iso27001

Specify your target version (2013 or 2022), ISMS scope, and industry. The skill produces a table covering all mandatory clauses 4-10 and applicable Annex A controls, with status ratings, evidence needed, gap notes, and a prioritized remediation summary.

The 2022 version reduced Annex A from 114 controls in 14 domains to 93 controls in 4 themes, added 11 new controls covering cloud security, threat intelligence, and data masking, and introduced minor clause changes like 6.3 and split sub-clauses in 9.2 and 9.3.

Mandatory records include the ISMS scope, information security policy, risk assessment and treatment processes, Statement of Applicability, security objectives, competence evidence, internal audit results, management review results, and nonconformity records with corrective actions.

The policy should include purpose, scope, policy statement, roles and responsibilities, procedures, review cycle, and a document control block. It maps primarily to clause 8.1 and Annex A 2022 controls A.5.15 through A.5.18.

The new controls are A.5.7 threat intelligence, A.5.23 cloud services security, A.5.30 ICT readiness for business continuity, A.7.4 physical security monitoring, A.8.9 configuration management, A.8.10 information deletion, A.8.11 data masking, A.8.12 data leakage prevention, A.8.16 monitoring activities, A.8.23 web filtering, and A.8.28 secure coding.

No. The skill provides general compliance information and implementation guidance, not legal advice. Certification decisions and formal audits require an accredited certification body, and complex compliance questions should be verified with qualified counsel or assessors.