ISO/IEC 27001:2022: the international reference standard for information security management, increasingly required by US enterprise procurement, vendor risk assessments, and federal contracts.

Documentation kit · ISO/IEC 27001:2022

Your ISO/IEC 27001 documentation, without starting from scratch.

Word and Excel templates to build your ISMS, document the Annex A controls and prepare the certification audit.

Clauses 4 to 10 and the 93 Annex A controls
Risk assessment, Statement of Applicability, treatment plan
105 editable files and an internal audit grid
NIST CSF 2.0, SOC 2, GDPR: cross-compliance matrix included

Buy the kit · $389

License per legal entityInstant download30-day money-back guarantee

105

Documents included

7 + 93

Clauses + Annex A controls

100%

Requirements mapped

2022

Latest revision

Who this kit is for

Designed for organizations that process, host or protect sensitive data.

Four profiles, one need: an ISO/IEC 27001 documentation base ready to adapt.

CISOs and security leaders

Build or consolidate the ISMS, prepare certification, align with the 93 Annex A controls.

ISMSCertificationAnnex A

SaaS providers and tech companies

Answer vendor questionnaires (CAIQ, SIG) and the security clauses of enterprise customers.

SaaSHostingMSPs

IT departments and CIO offices

Security governance, business continuity and compliance on one coherent documentation base.

GovernanceContinuityCompliance

Consultants and advisory firms

A documentation base to support clients through ISO/IEC 27001 certification.

Client engagementsFirm license on request

What is in the kit

105 documents organized by ISO/IEC 27001:2022 clause and Annex A theme.

The kit covers clauses 4 to 10 and the 4 Annex A themes: organizational, people, physical, technological. That is the 93 controls to assess in the Statement of Applicability.

Master document list · ISO/IEC 27001:2022

Version 2.0, May 2026

105 documents · 85 Word · 20 Excel

Clause 4 · Context of the organization

6 documents · Internal and external issues, interested parties, ISMS scope, process map, ISMS manual.

W
Internal and External Context Analysis Procedure (4.1)
W
Map of Processes Covered by the ISMS
X
Interested Parties and Requirements Matrix
X
Register of Strategic Security Issues
W
ISMS Scope Definition Document
W
Information Security Management System Manual

Clause 5 · Leadership

6 documents · Management commitment, security policy, org chart and RACI, role descriptions, user charter.

W
Information Security Policy Communication Procedure
W
Information Security Role Descriptions
X
ISMS Organization Chart and Security RACI Matrix
W
Management Commitment Charter
W
Standard User Charter
W
Management-Signed Information Security Policy

Clause 6 · Planning

9 documents · Risk assessment method, asset register, treatment plan, Statement of Applicability, objectives, changes.

W
Risk Assessment Methodology with Rating Scale (6.1.2)
W
Change Planning Procedure (6.3)
W
ISMS Change Request Form
X
Statement of Applicability
X
Risk Analysis Matrix and Threat Catalog
X
Risk Treatment Plan
X
Information Asset Register
X
Residual Risk Acceptance Register
W
Security Objectives and Implementation Plan

Clause 7 · Support

6 documents · Resources and competence, awareness, communication, document control, records.

W
Internal and External Communication Procedure (7.4)
W
Document Control Procedure (7.5)
W
Records Management Procedure
W
Annual Awareness Plan and Training Procedure
X
Information Security Resource Plan and Competency Matrix
X
Training and Awareness Register

Clause 8 · Operation

5 documents · Operational control, risk assessment and treatment, outsourced processes.

W
ISMS Operational Control Procedure (8.1)
W
Real-World Risk Assessment Procedure (8.2)
W
Operational Risk Treatment Procedure (8.3)
W
Control of Outsourced Processes and Services Procedure (8.1)
W
Risk Assessment Report and Action Plan

Clause 9 · Performance evaluation

4 documents · Monitoring and measurement, internal audit program, management review.

W
Monitoring Measurement Analysis and Evaluation Procedure (9.1)
W
ISMS Internal Audit Procedure and Program (9.2)
W
Management Review Procedure (9.3)
W
Management Review Minutes Template

Clause 10 · Improvement

4 documents · Continual improvement, nonconformities and corrective actions.

W
Continual Improvement Procedure (10.1)
W
Nonconformity and Corrective Action Management Procedure (10.2)
W
Nonconformity and Corrective Action Form
X
ISMS Nonconformity Register

Annex A.5 · Organizational controls

27 documents · Policies, assets, classification, access, suppliers and cloud, incidents, continuity, privacy, compliance, generative AI.

W
Procedure for Contact with Authorities and Special Interest Groups (A.5.5-6)
W
Threat Intelligence Monitoring Procedure (A.5.7)
W
Procedure for Integrating Information Security into Project Management (A.5.8)
W
Information Classification, Labeling and Transfer Procedure (A.5.12-14)
W
Intellectual Property Protection Procedure (A.5.32)
W
Records Protection Procedure (A.5.33)
W
Personal Data Protection Procedure GDPR (A.5.34)
W
Independent Review and Compliance with Policies Procedure (A.5.35-36)
W
Third-Party and Supplier Access Management Procedure (A.5.19, A.5.21)
W
Periodic Access Review and Recertification Procedure (A.5.18, A.8.2)
W
Cyber Crisis Management Procedure (A.5.24-26)
W
Data Protection Impact Assessment (DPIA) Template
W
Continuity and Restoration Test Report Template
W
Incident Response Playbooks, Ransomware, Data Leak, Compromise, DDoS
W
Incident and Breach Notification Templates, State Data-Breach Laws, FTC, CISA-CIRCIA
W
Security Incident Management Plan
W
Information Security Business Continuity Plan and ICT Readiness Plan
X
Information Security Roles RACI Matrix and Separation of Duties Procedure
X
Information Asset Register and Acceptable Use Policy
X
Register of Legal Regulatory and Contractual Requirements
X
GDPR Records of Processing Activities
W
Documented Operating Procedures
W
Information Security Policy and Topic-Specific Policies
W
Access Control and Identity Management Policy
W
Supplier Relationships and Contractual Clauses Policy
W
Cloud Services Security Policy
W
Generative Artificial Intelligence Tools Usage Policy

Annex A.6 · People controls

6 documents · Screening, contract clauses and NDA, awareness, disciplinary process, termination, remote work.

W
Background Screening Procedure, Pre-Employment (A.6.1)
W
Security-Related Disciplinary Procedure (A.6.4)
W
Termination and Job Change Procedure (A.6.5)
W
Template of Security Clauses for the Employment Contract and NDA
W
Information Security Awareness, Education and Training Plan
W
Remote Work Charter and Event Reporting Procedure

Annex A.7 · Physical controls

8 documents · Perimeters and entry, secure areas, environmental threats, equipment, media, maintenance, disposal.

W
Securing Offices Premises and Secure Areas (A.7.3-4, 6)
W
Equipment Cabling and Utilities Security (A.7.8, 11-12)
W
Off-Site Assets and Storage Media Security (A.7.9-10)
W
Equipment Maintenance and Secure Disposal (A.7.13-14)
W
Physical Equipment Inventory Procedure
W
Physical and Environmental Threat Protection Plan
W
Clear Desk and Locked Screen Charter
W
Physical Security Policy and Entry Perimeter Plan

Annex A.8 · Technological controls

19 documents · Endpoints, privileged access, MFA, vulnerabilities, backup, network, cryptography, secure development.

W
User Workstation Endpoint Security Procedure (A.8.1)
W
Privileged Access Management and Restrictions Procedure (A.8.2-4)
W
Secure Authentication Procedure MFA (A.8.5)
W
Capacity Management Procedure (A.8.6)
W
IT Configuration and Change Management Procedure (A.8.9, 32)
W
Information Deletion, Data Masking, and DLP Procedure (A.8.10-12)
W
Clock Synchronization Procedure (A.8.17)
W
Privileged Utility Program Usage Procedure (A.8.18)
W
Software Installation on Operational Systems Procedure (A.8.19)
W
Secure Development Lifecycle and Secure Coding Procedure (A.8.25, 28-29)
W
Separation of Dev Test Prod Environments and Protection During Audit Procedure (A.8.31, 33-34)
W
Patch Management and Vulnerability Management Procedure (A.8.8)
W
Penetration Testing and Vulnerability Scanning Procedure (A.8.8, A.8.29)
W
Application Security Requirements and Secure Architecture Form
W
Privileged Accounts and Administrators Charter
W
Anti-Malware Protection Policy and Vulnerability Management Procedure
W
Backup Redundancy Logging and Monitoring Policy
W
Network Security Segmentation and Web Filtering Policy
W
Cryptography Policy and Key Management Procedure

Audit and control

5 documents · Internal audit grid, dashboards, tracking of the 93 controls, cross-compliance matrix, master document list.

X
ISMS Master Document List
X
Cross-Compliance Matrix ISO 27001 NIST CSF 2.0 SOC 2 GDPR
X
Security Indicators Dashboard
X
Implementation Tracking Dashboard for the 93 SoA Controls
X
ISO 27001 2022 Internal Audit Grid

Full master document list, implementation checklist and one complete procedure in the free sample.

Why this kit exists

An ISO 27001 ISMS cannot be drafted from a blank page.

7 management clauses, 93 controls in 4 themes. Every requirement calls for a policy, a procedure or a record.

2022 version

Most online templates date from 2013

114 old controls, without the 4-theme structure or the 11 new controls: threat intelligence, cloud, DLP, secure coding, data masking.

Clauses 4 to 10

A documentation gap becomes an audit finding

The auditor checks every clause and the Statement of Applicability. A missing or inconsistent document means a nonconformity.

Vendor risk reviews

Enterprise customers require certification

Fortune 500 companies, federal agencies and regulated industries list ISO 27001 in RFPs and vendor risk assessments.

$15,000 to $35,000

A consulting engagement is costly

20 to 50 consultant days for the implementation. The kit provides that base, your budget goes to risk analysis and field work.

Clause-by-clause mapping

Every ISO/IEC 27001:2022 requirement → one document in the kit.

Clause by clause and theme by theme, the normative text and the documents provided. This is what a certification auditor asks to see first.

Clause 4

Context of the organization: issues (4.1), interested parties (4.2), documented ISMS scope (4.3), processes covered (4.4)

Context analysisInterested partiesISMS scopeProcess mappingStrategic issues

Clause 5

Leadership: management commitment (5.1), documented information security policy (5.2), roles and responsibilities (5.3)

Information security policy signed by managementManagement commitment charterOrg chart + ISMS RACISecurity role descriptionsPolicy communicationAcceptable use policy

Clause 6

Planning: risk assessment (6.1.2), treatment (6.1.3) with Statement of Applicability, objectives (6.2), change planning (6.3, new in 2022)

Risk methodology + rating gridAsset registerRisk analysis + threat catalogRisk treatment planStatement of ApplicabilityResidual risk acceptanceSecurity objectivesChange planning (6.3)Change request form

Clause 7

Support: resources (7.1), competence (7.2), awareness (7.3), communication (7.4), documented information (7.5)

Resource plan + competency matrixAwareness + training planISMS communicationDocument controlMaster document listRecords managementTraining register

Clause 8

Operation: operational control (8.1), risk assessment (8.2) and treatment (8.3) under real conditions, outsourced process control

Operational controlOperational risk assessmentRisk treatmentReport + action planOutsourced process control

Clause 9

Evaluation: monitoring (9.1), internal audit program (9.2), management review with 7 mandatory inputs (9.3)

Monitoring & measurementKPI dashboardAudit procedure + programISO 27001 audit checklistManagement review procedureManagement review minutes template

Clause 10

Improvement: continual improvement (10.1), nonconformities and corrective actions (10.2)

Continual improvementNC + corrective actions managementNC / CA formNC register

Annex A.5

37 organizational controls (A.5.1 to A.5.37): policies, roles and segregation of duties, management responsibilities, authority and specialist group contact, security in project management, asset management, acceptable use, classification and labeling, access control and identity, supplier and cloud relationships, threat intelligence, incident management, continuity, intellectual property, records protection, privacy / personal data (HIPAA / CCPA / state privacy laws), independent review, compliance, operating procedures

Information security policy + topic-specific (A.5.1)RACI + segregation of duties (A.5.2-4)Authority & group contact (A.5.5-6)Threat intelligence (A.5.7)Security in project management (A.5.8)Asset register + acceptable use (A.5.9-11)Classification + labeling + transfer (A.5.12-14)Access control + IAM (A.5.15-18)Supplier relationships (A.5.19-22)Cloud security (A.5.23)Incident management (A.5.24-28)Continuity + ICT readiness (A.5.29-30)Legal requirements (A.5.31)Intellectual property (A.5.32)Records protection (A.5.33)Privacy / Personal data (A.5.34)Independent review + compliance (A.5.35-36)Operating procedures (A.5.37)

Annex A.6

8 people controls (A.6.1 to A.6.8): background screening, contractual clauses, awareness and training, disciplinary procedure, termination, NDA, remote work, event reporting

Background screening (A.6.1)Employment contract + NDA (A.6.2, A.6.6)Awareness plan (A.6.3)Disciplinary procedure (A.6.4)Termination (A.6.5)Remote work policy + reporting (A.6.7-8)

Annex A.7

14 physical controls (A.7.1 to A.7.14): perimeter, entry, premises, monitoring, environmental protection, secure areas, equipment, utilities, cabling, maintenance, disposal

Perimeter + entry (A.7.1-2)Offices + monitoring + secure areas (A.7.3-4, 6)Environmental threats (A.7.5)Clean desk policy (A.7.7)Equipment + cabling + utilities (A.7.8, 11-12)Off-site assets + media (A.7.9-10)Maintenance + disposal (A.7.13-14)

Annex A.8

34 technological controls (A.8.1 to A.8.34): endpoints, privileged access, MFA authentication, anti-malware, vulnerabilities, configurations, DLP, data masking, backups, logs, monitoring, clocks, privileged utilities, software installation, network, cloud, crypto, secure development, application requirements, secure architecture, dev/test/prod environments

User endpoints (A.8.1)Privileged access + restrictions (A.8.2-4)Authentication + MFA (A.8.5)Capacity management (A.8.6)Anti-malware + vulnerabilities (A.8.7-8)Configurations + IT change (A.8.9, 32)Deletion + data masking + DLP (A.8.10-12)Backup + redundancy + logs + monitoring (A.8.13-16)Clock sync (A.8.17)Privileged utilities (A.8.18)Software installation (A.8.19)Network + segmentation + web filter (A.8.20-23)Cryptography (A.8.24)Secure development + secure coding (A.8.25, 28-29)App requirements + architecture (A.8.26-27)Outsourced development (A.8.30)Dev/test/prod environments (A.8.31, 33-34)

Not included

Documents specific to your organization's operational context, which must be drafted or configured case by case by your team, your CISO, or your IT department, because they depend on your real information system

Filled-in Statement of Applicability (your SoA)Instantiated risk analysis (with your real assets)Detailed business continuity plan (technical BCP)Technical configurations (hardening, firewalls, IAM)Network mapping and real architectureExhaustive asset inventory (instantiated on your IT estate)Pentest / technical audit reports

XDelivered in Excel in the kit: the Statement of Applicability for the 93 controls and the internal audit grid, clauses and Annex A.

Technical compliance

The points an experienced ISO/IEC 27001 auditor checks.

Ten points certification auditors check first. The kit addresses them one by one.

Documented ISMS scope

Boundaries and applicability, interfaces and dependencies with cloud providers and subprocessors.

4.3

Risk assessment methodology

Explicit likelihood, impact and acceptance criteria, NIST SP 800-30 and ISO 27005 compatible.

6.1.2

Statement of Applicability

93 controls listed: status, justification, implementation, reference document.

6.1.3

Incident management

Event, incident, major incident, escalation, breach notification timelines, lessons learned.

A.5.24 to A.5.28

Business continuity

BIA, RTO and RPO per process, disaster scenarios, BCP and DRP tests documented.

A.5.29 and A.5.30

Identity and access management

Least privilege, periodic access reviews, joiners, movers and leavers, MFA for privileged access.

A.5.15 to A.5.18, A.8.2 to A.8.5

Vulnerability management

Continuous detection, remediation deadlines by criticality, link with threat intelligence and patching.

A.8.8

Cryptography and key management

Encryption policy, key lifecycle management, separation of roles.

A.8.24

Cloud security

Documented shared responsibility, supplier security clauses, cloud provider evaluation.

A.5.23

Internal audit and management review

Program covering clauses and Annex A, 7 review inputs including risks and the treatment plan.

9.2 and 9.3

27001

ISO/IEC 27001: international recognition

The international reference standard for information security, recognized worldwide and aligned with many sector and regulatory frameworks.

Worldwide recognition (ISO/IEC)SOC 2 (US, complementary)HIPAA Security RuleNIST CSF and SP 800-53FedRAMP and StateRAMPCCPA and state privacy laws

ISMS flash audit

Where do you stand today?

Answer the 12 clause-by-clause and theme-by-theme questions to get your ISO 27001:2022 maturity score. Instant result, free, no personal information required.

Question 1 / 12

Clause 4: Context

/ 100

Buy the ISO 27001 Package · $389

Deployment process

From order to certification audit, here is the route.

Day 1

Download

Full ZIP: 105 Word and Excel documents.

Weeks 1 to 4

Customization

Logo, scope, ISMS org chart, roles, assets, cloud providers, applicable frameworks.

Weeks 5 to 12

Implementation

Risk analysis, Statement of Applicability, control deployment, awareness, evidence.

Weeks 12 to 16

Mock audit

Internal audit with the kit's grid, action plan, management review, certification readiness.

Typical timeline: 12 to 16 weeks to an ISMS ready for the certification audit, depending on your internal resources (CISO, IT, asset owners).

Need a hand? Our consultants can tailor the kit to your site and support the rollout, on quote.

Request a quote

Risk-free

30-day guarantee, no questions asked.

You test the package. If you change your mind, we refund you.

You have 30 days to download the package, review its content, open the documents, and verify that the writing quality matches your expectations. If something is off, you write us an email, no justification needed, and the refund is processed within 5 business days. That simple.

Frequently asked questions

Answers to your most common questions.

Is the kit enough to get ISO 27001 certified?

No. It provides the documentation for clauses 4 to 10 and Annex A. Certification depends on implementation: real risk analysis, completed Statement of Applicability, deployed controls, collected evidence.

Are the documents editable?

Yes. 85 Word files and 20 Excel files, no locked PDFs. Neutral layout, ready for your logo and references.

Does the kit cover SOC 2 and NIST CSF?

It is built on ISO/IEC 27001:2022 and includes a cross-compliance matrix with NIST CSF 2.0, SOC 2 and GDPR. It does not replace a regulatory analysis specific to your sector.

Does the license cover several entities?

It covers one legal entity, with unlimited internal use. Groups, subsidiaries or consulting firms: contact us for a suitable license.

When will I receive the files?

As soon as payment is confirmed: a link on the confirmation page and by email. Full ZIP, folders by document type.

What if the kit does not suit me?

You have 30 days to review it. Write to support@qse-academy.com explaining what does not meet your needs: the refund is issued to your original payment method, 4 to 5 business days after processing.

Take the next step

Your ISO 27001 ISMS. Ready today.

105 Word and Excel documents, instant download after payment.