Information asset inventory, risk assessment and treatment
Certification and compliance
ISO 27001
Coordinate risks, controls and evidence for ISO 27001
ISO:OK organises the information security management system by connecting risk assessment, treatment plan, controls and implementation evidence.
Overview
How ISO:OK supports ISO 27001
In ISO:OK the risk register leads to the treatment plan and the Annex A controls are already loaded: for each one you state whether it applies, how it is implemented or why it is excluded. The Statement of Applicability is printed from the data.
Assets, access, vulnerabilities, patches, backups with restore tests, business continuity and personal-data breaches each have their own register: they become the proof that controls are in place. Many policies are already written, ready to adapt.
If you also work on NIS2 or DORA, you reuse the same registers: you fill them in once.
What you can manage
A structured path for ISO 27001
Statement of Applicability and Annex A controls
Incidents, suppliers, business continuity and internal audits
The result
From requirements to verifiable evidence
Requirement coverage is clear and every control can be linked to the evidence proving its effective implementation.
One platform, one source of truth
- Guided activities with ownership and deadlines
- Documents, records and evidence in the same environment
- Coverage map to identify gaps before the audit
- Shared information across multiple standards
Who it is for
Designed for companies and consultants
For information-security managers, consultants and organisations preparing or maintaining ISO 27001.
FAQ
Frequently asked questions
Is the Statement of Applicability already set up?
Yes. The controls are already loaded: you record whether they apply and how they are implemented, then print the document.
Can I find policies already written?
Yes, including acceptable use of resources, access control, cryptography, backup, incidents, suppliers and personal data, ready to adapt to your company.
Can I manage ISO 27001, NIS2 and DORA together?
Yes. Risks, incidents, access, vulnerabilities, patches and continuity are the same registers and serve all three.
Can consultants manage several client companies?
Yes. Consultants can work with several organisations while keeping users, roles, activities and documents separated.
Start managing ISO 27001 with ISO:OK
Explore a dedicated environment for free, with sample data already loaded. If you prefer, we will guide you with a presentation.