Security-first compliance
for ISO 27001:2022
Cover all 93 Annex A controls and the ISMS clauses. Daily tests prove your controls work, Strac Comply drafts your Statement of Applicability, and your certification body reviews everything in its own portal.
14-day free trial. No credit card.
Read our ISO 27001 guide93
Annex A controls
100+
Automated tests, run daily
1
Evidence base for every framework
Framework
ISO/IEC 27001:2022
International Organization for Standardization 27001
Information security management
What it is
ISO 27001 is the international standard for running an information security management system (ISMS). The 2022 version has 93 Annex A controls in 4 themes: organizational, people, physical and technological. Certification takes a Stage 1 audit of your design, a Stage 2 audit of how it runs, and a surveillance audit each year for 3 years.
Why Strac Comply for ISO 27001
Most ISO 27001 tools hand you a 93-row spreadsheet and a folder of templates. Strac Comply tests the Annex A controls on your real systems every day and keeps your Statement of Applicability current from your live controls. Every year after the first, your surveillance audit starts from the same pinned evidence, so you don't collect it all again.
How Strac Comply runs ISO 27001
Evidence collected every day, not the week before your audit.
All 93 Annex A controls and 30 ISMS clauses, each with its required evidence. Daily tests where a system can prove it, policies and documents where it can't
A Statement of Applicability drafted from your live controls: every Annex A control, whether it applies, why, and the evidence behind it. Your management reviews and publishes it
One evidence base for every framework you run. The same test or document counts toward ISO 27001, SOC 2, PCI DSS, HIPAA, NIST CSF 2.0 and more
An auditor portal your certification body opens by magic link, plus a downloadable audit package. Evidence is pinned to the version they reviewed
Stage 1, Stage 2 and every surveillance audit on the same platform, with the same evidence carried year to year
93 Annex A controls. One evidence base.
A sample of the evidence behind the controls auditors look at first.
A.5.15
Access control
Access control policy + least-privilege tests on AWS, GCP and GitHub
A.8.5
Secure authentication
MFA tests on Okta, Google Workspace and AWS
A.8.8
Technical vulnerabilities
AWS Inspector findings, patch tests and the AI pen test report
A.8.15
Logging
CloudTrail tests: turned on, validated and retained
A.8.16
Monitoring activities
GuardDuty, Security Hub and suspicious-login tests
A.8.32
Change management
GitHub branch protection and code review records
Frequently asked
Do you support the 2013 or the 2022 version?
ISO 27001:2022, the current version. The window to move from 2013 to 2022 closed in October 2025, so every new certification and surveillance audit now uses the 2022 controls.
Can we add ISO 27001 to a running SOC 2 program?
Yes, and it saves most of the work. SOC 2 and ISO 27001 overlap heavily. In Strac Comply, the same test, policy or document counts toward both, so you collect it once. What ISO adds is the management system around it: scope, objectives, internal audit and management review.
Do you generate the Statement of Applicability?
Yes. Strac Comply drafts it from your live controls: every Annex A control, whether it applies, why, and the evidence behind it. It lands as a draft spreadsheet. Your management reviews it and publishes it, because the SoA is your statement, not ours.
Get ISO 27001 done without the scramble
Connect your systems and see your ISO 27001 evidence start to collect in the first hour.
14-day free trial. No credit card. Plans from $4,995 per year. See pricing · Browse integrations