ISO 27001 Software
ISO 27001:2022 with all 93 Annex A controls and ISMS clauses 4–10, auto-generated Statement of Applicability, evidence automation from 46 integrations, and cross-mapping to SOC 2, NIST CSF, and GDPR. Certification-ready without a compliance team.
ISO/IEC 27001 is the international standard for Information Security Management Systems (ISMS). The 2022 revision restructured 93 Annex A controls into four themes — Organizational (37), People (8), Physical (14), Technological (34) — and added 11 new controls covering threat intelligence, cloud service use, secure development lifecycle, and data masking.
The certification requires documented evidence that your ISMS satisfies both the management-system clauses (4–10) and the Annex A controls you've scoped in. Transition from the 2013 version ended October 31, 2025, so any certification going forward is on 2022.
For a small business, the audit-prep work dominates. Radius360 collapses it by pre-loading the full control set, generating your Statement of Applicability from your actual scope, and feeding evidence from the tools you already run.
All 93 Annex A controls + ISMS clauses 4–10 as first-class items. Control descriptions, implementation guidance, and testing procedures built in.
Your Statement of Applicability, risk treatment plan, and ISMS scope document generate from your actual inventory and risk register — not blank Word templates.
Annex A controls mapped to SOC 2, NIST CSF, HIPAA, PCI DSS, CMMC, and 25+ others. One evidence upload satisfies multiple audits simultaneously.
23 deep integrations pull evidence tied to specific Annex A controls. Access reviews from Okta, vulnerability scans from Tenable, endpoint data from CrowdStrike — all tagged to the controls they satisfy.
AI-generated policy language cites your actual environment (account counts, cloud configs, integrations) rather than ISO template boilerplate. Auditors confirm against reality; your policies should match.
Running ISO 27001 alongside SOC 2 or HIPAA doesn't cost extra. The platform is priced for your whole program, not per framework or per audit cycle.
The catalog carries ISO 27001:2022 with the 93 Annex A controls restructured into the four themes (Organizational, People, Physical, Technological). Evidence collected under the 2013 layout is automatically re-mapped to 2022 equivalents, so organizations mid-transition don't redo the work.
Yes — that's the design target. Built-in ISO 27001 control catalog, starter policies aligned to the Annex A themes, evidence automation from 46 integrations so you don't have to manually chase artifacts, and AI-generated Statement of Applicability (SoA) + ISMS documentation. Most small teams get a running ISMS in a day instead of a quarter.
Yes. Evidence exports include source attribution (which system, when, by whom) and control mappings that registrars expect. Most CBs care that the evidence is authentic and traceable, not which platform produced it. The generated SoA and risk treatment plan follow the standard ISO formats.
Comparable ISO 27001 depth; additional value in multi-framework support (run ISO in parallel with SOC 2, NIST CSF, GDPR with cross-framework evidence sharing) and multi-tenant architecture for consultants serving multiple clients. If you only ever run ISO and only for one company, a pure ISO tool may fit; for broader or multi-client programs, the math tips toward Radius360.
Yes. Clauses 4 through 10 (context, leadership, planning, support, operation, performance evaluation, improvement) are tracked as first-class items alongside the 93 Annex A controls. Internal audit evidence, management review output, and improvement actions all live in the platform.
Seven-day free trial, full ISO catalog, no credit card. See how much prep time cross-mapping compresses.
Start free trial