity

The Statement of Applicability (SoA) in ISO/IEC 27001 is a formal document that lists the controls from Annex A that the organization has chosen to implement to manage information security risks. It explains for each control whether it is applied or excluded and provides justification for any exclusions, as well as the current status and any implemented filters or compensating controls. The SoA links the results of risk assessment and treatment to the actual controls in place, serving as a baseline for monitoring, internal audits, and certification, and it demonstrates how the information security management system (ISMS) satisfies the required controls and management expectations.

Control implementation

Risk Treatment Plan

The risk treatment plan is a documented plan that defines how identified information security risks will be treated, including the chosen controls, actions, owners, timelines, and resources needed to reduce risk to an acceptable level. It links the risk assessment results to specific control measures and any necessary compensating controls, and it specifies residual risk acceptance criteria and how progress will be monitored. The plan also assigns responsibilities, sets milestones, and aligns with the organization’s overall ISMS objectives to support ongoing risk management and continual improvement.

Implementation status

Controls Implementation

For every Information Security Officer, the current status of the implementation of controls is an important aspect. With the Risk Treatment Console you are able to monitor the impementation status of the controls.

Compliance review

Internal Audit

An internal audit is a systematic, independent, and documented activity that assesses the ISMS against the ISO standard and the organization’s own requirements. It evaluates whether the information security controls are effectively implemented and maintained, and whether the ISMS complies with the SoA, risk treatment plans, policies, and procedures. The audit uses objective evidence to identify nonconformities and opportunities for improvement, and it results in an audit report and corrective actions to enhance the system, with findings tracked through an ongoing audit program.

ISO certification

External Audit

An external audit is conducted by an accredited certification body to verify that the organization's ISMS conforms to the standard and to the scope defined in the certificate. It typically includes a document review and an on-site assessment with interviews and evidence gathering to evaluate the implementation and effectiveness of controls, the SoA, risk treatment, and supporting processes. The audit results in findings or nonconformities that require corrective actions; if all criteria are met, a certification is issued and surveillance audits are conducted at intervals to maintain the certification.

You need an ISMS according to ISO27001:2022? No problem.