ISO 27001, done to the last control
ISO 27001 asks you to run an information security management system and prove it to an external auditor. NorthIron covers 93 of 93 Annex A controls on one atomic control set, keeps your Statement of Applicability in the platform, and files evidence against each control as it is collected, so the certification audit starts from a record rather than a scramble.
What this looks like today
The standard is a management system, not a checklist
Clauses 4 to 10 ask for scope, risk assessment, objectives, internal audit and management review. Annex A is only the control catalogue. Teams that treat it as a list of boxes discover the gap at stage one.
The Statement of Applicability drifts
It is written once in a spreadsheet, then controls change, exclusions get forgotten and the justification no longer matches what is running. The auditor reads it first.
Surveillance audits restart the work
Certification is a three year cycle with an audit every year. When evidence lives in folders, each one is rebuilt from scratch.
The standard, mapped to one control set
93 of 93 Annex A controls
NorthIron resolves 966 source framework controls to 144 atomic controls. ISO 27001 Annex A is covered in full, and each Annex A control points at the atomic controls and the evidence that satisfy it.
- Full Annex A coverage on the atomic control set
- Evidence mapped to each control
- Statement of Applicability maintained in the platform
The management system clauses
Scope, the risk assessment and treatment plan, policies, internal audit and management review are tracked as work with owners and dates, not as documents in a drive. The risk register starts from a curated library rather than a blank sheet.
What the platform collects for you
Connected cloud, identity and code systems are read with read-only access, and what they show is filed against the controls that need it. Access reviews, awareness training completion and cloud posture findings arrive as evidence without anyone taking a screenshot.
What stays with your team
Some evidence has to come from a person: a signed policy, a supplier contract, a board minute. It is uploaded against its control, read by the AI evidence review, and accepted or rejected by a named practitioner before the auditor sees it.
The second framework is already half done
Because ISO 27001 sits on the same atomic control set as SOC 2, the evidence you collect for one counts for the other. Most platforms sell you ISO 27001. NorthIron sells you the control set underneath it.
What you have at audit time
- 93 of 93 Annex A controls covered
- A Statement of Applicability that stays current
- Evidence filed against each control as it is collected
- A named practitioner approval on every accepted item
- Scoped, view-only access for your certification body
- Surveillance audits that start from last year's record
Questions we are asked about ISO 27001
Does NorthIron certify us?
No. Certification is issued by an accredited certification body after its own audit. NorthIron runs the programme and prepares the evidence, and your auditor reviews it inside the platform through a scoped link.
Which version of the standard do you cover?
ISO/IEC 27001:2022, including the 93 controls of its Annex A.
Can you help with the implementation itself?
Yes. NorthIron is built by a working security practice, and implementation and audit coordination are available alongside the platform.
We already hold SOC 2. How much carries over?
Most of the evidence. Both frameworks resolve to the same atomic controls, so the work that remains is the ISO specific part: the management system clauses and the Statement of Applicability.
See it against your own programme
The call opens the product, not a deck. A practitioner walks you through the ISO 27001 control map with your scope in front of them.