Managing ISO 27001 obligations with Riskophia
ISO/IEC 27001 Information Security Management
What it is
An international standard for an information security management system. Organizations can be certified by an accredited body. It is a standard and a certification programme, not a law, though contracts and regulators often reference it.
Who it applies to
Any organization that wants a certified, risk-based information security management system, commonly technology, financial services, professional services and public bodies.
Representative obligations
- Context, scope and leadership commitment
- Risk assessment and treatment
- Statement of Applicability and Annex A controls
- Documented policies and procedures
- Competence, awareness and communication
- Internal audit, management review and continual improvement
This list is illustrative and is not legal advice. Your obligations depend on your activities, jurisdictions and the current text of the standard.
From ISO 27001 text to evidence on file.
Riskophia helps you manage the compliance activities associated with ISO 27001. It does not by itself make you compliant, certified or approved; that depends on your practices and on the relevant auditor or certification body.
Requirements register
ISO 27001 obligations broken into plain-language requirements with owners, cadence and status.
Policies and attestations
Policy templates aligned to ISO 27001, version controlled and acknowledged by the right roles.
Training records
Mandatory training assigned by role through Learnophia, with completion recorded as evidence.
Evidence and gaps
Evidence linked to each requirement; gaps become owned actions with verified closure.
Crosswalk
Where ISO 27001 overlaps other regulations and standards, one control and one piece of evidence serve all of them.
Export
An inspection-ready package of status, evidence and history for ISO 27001.
See your ISO 27001 obligations in Riskophia.
Book a 30-minute demo led by a compliance professional, or talk to an expert about your sector.