Skip to content
S
StayEvident
ISO/IEC 27001:2022 · Information security

Your ISO 27001 ISMS — every clause and Annex A control, assessed.

StayEvident assesses your ISMS documentation against clauses 4–10 and all 93 Annex A controls, generates your Statement of Applicability from your scope decisions, and links the evidence your auditor will ask for.

Get startedSee how it works

All 93 Annex A controls

Clauses 4–10 plus every Annex A control across the four themes — 134 requirements, each assessed against your policies and procedures with the passages cited.

An SoA that stays true

Exclude a control or a whole theme with a justification, record why included controls apply, link the risks each control treats, and download a Statement of Applicability built from the same decisions — with a flag on any excluded control a risk still relies on.

Alongside ISO 9001 and 42001

Already certified to ISO 9001? Evidence you've confirmed for equivalent clauses — internal audit, management review, documented information — is offered for reuse. Adding ISO/IEC 42001? Its Annex A is cross-referenced to yours.

Coverage

Clauses 4–10 and all four Annex A themes.

Every requirement is assessed against your documents. The registers your ISMS depends on — risks, audits, CAPAs, competence, suppliers — sit alongside.

ClauseRequirement
4–10ISMS clausesAssessed clause by clause by AI against your documents, with quoted evidence; you confirm or override each verdict
6.1.2Information security risk assessmentRisk register with a configurable matrix and inherent/residual scoring
6.1.3Risk treatment and the SoARisks linked to the Annex A controls that treat them; Statement of Applicability generated from your scope decisions and treatments, exportable as PDF
7.2CompetenceCompetence requirements, matrix, training plans and records
7.5Documented informationDocument control — numbering, owners, version approval, review cadence and retention — plus a checklist of mandatory documented information
9.2Internal auditAudit programmes, audits with checklists and findings — one audit can cover several standards
9.3Management reviewReviews with inputs and outputs, exported as a PDF pack
10.2Nonconformity and corrective actionCAPAs tracked through their lifecycle to closure
A.5Organisational controls (37)Each control assessed; registers for information assets (A.5.9, A.5.12), suppliers (A.5.19–A.5.22) and legal obligations (A.5.31)
A.6People controls (8)Each control assessed; excludable individually or as a theme
A.7Physical controls (14)Each control assessed; excludable individually or as a theme
A.8Technological controls (34)Each control assessed; excludable individually or as a theme

Common questions

Does it cover the 2022 revision?+

Yes. StayEvident models ISO/IEC 27001:2022, including Annex A's 93 controls in four themes (organisational, people, physical, technological) and the controls new in the 2022 revision.

How are Annex A exclusions handled?+

Exclude an individual control or a whole theme, with a justification. Exclusions inherit down the tree, excluded controls aren't assessed, and they appear on your SoA with the justification. See Statement of Applicability.

Is our ISMS documentation used to train AI?+

No. Excerpts are sent to our AI providers only to perform the assessment and are never used to train models. Every AI verdict is reviewed by a person. See Security.

Can our certification body's auditor see the evidence?+

Invite them with the read-only auditor role to use audit-day mode, or hand over the audit pack and SoA as PDFs. See Audit-day mode.

Does StayEvident replace our copy of ISO/IEC 27001?+

No. Control guidance in StayEvident is written in our own plain English. You still need your own licensed copy of the standard.

Further reading

Free resourceISO 27001:2022 gap-assessment checklistA control-by-control checklist across all four Annex A themes.Open it →BlogThe ISO 27001:2022 controls auditors keep raising after the transitionThree Annex A controls new in the 2022 revision keep becoming nonconformities — what auditors look for, and how to make them operational before your audit.10 Jul 2026BlogThe Statement of Applicability is not a checkbox exerciseWhat clause 6.1.3 d actually requires, and how to justify inclusions and exclusions in a way that survives Stage 1 scrutiny.3 Jun 2026

Stop dreading audit season.

Upload your documents, adopt a standard, and see clause-by-clause coverage — including the gaps you didn't know about.

Get startedTalk to us