Skip to content
EU Rules Finder
English (Language)

ISO 27001 templates filled in for you: Statement of Applicability, risk register and policy

An information security management system under ISO/IEC 27001:2022 rests on a few core documents: the scope, the policy, the risk assessment and its treatment plan, the Statement of Applicability and the objectives. Answer the questions once; the kit writes them as Word files in English, German, Spanish, French, Polish or Italian, works out each risk level, and lists all 93 Annex A controls with your decisions.

Checked against the sources on 25 October 2026

Organization
Context and scope
What it covers, for example: development, hosting and support of the Acme booking platform.
One per line.
One per line. Leave empty if nothing is left out.
Activities outside the scope or done by others that it relies on, for example cloud hosting or payroll. One per line.
What inside the organization affects security, for example a small IT team or a legacy system. One per line.
Outside factors, for example the NIS2 rules, customer demands, attacks on your sector. One per line.
Amendment 1 of 2024 asks every organization to decide this, for example yes for a data centre at risk of flooding.
One per line, for example Customers: security clauses in contracts; Data protection authority: GDPR.
Information security policy
Name and role.
For example the managing director.
One per line, for example Access control, Backup, Acceptable use, Remote working.
A whole number from 1 to 36; 12 is usual.
SOC 2 and NIS2

The kit adds seven topic policies, a SOC 2 criteria worksheet and a NIS2 Article 21 record. Security is always in the worksheet; tick the other SOC 2 categories your report will cover.

Risks

Risks with a level (likelihood × impact) up to this number may be accepted, for example 8.
Risk R1
For example the customer database.
For example a stolen administrator password, no second factor.

Risk level: rate likelihood and impact

Numbers from the list below, for example 5.17, 8.5.

Statement of Applicability: the 93 controls

For each control: included or excluded, why, and whether it is in place. A control named in a risk above is justified by that risk.

0 of 93 decided.

5. Organizational controls
  • 5.1 Information security policy and topic policies
  • 5.2 Security roles and who is responsible
  • 5.3 Conflicting duties kept apart
  • 5.4 Management makes staff apply security
  • 5.5 Contacts with authorities
  • 5.6 Contacts with security groups and forums
  • 5.7 Information on threats collected and analysed
  • 5.8 Security in projects
  • 5.9 Inventory of information and assets, with owners
  • 5.10 Rules for acceptable use
  • 5.11 Assets handed back on leaving
  • 5.12 Information classified by need for protection
  • 5.13 Information marked with its class
  • 5.14 Rules for sending and sharing information
  • 5.15 Access control rules
  • 5.16 Identities managed over their whole life
  • 5.17 Passwords and other log-in secrets
  • 5.18 Access rights granted, reviewed and removed
  • 5.19 Security with suppliers
  • 5.20 Security terms in supplier contracts
  • 5.21 Security in the ICT supply chain
  • 5.22 Supplier services monitored and changes managed
  • 5.23 Use of cloud services
  • 5.24 Incident handling prepared
  • 5.25 Security events assessed and classified
  • 5.26 Response to incidents
  • 5.27 Lessons from incidents
  • 5.28 Evidence collected and preserved
  • 5.29 Security kept during disruption
  • 5.30 ICT ready for business continuity
  • 5.31 Legal, regulatory and contract requirements identified
  • 5.32 Intellectual property respected
  • 5.33 Records protected
  • 5.34 Privacy and personal data
  • 5.35 Independent review of security
  • 5.36 Compliance with own security rules checked
  • 5.37 Written operating procedures
6. People controls
  • 6.1 Background checks of candidates
  • 6.2 Security duties in employment contracts
  • 6.3 Security awareness and training
  • 6.4 Disciplinary process for breaches
  • 6.5 Duties after leaving or changing job
  • 6.6 Confidentiality agreements
  • 6.7 Working from home and other remote places
  • 6.8 Staff report security events
7. Physical controls
  • 7.1 Secure boundaries around premises
  • 7.2 Entry controls
  • 7.3 Offices, rooms and facilities secured
  • 7.4 Premises monitored
  • 7.5 Protection from physical and environmental threats
  • 7.6 Rules for working in secure areas
  • 7.7 Clear desk and locked screens
  • 7.8 Equipment placed and protected
  • 7.9 Assets taken off the premises
  • 7.10 Storage media handled over their life
  • 7.11 Power and other utilities
  • 7.12 Cables protected
  • 7.13 Equipment maintained
  • 7.14 Equipment wiped or destroyed before disposal or re-use
8. Technological controls
  • 8.1 Laptops, phones and other user devices
  • 8.2 Administrator and other privileged access
  • 8.3 Access to information restricted
  • 8.4 Access to source code
  • 8.5 Secure log-in
  • 8.6 Capacity planned and monitored
  • 8.7 Malware protection
  • 8.8 Technical vulnerabilities handled
  • 8.9 Secure configurations
  • 8.10 Information deleted when no longer needed
  • 8.11 Data masking
  • 8.12 Data leakage prevented
  • 8.13 Backups
  • 8.14 Redundant systems
  • 8.15 Event logs
  • 8.16 Monitoring for unusual behaviour
  • 8.17 Clocks synchronised
  • 8.18 Powerful utility programs restricted
  • 8.19 Software installed on live systems
  • 8.20 Network security
  • 8.21 Security of network services
  • 8.22 Networks separated
  • 8.23 Web filtering
  • 8.24 Encryption and key management
  • 8.25 Secure development life cycle
  • 8.26 Security requirements for applications
  • 8.27 Secure architecture and engineering principles
  • 8.28 Secure coding
  • 8.29 Security testing before acceptance
  • 8.30 Outsourced development supervised
  • 8.31 Development, test and production kept apart
  • 8.32 Changes managed
  • 8.33 Test data protected
  • 8.34 Systems protected during audit tests

Objectives

Objective 1
For example multi-factor log-in on all administrator accounts.
How you will know, for example 100 % of administrator accounts.
Language of the documents

Nothing you type is sent anywhere. Your business details stay in this browser for next time.

What is in the files

  • the ISMS scope, with the internal and external issues, the climate change question of Amendment 1:2024, the interested parties and their requirements, the sites, what is left out and the interfaces (clauses 4.1 to 4.3);
  • the information security policy with the commitments of top management, the roles and your topic-specific policies (5.2);
  • the risk assessment: the method, the 1 to 5 scales, your acceptance level, and the register with likelihood × impact worked out for every risk (6.1.2);
  • the risk treatment plan with the option, the Annex A controls, the action, who and when, and a column for each risk owner's approval (6.1.3);
  • the Statement of Applicability: all 93 controls of Annex A, included or excluded, the justification (the risks a control treats are filled in for you) and whether it is implemented (6.1.3 d), also as a CSV file for a spreadsheet;
  • the information security objectives with measure, resources, owner and date (6.2), and a read-me listing what the standard asks for beyond these files.

Checks the kit makes

A risk level is only worked out from whole ratings from 1 to 5; anything else is marked to complete. A control number that is not in Annex A is shown as refused, not guessed. A control you exclude while one of your risks relies on it is flagged in the form and in the Statement of Applicability. Nothing is left blank silently: every gap reads TO COMPLETE.

ISO 27001 and NIS2

The NIS2 Directive (EU) 2022/2555 does not require certification to ISO/IEC 27001. Its Article 21 requires essential and important entities to take risk-management measures, taking into account, where applicable, relevant European and international standards, and Article 25 asks Member States to encourage their use. A risk assessment, a policy and a Statement of Applicability are a common way to show how those measures were chosen. How the kit maps its policies to SOC 2 and to Article 21: SOC 2 and NIS2 policies.

What the kit does not do

It does not contain the text of the standard: the control names are our own short words, and you need your own copy of ISO/IEC 27001 to read the requirements. It does not write the procedures behind each control, run your internal audit or management review, or certify anything: only an audit by an accredited certification body leads to a certificate. The documents are in English, German, Spanish, French, Polish and Italian.

Nothing you type leaves your browser; the files are built on your device. Templates, not legal advice.

Sources