ISO 27001, running all year.
ISO/IEC 27001 asks for an information security management system that keeps working long after certification. TruOps keeps the evidence behind it current.
ISO 27001 maturity
Clauses and Annex A themes, scored 0 to 5
The same work also counts toward
Mapped coverage, with partial overlaps shown
Each mapping is labeled exact, partial, or inferred, with a source.
ISO/IEC 27001 is the international standard for an information security management system (ISMS). The 2022 edition sets management-system requirements in clauses 4 to 10 and lists 93 reference controls in Annex A, grouped into organizational, people, physical, and technological themes. Organizations are certified by an accredited certification body on a three-year cycle with annual surveillance audits.
- Published by
- ISO and IEC
- Current edition
- ISO/IEC 27001:2022
- Annex A
- 93 controls in 4 themes
- Certification
- 3-year cycle with surveillance audits
What ISO 27001 requires
The standard has two parts. Clauses 4 to 10 define the management system: context, leadership, planning (including risk assessment and treatment), support, operation, performance evaluation, and improvement. Annex A lists reference controls you select based on your risk assessment and justify in a Statement of Applicability.
| Annex A theme | Controls |
|---|---|
| Organizational | 37 |
| People | 8 |
| Physical | 14 |
| Technological | 34 |
The challenge
ISO 27001 is a management system that has to keep running. Most organizations have a binder that passed once and a Statement of Applicability that was accurate the week of stage 2.
- Annex A was mapped in a spreadsheet that no longer matches your controls.
- Internal audits and management reviews are calendar events with no live view of status.
- Every new framework (SOC 2, NIS2, 42001) means rebuilding the same evidence in a new template.
What you're probably using today
Almost nobody starts ISO 27001 from scratch. You already have a program somewhere, and TruOps picks up from there.
| What you use now | Where it falls short | With TruOps |
|---|---|---|
| Spreadsheets, shared drives, and email | Your program lives in folders named after last year's audit. Owners paste screenshots the week before fieldwork, and nothing is dated, so you can't show what was true last quarter. | Upload those same files. TruOps pre-fills the assessment from them, cites every answer, and keeps technical checks running so you have evidence for the whole period. |
| SOC 2 automation tools | Great for getting certified, with automated tests, a big framework library, and often a trust center. Maturity scoring, custom frameworks, and deeper risk or vendor work can fall outside what they cover. | Keep your automated checks. Use any framework as your anchor, map the rest with partial overlaps clearly marked, and run vendor and risk work in the same place. Start with the policies and reports you already have. |
| Enterprise GRC suites | They can model almost anything, but that flexibility usually runs through implementation partners and admins, so every change turns into a project. | AI reads your existing documents and sets up the program. Your first assessment opens pre-filled with sources, and you make changes by asking in plain language. |
2013 to 2022
The 2022 revision reorganized the 114 controls of the 2013 edition into 93, merging many and adding new ones such as threat intelligence, cloud services security, data masking, and secure coding. The transition period for certificates issued under ISO/IEC 27001:2013 ended on 31 October 2025.
How TruOps helps with ISO 27001
Pick ISO 27001 as your anchor, or map it to the framework you already run. TruOps keeps ISO 27001's own structure, down to the individual requirement, and shows coverage per requirement as satisfied, partial, or open, with the evidence behind each.
Upload what you have (prior reports, policies, spreadsheets) and TruOps pre-fills your ISO 27001 assessment with cited answers. Connected tools keep technical controls current on the schedule you set, and failed checks become findings with a recommended fix.
Each Annex A control is its own record with a status, owner, and evidence, so your Statement of Applicability always matches how you operate.
How TruOps helps
- Anchor or map
- Use ISO 27001 as your anchor or map it to another framework, and your work counts once.
- Pre-filled assessment
- Your ISO 27001 assessment opens with the answers your evidence supports already filled, each cited.
- Accurate coverage
- Partial coverage is clearly marked, with the remaining requirements listed.
- Continuous monitoring
- Technical controls checked against your tools, from hourly to quarterly.
- Findings with fixes
- Failed checks become grouped findings with a recommended action.
- Audit-ready snapshots
- Results saved as of their date, with the evidence trail attached.
Questions
How many controls are in ISO 27001:2022?
Annex A of ISO/IEC 27001:2022 lists 93 controls in four themes: organizational (37), people (8), physical (14), and technological (34).
Is ISO 27001 certification mandatory?
No. It's voluntary, but many customers and partners require it, especially outside the United States.
What is a Statement of Applicability?
A document listing which Annex A controls you apply, which you exclude, and why. It's a required ISO 27001 document.
Can TruOps map ISO 27001 to SOC 2?
Yes. Use ISO 27001 as your anchor or map it to SOC 2 and others. TruOps shows coverage requirement by requirement, including partial overlaps.
Do we have to rip out the tools we already use?
No. TruOps connects to your cloud, identity, endpoint, vulnerability, and code tools. Spreadsheets, prior reports, and policies upload into the Data Room. If you're moving from a SOC 2 automation tool or an enterprise GRC suite, you bring over your frameworks, evidence, vendors, and risks.
Can we bring our existing assessments, control lists, and vendor files?
Yes. Upload workbooks, reports, policies, and vendor exports. TruOps turns them into structured questionnaires, controls, and risks, each linked to the file it came from, for you to review.
Does TruOps replace our auditor, QSA, or certification body?
No. Only a licensed auditor, QSA, C3PAO, or accredited certification body can issue the opinion. TruOps keeps your evidence current, sourced, and dated so fieldwork goes quickly.
Related
Do the work once and count it everywhere it applies.
→FrameworksSOC 2AICPA Trust Services Criteria: Type I and Type II readiness.
→FrameworksISO/IEC 42001The certifiable AI management system standard.
→LearnFramework crosswalkMapping one framework's requirements to another's.
→Use casesAudit preparationWalk into fieldwork with dated, sourced evidence.
→See it run on your own data.
Book 30 minutes with a GRC specialist. Bring a real document, like a SOC 2 report, risk register, or vendor list (redacted is fine), and we'll show TruOps AI working on it.