International
ISO 27001: what it requires and how to self-assess
ISO/IEC 27001:2022 — information security management system
Direct support
Talk to an ISO 27001 specialist
Reply within one business day.
Short answer
ISO 27001 is the international standard for an information security management system. It requires a defined scope, risk assessment and treatment, a set of Annex A controls recorded in a Statement of Applicability, and evidence that the system is operated, audited and improved. Certification comes from an accredited certification body.
Why it matters
What ISO 27001 readiness does for the business.
Answers the security questionnaire
A certificate is the shortest route through enterprise procurement: scope, controls and an independent audit already documented.
Replaces the annual scramble
Risk assessment, treatment, internal audit and management review run on a cycle instead of restarting every time an audit is booked.
Gives the board a system
One register shows what is in scope, which risks are accepted and what is overdue, in the language a board can act on.
Scope
Who it applies to
- Organisations of any size that need to show a managed, auditable approach to information security.
- Suppliers answering enterprise and public-sector security questionnaires.
- Groups that must demonstrate security to customers in India, the EU, UK and the Gulf.
- Teams that already hold SOC 2 and want an international management-system standard as well.
- Any defined scope: one product, one data centre, or the whole company.
Controls
Key requirements
- Define the ISMS scope and the interested parties it serves.
- Set a security policy with leadership responsibility and defined roles.
- Run a risk assessment and produce a risk treatment plan on a repeatable cycle.
- Record a Statement of Applicability across the Annex A controls, justifying inclusions and exclusions.
- Implement the selected controls and keep evidence that they operate.
- Manage competence, awareness and documented information.
- Run internal audits and management reviews at planned intervals.
- Correct nonconformities and show continual improvement.
The programme
How we take you through ISO 27001.
Platform and people on the same path: Fortress holds the controls and the evidence, our team runs the assessment with you, and nothing is rebuilt when the auditor arrives.
- 01
Define the scope
We agree what the ISMS covers — entity, product, data centre or the whole company — and the interested parties it has to satisfy.
- 02
Run the risk assessment
Assets, threats and impacts are assessed with a repeatable method, and each risk gets a treatment decision recorded against it.
- 03
Build the Statement of Applicability
Every Annex A control is selected or excluded with a written justification, so the auditor sees reasoning and not just a tick.
- 04
Write the policy set and owners
Policies, roles and responsibilities are documented and assigned to named people, with the competence records that support them.
- 05
Operate and collect evidence
Controls run in Fortress with owners, review dates and attached evidence, so operation is demonstrated across the cycle.
- 06
Internal audit and certification
We run internal audit and management review, close the nonconformities, then hand the evidence set to your certification body.
Before / after
Where teams start, and where ISO 27001 readiness leaves them.
Before · status quo
What the organisation looks like today.
- 01
The Annex A spreadsheet exists, but nobody can say which controls are actually operating.
- 02
Risk assessment is redone from scratch before every audit.
- 03
Policies live in a folder that was last reviewed years ago.
- 04
Internal audit and management review happen only when a date forces them.
After · with Risknox
What changes once the programme is running.
- 01
Each control has an owner, a review date and evidence behind it.
- 02
Risk treatment is tracked on a cycle, with decisions recorded.
- 03
The policy set is versioned, approved and dated.
- 04
Internal audit and management review run to a schedule, findings closed.
Self-assess it in Fortress
Three steps from “where do we stand” to a plan.
- 1
Pick ISO 27001
Choose it in the GRC builder. Your first framework is included, and shared controls are reused if you add another.
- 2
Answer and attach evidence
Work through the control set, assign an owner to each control and attach the evidence behind the answer.
- 3
Get the gap report
See what is missing, with severity, a named owner and a remediation plan you track to closure.
Product screenshot
Self-assessment and audit readiness. Formal certification or attestation is done by an accredited auditor.
Readiness check
Two questions, and an indicative band for ISO 27001.
No login. Nothing is stored until you ask for the plan.
Team size
Where are you today?
Pick a team size and where you are today to see the band.
Questions we get asked
Is ISO 27001 certification mandatory?+
Not by law for most organisations. It is voluntary to adopt and is usually required by customers, tenders or group policy.
How long is an ISO 27001 certificate valid?+
Certificates are typically issued for three years, with surveillance audits during the cycle. The certification body sets the exact schedule.
Can we self-assess against ISO 27001?+
Yes. A self-assessment against the Annex A controls gives you the gaps and the evidence set. Only an accredited certification body can issue the certificate.
Which version should we use?+
ISO/IEC 27001:2022 is the current version. The 2022 revision moved the Annex A controls into 93 controls across four themes: organisational, people, physical and technological.
Self-assessment and audit readiness, in one place.
The control set, the evidence and the gap report — no rebuild when the auditor arrives.
Last updated November 2026