Context & scope
Understand the organisation, interested parties and boundaries of the information security management system.
ISO/IEC 27001:2022 · ISMS
Run the ISMS as a living system.
Connect scope, assets, risk decisions, controls, policies, evidence, audits, objectives and management reviews in one operating record built around the Plan–Do–Check–Act lifecycle.
STORM supports implementation, operation and evidence. Certification decisions belong to an independent accredited certification body.
ISMS operating cycleEvidence connected
ISMSOne operating record
PlanContext · risk · objectives
DoControls · policies · actions
CheckMonitoring · audit · review
ActCorrect · improve · repeat
2022 editionthird edition, published in October 2022
2024 amendmentclimate-action considerations apply to the management system
93 controlsAnnex A reference controls grouped into four themes
Certifiable ISMScertification is optional and performed independently
The management-system requirements
From organisational context to continual improvement.
ISO/IEC 27001 defines requirements for establishing, implementing, maintaining and continually improving an ISMS. The work spans Clauses 4–10, not only the Annex A control catalogue.
Leadership
Set policy, responsibilities and management commitment so the ISMS belongs to the organisation—not only the security team.
Planning
Address risks and opportunities, assess and treat information security risk, and define measurable objectives.
Support
Maintain resources, competence, awareness, communication and controlled documented information.
Operation
Plan and control the processes needed to operate risk assessment, treatment and the wider ISMS.
Performance evaluation
Monitor and evaluate performance, perform internal audits and conduct documented management reviews.
Improvement
Manage nonconformities and corrective action and continually improve ISMS suitability, adequacy and effectiveness.
Reference controls
Compare risk-determined controls with the reference set and document inclusion, implementation and exclusions in the Statement of Applicability.
How STORM supports the requirements
One thread from scope to management review.
STORM includes built-in ISO/IEC 27001 support and connects the records that teams otherwise reconstruct across spreadsheets, documents, ticketing tools and point-in-time assessments.
Scope from real dependencies
Map services, processes, data, hardware, software, users, locations and suppliers, including internal and external dependencies. Multi-company deployments preserve entity-level segregation with consolidated oversight.
Cartography · organisational scopeAssessment, treatment & SoA
Use STORM-RM, ISO/IEC 27005 or a configurable methodology; connect impact, threats and vulnerabilities to treatment, acceptance, owners and the Statement of Applicability.
Risk register · treatment plan · SoAMeasurable ISMS performance
Define information security objectives and KPIs, set targets and Green/Amber/Red thresholds, assign owners and monitor current and historical performance.
Clause 6.2 · KPIs · trendsControlled documentation
Author or import policies and procedures, manage version history, approvals, review schedules and acknowledgements, and map documents directly to compliance controls.
Policies · RBAC · audit trailControls in the operating environment
Connect supplier assessments, vulnerabilities, incidents, technical findings and mitigation actions to the affected assets, risks and accountable teams.
Suppliers · incidents · remediationEvidence, audit & review
Trace requirements to policies, technical checks, attestations and evidence; manage internal audits and findings; consolidate results in documented management reviews.
Compliance · internal audit · Clause 9.3
Plan from risk
Keep assessment, treatment and acceptance connected.
STORM turns asset context into impact, threat and vulnerability assessments, then carries those results into scenarios, risk levels, treatment decisions and a reviewable plan.
- Configurable scales, criteria, calculations and risk matrices
- Inherent and residual risk with owners and review dates
- Risk Treatment Plan and Statement of Applicability reporting
Control documented information
Make policy lifecycle visible and auditable.
Policies and procedures retain their versions, owners, review and approval history, acknowledgement status and links to relevant controls. Existing content can be imported from SharePoint or Confluence.
- Templates, version control and complete document history
- Configurable approvals, reviews and automated reminders
- Control mapping and acknowledgement reporting
Check with evidence
Replace point-in-time status with traceable signals.
Supported Microsoft Graph checks continuously validate identity, device and security configurations. Results map to ISO/IEC 27001 controls, generate evidence and can pre-populate applicable assessment responses.
- Entra ID, Intune, Defender, Azure, Sentinel and Microsoft 365 data
- Historical execution, thresholds, severity and implementation status
- Traceability across controls, policies, checks and attestations
Measure and improve
Bring objectives, audits and management review together.
Track measurable information security objectives and use results from risk, compliance, audits, incidents, suppliers and policy acknowledgements as inputs to management review and continual improvement.
- KPI targets, thresholds, owners and trend history
- Internal audit planning, findings and remediation tracking
- Clause 9.3 agenda, decisions and improvement actions
Annex A reference set
37 controls
8 controls
14 controls
34 controls
Four themes. Ninety-three controls. A risk-based decision.
The 2022 reference controls are organised into organisational, people, physical and technological themes. Applicability is determined through the organisation's risk-treatment process and recorded in its Statement of Applicability.
Organisational
Policies, roles, assets, suppliers, incident handling, continuity and wider governance need connected ownership and evidence.
STORM policies · suppliers · incidents · reviewsPeople
Responsibilities, awareness and policy acknowledgement depend on clear roles and a reviewable record of participation.
STORM RBAC · owners · acknowledgementsPhysical
Sites, equipment and supporting infrastructure remain part of inventory, dependency, impact and treatment decisions.
STORM cartography · impact · evidenceTechnological
Configurations, vulnerabilities, logging, monitoring and remediation can be tied to affected assets, controls and risk decisions.
STORM checks · findings · technical riskCounts and themes follow official ISO/IEC JTC 1/SC 27 material for ISO/IEC 27002:2022. These summaries do not reproduce the licensed Annex A control text.
Operate the lifecycle
01
02
03
04
05
Build evidence while the ISMS runs.
Use STORM to keep decisions and evidence connected through the full management-system cycle while qualified teams retain responsibility for interpretation and implementation.
Scope
Define entities, services, processes, assets, dependencies and interested-party context.
Cartography · contextAssess
Evaluate impact, threats and vulnerabilities against defined risk criteria.
Impact · threat · riskTreat
Select controls, document applicability, assign owners and manage actions.
SoA · treatment · policiesEvaluate
Monitor evidence, measure objectives, audit the system and review performance.
Checks · KPIs · auditImprove
Resolve findings, document decisions and track corrective and improvement actions.
Findings · management reviewPractical questions
Keep implementation, controls and certification distinct.
A capable platform organises the work. It does not replace organisational judgement or independent assurance.
Does STORM include built-in ISO/IEC 27001 support?
Yes. STORM's documented framework catalogue includes ISO/IEC 27001, with assessment, control mapping, gap tracking, evidence, internal-audit and reporting workflows. The organisation remains responsible for defining scope, determining applicable controls and operating an effective ISMS.
What is the difference between ISO/IEC 27001 and ISO/IEC 27002?
ISO/IEC 27001 defines requirements for an information security management system and can be used for certification. ISO/IEC 27002 provides implementation guidance and good practices for information security controls; ISO states that ISO/IEC 27002 itself is not certifiable.
Must every Annex A control be implemented?
Control selection is risk-based. The organisation determines necessary controls, compares them with Annex A and documents inclusion, implementation status and justified exclusions in its Statement of Applicability. Obtain the official standard and qualified advice for the complete requirements.
Can STORM issue an ISO/IEC 27001 certificate?
No. STORM can support implementation, evidence, assessment, audit preparation and continual improvement. If certification is pursued, the certification decision must be made by an independent accredited certification body.
How does STORM support continual improvement?
STORM connects monitoring results, KPIs, audits, incidents, supplier assessments, risk decisions, findings and corrective actions. Management Review consolidates these inputs so decisions and improvement actions remain assigned, documented and reviewable.
Does the 2024 climate-action amendment matter?
Yes. ISO lists ISO/IEC 27001:2022/Amd 1:2024 as an applicable amendment. Organisations should use the current official standard package and consider the amendment when reviewing organisational context and interested-party requirements.
Bring your ISMS workflow
Book a STORM demo
See ISO/IEC 27001 through one connected operating record.
Use a focused walkthrough to test STORM against your scope, risk method, control set, policy lifecycle, technical evidence, audit programme, objectives and management-review process.