ISO 27001 Compliance Skill

Mandatory Clauses (4–10) — Apply to ALL versions

Both 2013 and 2022 share the same clause framework. The 2022 version added minor structural sub-clauses (6.3, split 9.2, split 9.3) but no new obligations.

Annex A Controls

• 2022 version: 93 controls in 4 themes → read references/annex-a-2022.md
• 2013 version: 114 controls in 14 domains → read references/annex-a-2013.md
• Cross-version mapping: read references/control-mapping.md

Core Workflows

1. Gap Analysis

When asked to perform or help with a gap analysis:

1. Ask for: version (2013/2022), scope of ISMS, industry/sector if relevant
2. Produce a table covering ALL applicable clause requirements + selected Annex A themes
3. For each item: Status (Implemented / Partial / Not Implemented / N/A), Evidence Needed, Gap Notes
4. Summarise critical gaps and recommended priority order
5. Offer to generate a remediation roadmap

Status definitions:

• ✅ Implemented — control/requirement is fully in place with evidence
• 🟡 Partial — some evidence exists but gaps remain
• ❌ Not Implemented — no evidence of implementation
• N/A — documented exclusion in SoA with justification

2. Policy & Document Generation

When generating policies or documents:

• Always include: Purpose, Scope, Policy Statement, Roles & Responsibilities, Procedures/Controls, Review Cycle, References
• Map each policy to the relevant ISO 27001 clause(s) and Annex A control(s)
• Include a document control block: Version | Author | Approved By | Date | Next Review

Common policy types and their primary mappings:

3. Control Implementation Guidance

For any Annex A control, structure your response as:

Control: [ID] [Name]

• Purpose: Why this control exists
• What to implement: Concrete, actionable steps
• Evidence for audit: What an auditor will look for
• Common pitfalls: What teams typically miss
• 2013→2022 note (if applicable): What changed

Consult references/annex-a-2022.md for full control descriptions.

4. Risk Assessment Support

When helping with risk assessment or risk register:

1. Use the standard likelihood × impact methodology
2. Risk register columns: Asset | Threat | Vulnerability | Likelihood (1–5) | Impact (1–5) | Risk Score | Treatment Option | Control(s) | Owner | Due Date | Residual Risk
3. Treatment options: Accept | Avoid | Transfer | Mitigate
4. Remind user: SoA must reflect selected controls from risk treatment
5. Offer to generate a Risk Treatment Plan (RTP) after the register

Version Differences — Quick Reference

11 New controls in 2022: A.5.7 Threat intelligence | A.5.23 Cloud services security | A.5.30 ICT readiness for BC | A.7.4 Physical security monitoring | A.8.9 Configuration management | A.8.10 Information deletion | A.8.11 Data masking | A.8.12 Data leakage prevention | A.8.16 Monitoring activities | A.8.23 Web filtering | A.8.28 Secure coding

Mandatory Documentation Checklist

Produce this as a checklist when asked for certification readiness:

Mandatory records (ISO 27001:2022):

• ISMS Scope (4.3)
• Information Security Policy (5.2)
• Risk assessment process (6.1.2)
• Risk treatment process (6.1.3)
• Statement of Applicability (6.1.3d)
• Information security objectives (6.2)
• Evidence of competence (7.2)
• Operational planning results (8.1)
• Risk assessment results (8.2)
• Risk treatment results (8.3)
• Monitoring & measurement results (9.1)
• Internal audit programme + results (9.2)
• Management review results (9.3)
• Nonconformities + corrective actions (10.1)

Reference Files

Load the appropriate reference file based on the task:

• references/annex-a-2022.md — Full list of all 93 Annex A controls (2022) with descriptions
• references/annex-a-2013.md — Full list of all 114 Annex A controls (2013)
• references/control-mapping.md — Cross-reference table: 2013 ↔ 2022 control mapping

When to load reference files:

• User asks about a specific control → load the relevant version's reference file
• Performing gap analysis → load both version files if cross-version
• Generating SoA → load annex-a-2022.md (or 2013 if specified)
• Transition assessment → load control-mapping.md