ISO 27001 readiness

ISO/IEC 27001 certification is issued by an accredited certification body after a two-stage audit of your information security management system (ISMS): Stage 1 reviews documentation, Stage 2 tests that the ISMS operates. Certificates last three years with annual surveillance audits. Certificates against the 2013 edition expired on 31 October 2025; audits are now against ISO/IEC 27001:2022.

Any organisation, of any size. You define the ISMS scope (which business units, locations and systems), assess information security risks, and choose controls from Annex A in a Statement of Applicability, justifying any exclusions.

• ISMS clauses 4–10. Context and scope, leadership commitment, risk assessment and treatment, resources and competence, operation, internal audit, management review and continual improvement.
• Statement of Applicability. Every one of the 93 Annex A controls is listed as applicable or not, with a justification and implementation status.
• Organisational controls (A.5). 37 controls: policies, roles, asset inventory, information transfer, supplier security, incident management, legal and privacy requirements.
• People controls (A.6). 8 controls: screening, terms of employment, awareness and training, disciplinary process, remote working.
• Physical controls (A.7). 14 controls: secure areas, equipment protection, clear desk, secure disposal.
• Technological controls (A.8). 34 controls: authentication, logging, data masking, data leakage prevention, cryptography, secure development life cycle and secure coding.

14 RuleFix rules run when ISO 27001 is selected on a project. 10 of the framework's controls have at least one rule mapped to them. The table is generated from the rule catalogue, so it always matches what the scanner runs.

A mapping means the rule checks part of that control in application code or configuration. Passing every rule does not satisfy a control: each one also needs process, people and infrastructure work that no code scanner can see.

Most of an audit is organisational. You need these in place regardless of what any scan finds:

• The management system itself. Scope, risk methodology and risk register, Statement of Applicability, internal audits and management reviews (clauses 4–10).
• Organisational controls. Most of A.5 — policies, asset ownership, supplier agreements, incident management, business continuity.
• People and physical controls. All of A.6 and A.7.
• Technological controls outside code. Endpoint protection, network segregation, backup, capacity management, monitoring operations (for example A.8.1, A.8.7, A.8.13, A.8.16, A.8.22).

Select ISO 27001 on each project in scope. Every scan then records findings with stable fingerprints. An issue becomes Fixed when a complete scan no longer finds it, when your agent resolves it with a confirming re-scan, or when a person marks it — and every status change is written to the audit log with who made it. The evidence report (print to PDF or JSON) collects the latest scan, score history, open and resolved findings and triage decisions per framework.

• A.8.25 (secure development life cycle) and A.8.29 (security testing in development and acceptance) ask you to test software for security during development. RuleFix scan history per project is direct evidence that this happens on every change.
• Reference RuleFix in your Statement of Applicability as the implementation evidence for the Annex A controls listed below, and attach a recent evidence report.
• Use findings and their resolution as input to the risk register and to corrective-action records (clause 10.2) when the same rule keeps firing.
• Internal auditors can re-run a scan on a sample of repositories and compare fingerprints with the report, which makes the evidence easy to re-perform.

• Define the ISMS scope and get leadership sign-off.
• Choose a risk methodology, build the asset inventory and risk register.
• Draft the Statement of Applicability against the 2022 Annex A.
• Turn on RuleFix with ISO 27001 selected for repositories in scope and record it as the control for secure coding and security testing.
• Write the mandatory documented information (policy, risk treatment plan, SoA, objectives, competence records).
• Run awareness training and record attendance.
• Complete an internal audit and a management review before Stage 1.
• Book Stage 1 and Stage 2 audits with an accredited certification body.