Skip to content

Security-first compliance
for ISO 27001:2022

Cover all 93 Annex A controls and the ISMS clauses. Daily tests prove your controls work, and Strac Comply drafts your Statement of Applicability. Your certification body reviews everything in its own portal.

Start free trialBook a demo

14-day free trial. No credit card.

Read our ISO 27001 guide
Annex A controls
93
Annex A controls
Automated tests
100+
Automated tests, run daily
Evidence base
1
Evidence base for every framework

What is ISO 27001?

ISO/IEC 27001:2022

International Organization for Standardization 27001

Information security management

ISO 27001 is the international standard for how you run an information security management system (ISMS). The 2022 version has 93 Annex A controls in 4 themes: organizational, people, physical and technological.

Certification takes a Stage 1 audit of your design and a Stage 2 audit of how it runs. It also takes a surveillance audit each year for 3 years.

Why Strac Comply for ISO 27001

Most ISO 27001 tools hand you a 93-row spreadsheet and a folder of templates. Strac Comply tests the Annex A controls on your real systems every day. It also keeps your Statement of Applicability current from your live controls.

Every year after the first, your surveillance audit starts from the same pinned evidence. You don't collect it all again.

How Strac Comply runs ISO 27001

Strac Comply collects evidence every day, not the week before your audit.

  • All 93 Annex A controls and 30 ISMS clauses, each with its required evidence. Daily tests where a system can prove it, policies and documents where it can't

  • Strac Comply drafts your Statement of Applicability from your live controls. It lists every Annex A control, whether it applies, why, and the evidence behind it. Your management reviews and publishes it

  • One evidence base for every framework you run. The same test or document counts toward ISO 27001, SOC 2, PCI DSS, HIPAA, NIST CSF 2.0 and more

  • An auditor portal your certification body opens by magic link, plus a downloadable audit package. Strac Comply pins the evidence to the version they reviewed

  • Stage 1, Stage 2 and every surveillance audit on the same platform. Your evidence carries over from year to year

93 Annex A controls. One evidence base.

A sample of the evidence behind the controls auditors look at first.

How long does ISO 27001 take?

About 3 to 6 months

To a certificate, after a Stage 1 and a Stage 2 audit.

  1. Step 1

    Get ready

    4 to 8 weeks

  2. Step 2

    Run your ISMS

    4 to 8 weeks

  3. Step 3

    Stage 1 and 2 audits

    4 to 6 weeks

  4. Step 4

    Certificate

    2 to 4 weeks

See the full ISO 27001 timeline

Frequently asked questions

Do you support the 2013 or the 2022 version?

ISO 27001:2022, the current version. The window to move from 2013 to 2022 closed in October 2025. Every new certification and surveillance audit now uses the 2022 controls.

Can we add ISO 27001 to the SOC 2 program we already run?

Yes, and it saves most of the work. SOC 2 and ISO 27001 overlap heavily. In Strac Comply, the same test, policy or document counts toward both, so you collect it once.

ISO adds the management system around it: scope, objectives, internal audit and management review.

Do you generate the Statement of Applicability?

Yes. Strac Comply drafts it from your live controls: every Annex A control, whether it applies, why, and the evidence behind it.

You get it as a draft spreadsheet. Your management reviews and publishes it, because the SoA is your statement, not ours.

Also in Strac Comply

SOC 2PCI DSSNIST CSF 2.0HIPAAand more

Get ISO 27001 done without a last-minute rush.

Connect your systems, and your ISO 27001 tests run today.

Start free trialBook a demo

14-day free trial. No credit card. Plans from $4,995 per year. See pricing · Browse integrations