ISO 27001 in Proofroom
Proofroom ships ISO/IEC 27001:2022, including its 2024 amendment on climate change. This guide covers what is there, the Statement of Applicability, the yearly management system work, and the certification audits.
ISO text is copyrighted, so Proofroom uses only the identifiers: clauses 4.1 to 10.2 and Annex A 5.1 to 8.34. Every title and description is our own plain-English summary of what the clause or control asks. Keep your licensed copy of the standard to hand for the exact wording.
What is there
- Clauses 4 to 10: the management system (ISMS) requirements, with the sub-clauses auditors cite (6.1.2 risk assessment, 6.1.3 risk treatment, 9.2 internal audit, 9.3 management review and so on).
- All 93 Annex A controls in their four themes: organisational (A.5), people (A.6), physical (A.7) and technological (A.8). Annex A identifiers carry an “A.” prefix in Proofroom (A.5.15), so they never clash with the clause numbers (5.1 is a clause, A.5.1 a control).
- Each control’s type (preventive, detective, corrective or directive) and its security properties and NIST CSF functions, in Readiness → Coverage. This is our own classification.
- Climate change (2024 amendment). Clause 4.1 asks you to decide whether climate change is a relevant issue, and 4.2 whether interested parties have climate-related requirements. The yearly scope review check asks you to record both decisions, either way.
Frameworks → ISO/IEC 27001 lists every clause and control with its description.
Evidence you already have
Work done for SOC 2 or PCI DSS counts where the controls overlap. The crosswalk (Admin → Crosswalk) maps Annex A controls to the SOC 2 criteria and PCI DSS requirements that ask for the same thing, one row per real overlap; an admin can add or remove rows. Readiness → ISO 27001 (“If you pursued ISO 27001”) shows what that already covers before you open an audit.
Proofroom also maps ISO 27001 identifiers to:
- Connectors: each collector suggests the Annex A controls its evidence supports (for example the leavers check suggests A.5.18). Collectors you already had get these once, when you update.
- Workflow checks in the library (an access review counts for A.5.18). Checks you already had get them once, when you update; a mapping you remove stays removed.
- Policy templates: newly adopted policies carry their ISO 27001 controls. A policy you adopted earlier shows “The template now also maps …” with Start a draft with them added; an admin approves the draft as usual.
- The security assessment and the risk library, so gaps and risks name the ISO 27001 controls they touch.
The Statement of Applicability
The Statement of Applicability (SoA) lists every Annex A control and, for each one, whether you include it, why, and how far it is in place. It is the document a certification body asks for first.
Open it from Frameworks → ISO 27001 Statement of Applicability. Analysts and admins edit it, admins approve it, and auditors on an ISO 27001 audit read the approved version (what Proofroom sees is limited, for them, to evidence in their own audits). Staff with the user role do not see it.
All the rows on the page are one form with one Save changes button that stays in view. If you try to leave with changes not saved, Proofroom asks first.
- Start it. Every control starts undecided. The status of each is a suggestion from what Proofroom already sees (evidence, Workflow checks, connectors, policies); check each one.
- Decide every control: Included or Excluded, with a reason for each. ISO 27001 asks for the reason for including a control as well as for excluding one. Two quick steps help: Include the undecided (most companies include most controls), and a reason for every included control that has none.
- Set the status of each included control: Not started, Planned, Partly in place or In place.
- Submit for approval. Proofroom refuses while any control is undecided or without a reason.
- An admin approves it on its policy page (History and approval). As with any policy, someone other than the person who wrote or submitted it approves, unless there is only one admin.
The approved version is frozen, kept in the history with who approved it and when, and filed as evidence for clause 6.1.3 in your open ISO 27001 audits. To change it, choose Edit: start a new draft; the rows are copied and the approved version stays as it was. Reviewed, no changes records a yearly review without edits.
Each row also shows What Proofroom sees: the evidence, checks, connectors and policies covering the control today, directly or through the crosswalk. It is information for you and the auditor, not part of the approved decision.
Download PDF and Download XLSX export the version you are looking at (a draft says so on every page).
Controls the approved SoA excludes are not applicable, with your reason, in your open ISO 27001 audits and in Readiness. Each newly approved version updates them: a control it brings back is in scope again, a control it excludes is marked not applicable. A control you marked not applicable for your own reason is left alone.
The yearly ISMS work
The Workflow library has a check for each recurring requirement. Switch them on in Set up Workflow for this audit on your ISO 27001 audit, or from Workflow.
| Check | How often | Clauses |
|---|---|---|
| ISMS scope and context review | Yearly | 4.1, 4.2, 4.3 |
| Risk assessment | Yearly | 6.1.2, 8.2 |
| Risk treatment plan and Statement of Applicability review | Yearly | 6.1.3, 8.3 |
| Security objectives and measurements review | Twice a year | 6.2, 9.1 |
| ISMS internal audit | Yearly | 9.2.1, 9.2.2 |
| ISMS management review | Yearly | 9.3.1 to 9.3.3, 5.1 |
| Nonconformities and corrective actions | Quarterly | 10.1, 10.2 |
The risk register (Risks) is the record of the risk assessment and treatment: owners, scores before and after controls, treatments and accepted risks with their sign-off. Export it as XLSX for the treatment plan.
Each nonconformity is a task (Tasks) with its corrective action, owner and proof; the quarterly check attaches the list.
The certification audits
Create an ISO 27001 audit for each audit of the cycle and set ISO 27001 audit to its stage:
- Stage 1, the review of the management system and the SoA. Annex A controls start as not applicable in a stage 1 audit; switch on any the auditor wants to see. Changing the audit to another stage brings them back (except the ones the SoA excludes).
- Stage 2, the certification audit.
- Surveillance audits in years 1 and 2.
- Recertification in year 3, which starts a new cycle.
The audit’s Settings page shows the certification cycle: from the end of the closed stage 2 (or recertification) audit, when each surveillance audit and the recertification fall due, and which audit covers each. Your certification body sets the real dates.
Auditor requests, the evidence package and the readiness report work on ISO 27001 audits as on any other.
What Proofroom does not do
Proofroom does not certify you or reproduce the standard. An accredited certification body audits and certifies; your consultant or auditor confirms what the standard requires of you.