01
Organisational (37 controls)
Policies, roles, supplier relationships, incident management and business continuity.
ISO/IEC 27001:2022
Get to ISO 27001 with every Annex A control already mapped.
All 93 Annex A controls come with owners, evidence and a Statement of Applicability. Your auditor sees the proof, and you stop assembling it by hand.
- Standard
- ISO/IEC 27001:2022
- Annex A controls
- 93
- Setup
- About an hour
What it is
What ISO 27001 asks of you
ISO 27001 is the international standard for an information security management system, or ISMS. It asks you to find your information security risks, decide which controls treat them, run those controls, and review the result every year.
An accredited certification body audits you against it. If you pass, you receive a certificate that lasts three years, with an audit every year in between.
Who needs it
- Banks, payment service providers and other institutions the Bank of Ghana regulates. The CISD asks for ISO 27001 certification.
- Fintechs that sell to banks and are asked for a certificate in every procurement round.
- Any organisation that holds customer financial data and wants one recognised answer to how it protects it.
What it covers
Ninety-three controls, four themes
Annex A groups its controls into four themes. Each control in CyberPlug has an owner, a status and the evidence behind it.
02
People (8 controls)
Screening, awareness training, remote working and leaving the company.
03
Physical (14 controls)
Secure areas, equipment and clear-desk rules for your offices and data rooms.
04
Technological (34 controls)
Access control, encryption, logging, secure development and network security.
05
The management system itself
Scope, risk assessment, risk treatment, a Statement of Applicability, internal audit and management review (clauses 4 to 10).
The problem
Why ISO 27001 eats a quarter
- The Statement of Applicability lives in a spreadsheet, and it falls out of date the day someone changes a control.
- Proof sits in email threads, Drive folders and screenshots. In the teams we interviewed, assembling it took two to three weeks per audit cycle.
- The same multi-factor authentication evidence is collected again for the next framework.
How CyberPlug helps
Start from a mapped library, finish with proof
- 01
A control library that is already mapped
All 93 Annex A controls are in your workspace on day one, linked to the clauses they satisfy. You assign owners instead of writing the list.
- 02
A Statement of Applicability that updates itself
Choose ISO 27001 during setup and your Statement of Applicability is seeded, with required controls linked. Export it for your auditor whenever they ask.
- 03
Evidence from the systems you already run
Read-only connectors collect configuration evidence from AWS, GitHub, Google Workspace, Okta and PostgreSQL every 24 hours. Documents without an API are uploaded once and go through the same review.
- 04
A person approves everything
A control passes only when its automated checks pass and its evidence is active and valid. Automation never approves a control, so when an auditor asks who signed off, there is a name.
- 05
Readiness you can see
A live readiness score shows which controls still lack evidence, who owns each one and how far along the audit is. Your auditor gets read-only access.
Path to ready
From first login to audit day
- 1
Set the scope
Decide which systems, sites and teams the ISMS covers.
- 2
Assess risk
Log your risks, score likelihood and impact, assign owners.
- 3
Choose your controls
Review the Annex A library and record why each control applies or does not.
- 4
Run and evidence the controls
Connect your systems and upload what has no API.
- 5
Audit yourself
Close gaps ahead of an internal audit and a management review.
- 6
Sit the certification audit
An accredited certification body audits you. CyberPlug prepares the evidence and does not issue the certificate.
CyberPlug covers steps 2 to 5 inside the platform. Your certification body runs step 6.
One control, many frameworks
Certify once, answer the Bank of Ghana with the same evidence
The Bank of Ghana's directive asks for ISO 27001 certification. A control you evidence for ISO 27001 counts toward the matching CISD requirement and toward the Data Protection Act, so you prove it once.
FAQ
Questions we hear most
Does CyberPlug certify us?
No. An accredited certification body issues ISO 27001 certificates. CyberPlug prepares your controls, evidence and Statement of Applicability so that audit goes faster.
Do I still need a consultant?
Some teams keep one for risk workshops or the internal audit. CyberPlug gives them, and you, one place to see where every control stands.
Can my auditor see the evidence?
Auditors get read-only access to the evidence, its history and the named person who approved it. They can inspect it directly instead of asking for screenshots.
What does CyberPlug read from our systems?
Configuration metadata only, such as whether encryption or multi-factor authentication is switched on. It never reads your data, your email or your source code, and every connector is read-only.
Does the library cover the 2022 version?
Yes. The library follows ISO/IEC 27001:2022 and its 93 Annex A controls.
How long does setup take?
A first workspace takes about an hour: create the account, choose ISO 27001, invite your team and describe what you run.