Fast-Track ISO 27001 Compliance | Expert Template Library

Frequently Asked Questions

What is the ISO 27001 standard for an ISMS, and what does it mean?

ISO 27001 is the leading international standard for information security. It specifies the requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS).

An ISMS is a systematic and structured framework of policies, procedures, and controls designed to manage and protect an organisation’s security risks across people, processes, and technology. By implementing an ISMS, an organisation ensures ongoing quality assurance and full visibility into how information is handled, shared, and protected.

Is ISO 27001 a legal requirement, and is the 2013 version still valid?

In general, ISO 27001 is not a legal requirement in itself, but in practice it often serves as a foundation for regulatory compliance. Demand is largely driven by B2B customer requirements, supplier audits, and modern cybersecurity regulations such as NIS2 and DORA, which require organisations to adopt security measures aligned with recognised standards like ISO 27001.

Regarding versions, the previous ISO 27001:2013 standard has officially been updated and replaced by ISO 27001:2022. Organisations seeking certification today, or maintaining their compliance status, should transition to the updated 2022 framework, which aligns security controls with today’s technological and organisational landscape.

What are the three fundamental principles or pillars of ISO 27001?

At its core, ISO 27001 focuses on protecting information through the CIA Triad — the three fundamental pillars of information security:

Confidentiality: Ensuring that sensitive information and personal data are protected and accessible only to authorised individuals or systems.
Integrity: Ensuring the accuracy, completeness, and consistency of data, preventing unauthorised or accidental modification.
Availability: Ensuring that authorised users have reliable, secure, and timely access to information, systems, and infrastructure whenever needed.

What are the four domains, categories, or themes within the ISO 27001 requirements?

In the updated ISO 27001 framework, the security controls and implementation guidance are grouped into four core themes (or domains):

Organisational Controls: Focus on governance structures, security policies, cloud service usage, and asset management.
People Controls: Address the human element, including remote working arrangements, personnel screening, and security awareness training.
Physical Controls: Cover physical security measures such as secure perimeters, access controls, facility protection, and equipment monitoring.
Technological Controls: Govern the protection of IT infrastructure, including encryption, network security, and data leakage prevention.

How does NorthGRC support ISO 27001 certification?

The NorthGRC platform acts as your digital roadmap to ISO 27001 certification. It structures the entire process by linking risk assessments directly to controls and supporting documentation. This eliminates guesswork by clearly showing what is missing and what actions are required.

Using our pre-configured Annual Wheel, organisations can achieve certification in as little as four months, avoiding the need to build compliance structures from scratch in spreadsheets.

Does NorthGRC include ISO 27001 templates?

Yes. The platform includes a comprehensive library of hundreds of expert-validated templates, covering everything from incident response plans to information security policies.

What makes NorthGRC unique is its dynamic Statement of Applicability (SoA) template, which updates automatically in real time as you work with your controls. Rather than simply providing a document, NorthGRC delivers a complete structure that is aligned with ISO requirements from day one.

How does NorthGRC help us remain ISO 27001 compliant after certification?

ISO 27001 requires continuous monitoring and improvement. Within NorthGRC, controls in the Compliance Workbench are directly connected to operational tasks in the Annual Wheel.

If a recurring control activity is not completed on time, the task, the associated control, and all linked documentation automatically change status to red. This gives management and auditors an immediate, real-time view of compliance gaps and outstanding actions before they are identified during an external audit.

Can we reuse our ISO 27001 work for other regulations within NorthGRC?

Yes — and this can save organisations hundreds of administrative hours.

Within NorthGRC, requirements are broken down into granular, reusable controls. When you implement and document a control for ISO 27001, the platform automatically maps your evidence and responses to equivalent requirements across frameworks such as NIS2, GDPR, and DORA.

In practice, this means you only need to document your processes once. NorthGRC then automatically updates your compliance status across all selected standards and regulations.

Reach ISO 27001 Compliance Without the Manual Grind

The "Start-from-Zero" Trap

Your Compliance Accelerator

ISO 27001 certified in just 4 months

Structured ISMS operations

From statements to ongoing compliance

Simplifying NIS2 compliance without distracting from core business

1/1

Built for Speed

1. The Expert Template Library

The Head Start

2. Threat-Based Risk Assessment

The Intelligence

3. The Automated Statement of Applicability

The Output

Key Features for GDPR Compliance

Compliance Management

Risk Management

Documents Module

Asset Management

Incident Management

Vendor Management

Dashboard & Reporting

Integrations

Ready for Your Internal Audit?