ISO/IEC 27001:2022 · Information security

Your ISO 27001 ISMS — every clause and Annex A control, assessed.

StayEvident assesses your ISMS documentation against clauses 4–10 and all 93 Annex A controls, generates your Statement of Applicability from your scope decisions, and links the evidence your auditor will ask for.

Get started See how it works

All 93 Annex A controls

Clauses 4–10 plus every Annex A control across the four themes — 134 requirements, each assessed against your policies and procedures with the passages cited.

An SoA that stays true

Exclude a control or a whole theme with a justification, record why included controls apply, and download a Statement of Applicability built from the same decisions.

Alongside ISO 9001

Already certified to ISO 9001? Evidence you've confirmed for equivalent clauses — internal audit, management review, documented information — is offered for reuse.

Coverage

Clauses 4–10 and all four Annex A themes.

Every requirement is assessed against your documents. The registers your ISMS depends on — risks, audits, CAPAs, competence, suppliers — sit alongside.

ClauseRequirementIn StayEvident

4–10ISMS clausesAssessed clause by clause by AI against your documents; you confirm or override each verdict

6.1.2Information security risk assessmentRisk register with a configurable matrix and inherent/residual scoring

6.1.3Risk treatment and the SoAStatement of Applicability generated from your scope decisions, exportable as PDF

7.2CompetenceCompetence requirements, matrix, training plans and records

7.5Documented informationDocuments with types, tags, version history and search

9.2Internal auditAudit programmes, audits with checklists, findings

9.3Management reviewReviews with inputs and outputs, exported as a PDF pack

10.2Nonconformity and corrective actionCAPAs tracked through their lifecycle to closure

A.5Organisational controls (37)Each control assessed; supplier controls A.5.19–A.5.22 govern the supplier register

A.6People controls (8)Each control assessed; excludable individually or as a theme

A.7Physical controls (14)Each control assessed; excludable individually or as a theme

A.8Technological controls (34)Each control assessed; excludable individually or as a theme

Common questions

Does it cover the 2022 revision?+

Yes. StayEvident models ISO/IEC 27001:2022, including Annex A's 93 controls in four themes (organisational, people, physical, technological) and the controls new in the 2022 revision.

How are Annex A exclusions handled?+

Exclude an individual control or a whole theme, with a justification. Exclusions inherit down the tree, excluded controls aren't assessed, and they appear on your SoA with the justification. See Statement of Applicability.

Is our ISMS documentation used to train AI?+

No. Excerpts are sent to our AI providers only to perform the assessment and are never used to train models. Every AI verdict is reviewed by a person. See Security.

Can our certification body's auditor see the evidence?+

Invite them with the read-only auditor role to use audit-day mode, or hand over the audit pack and SoA as PDFs. See Audit-day mode.

Does StayEvident replace our copy of ISO/IEC 27001?+

No. Control guidance in StayEvident is written in our own plain English. You still need your own licensed copy of the standard.

Stop dreading audit season.

Upload your documents, adopt a standard, and see clause-by-clause coverage — including the gaps you didn't know about.

Get started Talk to us