#01
Statement of Applicability in spreadsheets
SoA maintained in Excel ; no change history, no link to risk, versions distributed by email. The auditor asks for justification behind every decision.
Module / ISO 27001
ISO 27001:2022 ; Information Security Management.
93 Annex A controls across 4 domains. Statement of Applicability. Evidence management. Cross-mapping with DORA/NIS2. Full ISMS lifecycle ; from scope to certification.
Full ISMS lifecycle
From scope to certification. One system.
The complete ISO/IEC 27001:2022 structure reflected in the interface ; no spreadsheets, no versions distributed by email.
93
93 controls
4
4 domains
9
9 tools
100%
Annex A
Challenges
We know the ISO 27001 implementation challenges.
We have worked with organisations at every stage of the certification journey. These problems come up every time.
#02
No risk assessment methodology
Risk assessments conducted ad hoc, without a consistent likelihood x impact approach. Every system owner applies their own method.
#03
93 Annex A controls without prioritisation
All 93 controls across 4 domains look identical. No maturity rating (0-5), no risk-based prioritisation, no clear path to certification.
#04
Stage 2 evidence collected last minute
Weeks before the Stage 2 certification audit the team scrambles to gather implementation evidence. Something is always missing.
#05
No visibility of ISMS progress
Nobody knows how many controls are implemented, in progress or planned. Management has no compliance dashboard.
#06
ISMS documentation out of date
Security policies, procedures and records created once and never updated. The auditor rejects documents that are three years old.
Structure
4 Annex A domains ; 93 controls.
ISO 27001:2022 reorganises controls into 4 thematic domains. RealSec reflects this structure in the interface.
37
Organizational
Policies, governance, processes, responsibilities
8
People
Screening, training, discipline, offboarding
14
Physical
Security zones, equipment, media
34
Technological
Endpoint, access, cryptography, DevSecOps
Features
Nine tools. Full certification.
Every feature supports a specific stage of ISMS implementation and certification audit preparation. Evidence management, cross-mapping with DORA/NIS2 and the maturity model in one place.
Annex A ISO 27001:2022
Annex A controls with 0-5 maturity rating.
Complete list of 93 Annex A controls divided into 4 domains (Organizational, People, Physical, Technological). Each control rated on a 0-5 scale (non-existent to optimised). Controls linked to identified risks and required evidence.
- + 93 controls across 4 domains with descriptions and implementation examples
- + 0-5 maturity rating with justification for each control
- + Control-to-risk traceability
- + Implementation evidence ; document uploads and links
controls.tsx
ANNEX A ; TECHNOLOGICAL (34) ; PROGRESS 61% live
A.8.1 IMPLEMENTED
User Endpoint Devices
A.8.2 IN PROGRESS
Privileged Access Rights
A.8.7 IMPLEMENTED
Protection Against Malware
A.8.8 PLANNED
Management of Technical Vulnerabilities
Statement of Applicability
Automated SoA with justifications.
The system automatically generates the Statement of Applicability from control assessments and Risk Assessment results. Every inclusion or exclusion decision is documented with a justification and a responsible owner.
- + Automatic SoA generation from control assessments
- + Inclusion/exclusion justification for each of the 93 controls
- + PDF SoA export ready for the auditor
- + SoA change history with timestamps and authors
ui.tsx
UI Preview
Full interface preview available in the live demo.
Risk Assessment
Risk Assessment ; Likelihood x Impact methodology.
Structured risk assessment based on the Likelihood x Impact methodology. Asset identification, threats, vulnerabilities and risk owners. 5x5 risk matrix with acceptance thresholds and risk treatment plans.
- + Asset register with owners and classification
- + 5x5 risk matrix (likelihood x impact)
- + Four treatment options: accept, reduce, transfer, avoid
- + Residual risk monitoring after control implementation
risk.tsx
RISK ASSESSMENT ; 5x5 MATRIX live
R-01 20
Customer data loss
R-02 12
System unavailability
R-03 6
Configuration error
R-04 2
Minor IT incident
Evidence Management
Managing implementation evidence.
Central repository for Annex A control implementation evidence. Each control linked to required evidence ; documents, screenshots, logs, test results. Evidence completeness tracking per control and automatic alerts for missing or expired evidence.
- + Evidence upload per control ; PDF, DOCX, screenshots, logs
- + Automatic mapping: control ; required evidence type
- + Evidence completeness dashboard ; percentage of controls with a full set
- + Alerts for expired evidence (older than 12 months)
evidence.tsx
EVIDENCE TRACKER ; 78% COMPLETE live
A.5.1 COMPLETE
Information Security Policies
A.8.1 COMPLETE
User Endpoint Devices
A.6.3 MISSING
Information Security Awareness
A.8.8 MISSING
Technical Vulnerabilities
Internal Audit
Internal Audit Program.
Planning and execution of the ISMS internal audit programme. Annual audit schedule with assigned auditors and scope. Checklists for each ISMS area. Audit reports with observations and non-conformities.
- + Annual audit programme with schedule and scope
- + Checklists based on ISO 27001:2022 requirements
- + Non-conformities, observations and opportunities for improvement
- + Corrective action tracking with deadlines and statuses
ui.tsx
UI Preview
Full interface preview available in the live demo.
Audit Findings
Audit findings register.
Central register of all findings from internal and external audits. Classification: major non-conformity, minor non-conformity, observation, opportunity for improvement. Corrective action tracking with deadlines, owners and effectiveness verification.
- + Findings register: major NC / minor NC / observation / OFI
- + Finding linked to an Annex A control and ISMS requirement
- + Corrective action plan with deadlines and owners
- + Effectiveness verification ; evidence of finding closure
ui.tsx
UI Preview
Full interface preview available in the live demo.
Cross-mapping
Cross-mapping with DORA and NIS2.
Automatic mapping of 93 Annex A controls to DORA requirements (art. 5-16) and NIS2 pillars (art. 21). Eliminate duplicate work ; one implementation evidence item covers multiple regulations. Combined compliance gap report for all frameworks simultaneously.
- + ISO 27001 Annex A to DORA cross-reference mapping
- + ISO 27001 Annex A to NIS2 art. 21 (10 areas) mapping
- + One implementation evidence item ; multiple regulations covered
- + Combined compliance score report across all frameworks
crossmap.tsx
CROSS-MAPPING ; ISO / DORA / NIS2 live
A.5.1 21(a)
Sec. Policies
A.5.24 21(b)
Incident Mgmt
A.5.29 21(c)
BCM / ICT
A.5.19 21(d)
Supplier Sec.
Maturity Model
Maturity model integration.
ISMS maturity assessment across 5 levels (Initial to Optimised) with automatic gap task generation for each next level. Cascading task closure with confirmation. Maturity progress dashboard with trend over time.
- + 0-5 maturity rating per control and per domain
- + Automatic gap tasks: what needs to be done to advance to the next level
- + Cascading task closure with accordion and checkboxes
- + ISMS maturity dashboard with quarterly trend
ui.tsx
UI Preview
Full interface preview available in the live demo.
Audit Preparation
Preparation for Stage 1 and Stage 2.
Dedicated tools for preparing for the certification audit. Stage 1 checklist (ISMS documentation) and Stage 2 checklist (implementation evidence). Audit simulation with gap identification. Certification readiness report.
- + Stage 1 checklist ; required ISMS documentation
- + Stage 2 checklist ; implementation evidence for 93 controls
- + Gap analysis report with action prioritisation
- + Certification readiness dashboard as a percentage
ui.tsx
UI Preview
Full interface preview available in the live demo.
Additional features
Beyond the 93 Annex A controls.
Evidence Management
Centralised evidence per control with lifecycle tracking and completeness gauge
Cross-mapping DORA/NIS2
42 mappings between ISO 27001, DORA and NIS2 ; eliminating duplicate work
Maturity model 0-5
Interactive heatmap of 93 controls with gap analysis and remediation roadmap
Audit findings
Major NC, Minor NC, Observation, Opportunity ; with closure workflow
Security policies
Library, versioning, approval workflow, acknowledgment tracking
Audit preparation
Readiness checklist per domain, missing evidence, readiness report
Statement of Applicability
Automatic SoA with per-control justification, PDF export
PDCA per control
Improvement cycle with dates, owners and evidence
FAQ
Frequently asked questions
Realistically 6 to 18 months. The longest phase is ISMS implementation (4 to 12 months), followed by the internal audit and certification (Stage 1 and Stage 2).
The certification audit itself typically costs 8,000 to 14,000 PLN net, with annual surveillance audits at 3,500 to 5,000 PLN. A full implementation with external experts can reach 150,000 to 350,000 PLN.
No. You implement controls that follow from the risk assessment, and document exclusions with justifications in the SoA. Blindly ticking every box is something auditors spot immediately.
It keeps all 93 Annex A controls, evidence linked to each control, cross-mappings to other regulations and certification readiness in one place. Live data instead of files.
Ready for ISO 27001 certification?
A 30-minute demo session with an expert. See how RealSec guides you through every stage of ISMS implementation ; all the way to certification.