ISO/IEC 27001 · 2022

ISO/IEC 27001:2022 is the international standard for an Information Security Management System (ISMS). It covers both the management system (clauses 4–10) and the Annex A control set, the framework of choice when you sell globally. Keel runs the whole programme in one place: scope, risk assessment and treatment, the controls you apply, the Statement of Applicability, internal audit and management review, with the evidence a certification body will sample.

100+

requirements tracked

Core plans

Access

Add-on from $39/mo

Start your 14-day free Pro trial with ISO/IEC 27001 See pricing

Scope

How much of the standard Keel models

Models its declared scope in full

Keel authors every leaf requirement in the scope declared below, with nothing inside that scope left out. A test fails the build if the authored count and the declared count ever diverge, so this framework cannot quietly lose requirements after the fact.

Authored in Keel: 100+ requirements
In Keel’s scored scope: 100+ leaf requirements

The reading bar93 index cards, one per controlISO/IEC 27001:2022 Annex A, one card per control, in drawer order: A.5 Organizational (37), A.6 People (8), A.7 Physical (14), A.8 Technological (34). Keel scores each card. A control leaves the denominator only when you mark it out of scope.

What Keel scores here, and what it does not

Keel publishes this for every framework it ships, complete or not, so a readiness percentage can be read against a denominator you can see. Compare every framework

Who it is for

Who needs ISO/IEC 27001?

Companies selling into Europe and beyond, where ISO 27001 is the common language
Teams that want a certifiable, audited standard rather than an attestation
Organizations building a durable security program, not a one-off checklist

What Keel does

How Keel helps with ISO/IEC 27001

The full ISMS clauses plus the Annex A controls, crosswalked to your other frameworks
Statement of Applicability and evidence tracking built in
A risk register and policy library tied to the controls they justify
Internal audit, nonconformities and corrective action, and management review on every plan
Readiness scoring across the whole standard so nothing slips before the audit

Collect once, comply everywhere

ISO/IEC 27001 shares canonical controls with FedRAMP Rev5 Class D, FedRAMP Rev5 Class C and NIST SP 800-53 and others in the catalog. Implement one of those controls and it counts toward every framework it satisfies, so adding ISO/IEC 27001 rarely means starting from scratch.

Shares canonical controls with

CIS Critical Security Controls shares canonical controls
PCI DSS shares canonical controls
SOC 2 shares canonical controls
SOX (Sarbanes-Oxley) Section 404 shares canonical controls
NIST Cybersecurity Framework shares canonical controls
NIST SP 800-53 shares canonical controls
FedRAMP Rev5 Class B shares canonical controls
FedRAMP Rev5 Class C shares canonical controls
FedRAMP Rev5 Class D shares canonical controls
FedRAMP 20x shares canonical controls
FedRAMP Consolidated Rules shares canonical controls
NIST SP 800-171 shares canonical controls
HIPAA shares canonical controls
GDPR shares canonical controls
COPPA shares canonical controls
Google Play Families no shared canonical controls
Amazon Appstore Child-Directed Apps no shared canonical controls
Apple App Store Kids Category no shared canonical controls
PIPEDA shares canonical controls
ISO 9001 shares canonical controls
AI Governance Essentials shares canonical controls
ISO/IEC 42001 shares canonical controls
NIST AI Risk Management Framework shares canonical controls
EU AI Act no shared canonical controls
ESG Essentials shares canonical controls
US Employment Law - Federal Baseline shares canonical controls

A framework is lit when at least one canonical control satisfies both ISO/IEC 27001 and that framework. Unlit means none of them do, which is an absence rather than a judgment about that standard.

Questions about ISO/IEC 27001 in Keel

What does ISO 27001 compliance software do?

It keeps the ISMS in one place: scope, risk assessment and treatment, the Annex A controls you apply, the Statement of Applicability, policies, internal audit, corrective action and management review, plus the evidence behind each. Keel links all of it to one control library, so the same work also counts toward SOC 2 and the other frameworks it crosswalks to.

Can Keel certify us to ISO 27001?

No. An ISO 27001 certificate is issued by a certification body, and buyers generally expect an accredited one. Keel runs the management system and keeps the records that body audits, and the certification fee is separate from your Keel plan.

Which Keel plan includes ISO 27001?

ISO 27001 is a paid framework. It is included from Starter, or you can add it to the Free plan as a monthly framework add-on. The internal audit programme, nonconformities and corrective action, and management review are on every plan.

GRC software pricing

Does Keel produce the Statement of Applicability?

Yes. The Statement of Applicability is built from your Annex A decisions: you mark each Annex A control included or excluded and record why, its implementation status is pulled live from the controls you have mapped, and the result exports as a branded PDF.

Statement of Applicability

Features that help with ISO/IEC 27001: Risk register · Policy management · Vendor risk management · Controls & crosswalk · Evidence management

Software guides: ISO 27001 compliance software

By industry: ISO 27001 for SaaS companies · ISO 27001 for manufacturers · ISO 27001 for fintech companies · ISO 27001 for healthcare and healthtech · ISO 27001 for AI companies

Other frameworks: CIS Critical Security Controls · PCI DSS · SOC 2 · SOX (Sarbanes-Oxley) Section 404 · NIST Cybersecurity Framework · NIST SP 800-53 · All frameworks