ISO/IEC 27001:2022
For the CISO, compliance lead or founder whose customers, partners or board ask for ISO 27001. Run your ISMS, decide which Annex A controls apply, and see where you stand with a free readiness check.
What the standard asks
ISO 27001 is voluntary, but it is often the price of entry in enterprise sales and procurement. Certification rests on three things.
Set the scope, a security policy and objectives, assess and treat your information risks, make sure people are competent, then measure, audit internally and improve.
Decide which of the 93 reference controls you need for your risks, and record each decision and its reason in a Statement of Applicability.
A certification body, usually an accredited one, audits you in two stages, documents first and then practice, followed by surveillance audits each year and recertification every three years.
Annex A by theme
How Fidureon covers it
The parts of an ISMS that take the most time, in one place, each tied to the clause or control it answers.
Clauses 4–10
All 30 management-system requirements, from the context of the organisation (4.1) to improvement (10). Each requirement’s status comes from the actions your teams complete, so it moves when the work does.
Annex A controls
Each control has an owner, a review frequency and a review method, audit or self-assessment, and lists the risks it mitigates. Link it to the Annex A controls and clauses it meets, and its health comes from its reviews.
Gap analysis
Score every requirement in a gap assessment, compare it with an earlier baseline, and generate a branded PDF report for management or your auditor. Consultancies run the same assessments for clients from the partner console.
Asset inventory · A.5.9
Map a process on the canvas and add the assets, information and suppliers each step uses, or create new ones right there. When you save, the links fill themselves in, so every asset in the register shows which suppliers and information it involves.
Works with your other frameworks
Link the control behind ISO 27001 A.5.19 to the security measures of Cybersäkerhetslagen, the Swedish NIS2 law, and to GDPR Art. 28, and its status and evidence count toward each. With the DORA module, the same supplier records carry the ICT third-party profile for your register.
FAQ
No. An ISO 27001 certificate is issued by a certification body, usually an accredited one, after its own audit. Fidureon is where you build and run your information security management system, record your Statement of Applicability and keep the evidence, so that you are ready when the auditor arrives.
ISO/IEC 27001:2022, the current edition: 30 requirements across clauses 4 to 10 and all 93 Annex A controls, grouped in the four themes organisational, people, physical and technological.
Each Annex A control is marked applicable or not applicable, with a justification and a justification type: security baseline, risk, regulatory, contractual. In the readiness check, six risk-profile questions mark the controls that are clearly out of scope as not applicable, using fixed rules, not AI; every other control stays applicable, and you can change any decision. The Statement of Applicability exports to CSV.
Yes. You keep assets, information types with their classification, and suppliers in registers. On the process canvas you draw how a process runs, add the records each step uses, and create new ones right there with Create & Link. When you save, Fidureon links the process to those records, and the connections on the diagram link assets to their information types and suppliers, so the asset register shows them. Drawing alone never creates register entries.
A guided, chat-led assessment in the Fidureon app. ISO 27001 is its default track; the other track is the EU AI Act. You upload the documents you already have, Fidureon proposes a score for each requirement, and a person reviews and approves every proposed score. You end with a readiness score and a list of gaps.
From GitHub, yes. In the readiness check, the GitHub connector reads configuration from your most active repositories, such as branch protection and required reviews, CODEOWNERS, CI workflows, vulnerability alerts and secret scanning, and turns it into proposed scores that you approve. Other evidence, such as policies and records, is uploaded or written in Fidureon.
Yes. A control can be linked to requirements in any framework you have active, such as GDPR, NIS2 (Sweden) and ISO 42001, so the same control and its evidence count toward each of them. You make the links yourself, and Fidureon suggests them when you import controls from documents or spreadsheets.
Fidureon is built and operated by CShift AB in Göteborg and hosted on Google Cloud in the EU: europe-north1 (Finland) is the primary region, and evidence files are replicated every day to europe-north2 (Stockholm). The AI runs on models hosted in EU data centres: Google’s models on Vertex AI in the EU, and selected flows on Mistral, a European AI company. The security page has the details.
Security, hosting and sub-processors in detail: Security at Fidureon.
See Fidureon on your own ISO 27001 scope, or start the free readiness check on the ISO 27001 track.