Regulatory Standards · Global
ISO/IEC 27001
ISO 27001, run as a living ISMS.
ISO 27001 certification rests on risk assessment, treatment and evidence of Annex A controls. Astragar connects your risk register to real assets, vulnerabilities and control evidence.
Book a ISO 27001 review✓ Available in Astragar GRC
93
Annex A controls in the 2022 edition
4
Themes: organisational, people, physical, technological
3 years
Certification cycle with annual surveillance audits
What ISO 27001 requires
The obligations, in brief.
ISMS scope & context
Define scope, interested parties and leadership commitment.
Risk assessment
Identify, analyse and evaluate information security risks.
Statement of Applicability
Justify which Annex A controls apply and how they are met.
Improvement
Internal audit, management review and corrective action.
How Astragar helps
From checklist to measurable risk.
01
Requirement → control mapping
Map every ISO 27001 requirement to controls, systems, assets and owners.
02
Evidence, continuously
Collect and maintain evidence, with sign-off from contributor to IT auditor, CISO and executive office.
03
Exposure behind the gaps
See which vulnerabilities and sensitive data put ISO 27001 controls at risk.
04
Risk in financial terms
Prioritise remediation by business and financial impact, not checklist order.
Risk assessment is the heart of ISO 27001. Astragar grounds it in live vulnerability and data exposure, valued in money.
Sign-off workflow
Evidence Contributor
→IT Auditor
→CISO
→Executive Office
Find the data. Test the controls. Reduce the risk.
Start with a scoped ISO 27001 review: requirements mapped, evidence gaps found, remediation prioritised by financial impact.
Book a ISO 27001 reviewAstragar supports compliance programmes with technical evidence and risk analysis. It does not provide legal advice or issue certifications.
See your cyber risk in $ terms, not CVSS scores.
