Lion Cipher Lab
Do an ISO/IEC 27001 Annex A gap assessment and build a Statement of Applicability
- GRC / Compliance
- Intermediate
- ~60 min
- Free · no account required
Why it matters
ISO/IEC 27001 is the international standard for information security management, and in practice it is the certification enterprise customers, European buyers and procurement teams ask for by name before they will sign. If you work in security anywhere near a sales cycle, a vendor questionnaire or an international customer, this standard will land on your desk. The single document an ISO 27001 auditor asks for first is the Statement of Applicability - the table that says, control by control, which of the standard's Annex A controls apply to you, why, and what you are doing about each one. It…
What you'll learn
- what an ISMS (information security management system) is
- ISO/IEC 27001 versus ISO/IEC 27002
- writing an ISMS scope statement
- the 2022 Annex A structure (93 controls, four themes)
- running a control gap assessment
- risk treatment decisions
- writing a Statement of Applicability, including justified exclusions
- choosing between ISO 27001, SOC 2 and NIST CSF
- audit evidence thinking
Steps in this lab
- What ISO/IEC 27001 actually is, and the mental shift almost everyone gets backwards
- Scope first - you cannot assess what you have not bounded
- Annex A in the 2022 revision - 93 controls in four themes, and why the old shape still haunts the internet
- Build the gap-assessment table
- Fill in ten real controls, end to end
- Where the SoA actually comes from - risk assessment and risk treatment
- Write the Statement of Applicability extract, exclusions and all
- The judgment layer - when ISO 27001 is the right answer, and when it is not