With online security needs evolving on an almost continuous basis, your organisation – no matter how big or small – needs the very best, simplest and most cost-effective ISO 27001 certification software tools to help you get certified.
So, we’ve put together a list of the latest and greatest ISO 27001 certification software tools. But first, let’s look at the why, what and how of certification.
Proof of protection with ISO 27001
According to Computer Weekly, one of the reasons that cyber security has become so important since the Covid-19 pandemic, is “the shift of crime online as criminals seek to make money from stealing information and committing fraud.”
Never before has it been more important to safeguard your and your clients’ data and to be able to prove that you’ve done so. But how do you go about obtaining undeniable proof that your ISMS is rock solid and will continue to adapt to new threats?
By getting ISO 27001 certified.
Always choose the best tools for the job
Attaining ISO 27001 certification can be a tedious and complex process. OR… it can be a simple and exciting process. It all comes down to the tools that you choose to use.
We spent some time researching the best, simplest and easiest-to-use tools.
There are so very many that finding the best ones meant narrowing down the criteria.
Cost, ease-of-use and free stuff were some of the criteria we used to judge the top 10 ISO 27001 software tools.
We also looked at where each tool’s company is based and who their primary clients are. Of course, the most important criterion is that the tool gets the job done and gets it done well.
At the end of the process, you should be ready to stand in front of the auditor, confident that you’ll come away with a certificate of compliance clutched in your trembling (with excitement not fear) hand.
¿Qué es la norma ISO 27001?
Before you decide on which tools to use to get certified, you need to know what the job is that you need to get done – in this case, what ISO 27001 certification is all about, and which common pitfalls you can expect.
We always like to get our info from the horse’s mouth and, according to ISO (International Organisation for Standardisation), “ISO/IEC 27001 is the world’s best-known standard for information security management systems (ISMS) and their requirements”. In other words, ISO 27001 makes sure that you establish, implement, maintain, manage and continually improve your information security.
The certification process is divided into three phases:
1. Preparation
- Define your certification scope
- Perform risk assessments
- Design controls
2. Implementation
- Implement Annex A’s 114 controls
3. Audit
- Audit Stage 1: Auditor reviews your ISMS design and mandatory ISO 27001 documentation and points of non-conformities
- Audit Stage 2: Auditor evaluates your business processes and controls.
By complying with ISO 27001 you demonstrate that you are committed to handling and managing confidential information correctly.
What is the cost of ISO 27001 certification?
As you can see, there’s a lot of work involved in getting certified. So, you’ll need to decide whether you’re going to DIY it or get some serious assistance.
Depending on whether you take the DIY route, the consultant route or the compliance platform route, the costs of your ISO 27001 certification can range from €15,000 to €88,000.
Read on to find out more about the costs of each of the tools we researched.
What is the latest ISO 27001 version?
ISO 27001 was updated in 2022. It’s not hugely different from the 2013 version, but there are a few changes that you should be aware of. Luckily PECB has whipped up this handy at-a-glance diagram.
Top 10 ISO 27001 certification software tools
Now that you know exactly what ISO 27001 is, what it costs (well, sort of) and what the latest version is, you need to know who to go to for the very best certification software tools.
Let’s take a look at the Top 10 27001 Certification Software Tools for 2023:
1. Compleye
Located: The Netherlands
Clients: Start-ups and scale-ups
Cost: Free, with limited access for startuppers; €250 per month for the DIY package
Ease of use: Super easy
Free stuff: Yes
Key Features:
Streamlined Compliance
- Manages & Maintains your ISMS in one place
- Simplifies your Cybersecurity Audits
- Operational System (goodbye to excel files)
- Incident Management
- Vendor Management
- 30+ audit-ready policy templates
- Reduces the use of multiple tools & data storage tools
Simplified Compliance
- Translates the ISO 27001 requirements into easy steps
- Provides a lean approach to certification
- Reduces documentation
- Made for GDPR, SOC 2, ISO 27001 and many more
- A lean approach helps us to customise your ISMS
- Keeps track of the changes with Activity Log (Audit Trail)
- Streamlines your compliance operations
More about the company:
Compleye was born in 2018 when founder, Karolin Kruiskamp, identified a need for a lean approach to compliance. They offer a nifty online tool – Compleye Online – with expert guidance from passionate Compliance Officers every step of the way.
Compleye Online, an all-in-one DIY compliance platform simplifies your road to ISO 27001, ISO 9001 and SOC-2 certification. It’s easy to use and includes templates and tools for every stage of your certification process. Compleye’s signature byline “Making compliance (almost) fun” says it all.
2. Secureframe
Located: USA
Clients: Start-ups and high-growth companies
Cost: Stage 1 & 2 audit: €10,000 – €15,000 Surveillance audit: €5,000 – €10,000
Ease of use: Easy
Free stuff: Yes
Key Features:
- Continuous monitoring
- Actionable notifications
- Real-time monitoring
- Automated evidence collection
- Vulnerability scanning
- Automated onboarding
- Integration library
More about the company:
Secureframe was founded in 2020 and offers a fully automated process with continuous monitoring. Secureframe’s goal is to ‘empower companies to manage their security, privacy and compliance programs to meet the demands of today and tomorrow’s business environment.’
3. IT Governance
Located: Ireland
Clients: All business sectors and industries
Cost: €1,150 for the complete ISO 27001 suite
Ease of use: Semi-Easy
Key Features:
- A complete set of mandatory and supporting documentation templates that are easy to use, customisable and fully ISO 27001-compliant.
- Helpful project tools to ensure complete coverage of the Standard.
- Industry-leading ISO 27001 implementation guidance for both technical and non-technical managers.
- Official ISO 27000 standards that outline the requirements of an ISMS.
More about the company:
IT Governance started off as an e-commerce business in 2002. It is now a recognised authority on ISO 27001 and focusses on cyber resilience, data protection, PCI DSS, ISO 27001 and cyber security.
4. ProActive QMS
Located: United Kingdom, New Zealand, USA
Clients: Public and private sector organisations
Cost: Document manager: GBP119 per month; Performance Leader: GBP163.50 per month; Business Manager (combo of document manager and performance leader): GBP249 per month
Ease of use: Super Easy
Key Features:
- Cuadro de mandos
- Action logs
- System documents
- System records
- Forms control
- Training and competence
- Equipment control
- Audits
- Measurement and analysis
- Compliance evaluation
- Mobile access
- Warnings and alerts
- System settings
- Ticket support system
- User manuals
- All reports accessible from a single point
More about the company:
Proactive QMS opened their doors in 2013 and provide a centralised tool for the tracking and management of their clients’ ISMS and ISO certification. Experts are on hand to help you navigate your way to compliance using the Proactive ISO compliance software.
5. Conformio
Located: USA & Europe
Clients: Small and medium-sized organisations
Cost: Flexible: Starter: $99/ month; Professional: $169/ month; Advanced: $199/ month
Ease of use: Easy
Free Stuff: Yes
Key Features:
- Implementation wizards
- Document templates
- Action reminders
- Dashboards
More about the company:
Conformio is brought to you by Advisera Expert Solutions. It’s an online tool that preps you for ISO 27001 certification and comes pre-loaded with mandatory document templates. Conformio provides task management features linked to specific ISO 27001 deliverables.
6. Proactive Compliance Tool
Located: The Netherlands
Clients: SMEs
Cost: On request
Ease of use: Easy-ish
Free Stuff: Yes
Key Features:
- Risk analysis
- Measures and tasks dashboard
- File and version management
- Charts and dashboards
- Charts per form
More about the company:
Driven by a young and passionate team, The PCT is a SaaS solution that allows clients to create, manage and maintain their company’s policy documents, processes, procedures and work instructions in one uncluttered environment.
7. OnSpring
Located: USA
Clients: From start-ups to Fortune 500 companies
Cost: On request; Bronze, Silver and Gold levels
Ease of use: Easy-ish
Free Stuff: Yes
Key Features:
- Reporting
- Dashboards
- Workflows
- Messaging
- Surveys
- Formulas
- Task management
- Shared lists
- Dynamic docs
- Data references
- Control de acceso
- Multi-record creation
More about the company:
OnSpring believes in people-powered automation and strives to offer a balance between automated functions and human ingenuity. In their own words, “Onspring centralises compliance activities for better control and visibility.”
8. CommandHound
Located: USA
Clients: Small, medium and large businesses
Cost: On request
Ease of use: Easy-ish
Free Stuff: Apart from the demo, not clear
Key Features:
- Cuadro de mandos
- Inbox
- Control towers
- Plantillas
- Calendar
- Intelligence
- Archive
- Control points
More about the company:
Launched in 2017, CommandHound is a general compliance software tool that uses control towers and control points to ensure a strong sense of accountability.
Using defined milestones, CommandHound keeps their clients on track with reminders and escalations to drive individual accountability and make sure the necessary work gets done on time.
9. Teramind
Located: USA
Clients: All industries and sizes
Cost: On request
Ease of use: Super-easy
Free Stuff: Yes!
Key Features:
- Monitoring and measurement
- Logs of user activities, exceptions and security events
- Security rules and access control for users and third-party vendors
- Internal audit, incident management procedure and corrective actions
- Risk assessment and treatment
- Information security awareness and training
More about the company:
In business since 2014, Teramind provides insider threat detection, data loss protection and process engineering. By monitoring user activity Teramind allows companies to detect, investigate and report data breaches.
This monitoring and reporting is useful throughout the ISO 27001 certification process allowing companies to ensure that they conform with ISO standard requirements.
10. Netwrix
Located: USA
Clients: Small – Enterprise
Cost: On request
Ease of use: Easy-ish
Free Stuff: Apart from the demo, not clear
Key Features:
- Risk assessment
- Sensitive files count by source
- Sensitive file and folder permission details
- Auditor Alert
- Incident identification and prevention
More about the company:
Netwrix was founded in 2006 and is headquartered in California. Their unified platform uses on premise and cloud-based systems and enables the continuous assessment in account management, security permissions and data governance.
Netwrix can be used to ensure ISO 27001 compliance and data security improvement. Their byline, ‘Buckle up, your real data security journey is about to begin’ gives them an edgy feel.
Tips and tricks to help you choose the right ISO 27001 software tool
When looking for the best tool, take into account that the software should be easy to use, come preloaded with (free) templates, remind you of tasks and important dates and provide you with real experts on tap to help you when you need the human touch.
Make sure that you choose the right tool according to the size of your company and (and this is important) ensure that you can attend or download a free demo before fully committing.
Also, if you plan on getting certified after March 2023, check that the tool has been updated to the latest version – in this case ISO 27001:2022.
Whichever tool you choose, it should streamline and simplify your compliance process.
In other words it really should be what our number 1 contender, Compleye, defines as an “All-in-One DIY Compliance Platform”.
It’s clear that even though online safety is becoming more fragile and even though the needs of cyber security change all the time, there is no shortage of companies that can offer excellent tools to make sure that you can attain ISO 27001 certification and prove to your clients that their data is safe with you.
Whichever ISO 27001 certification software tools you choose, we hope that it makes your compliance journey easy and perhaps even (almost) fun!
Frequently Asked Questions
Which KPIs should we track for ISO 27001?
ISO 27001 does not prescribe a list, but these are the most common starting points:
- Security incidents. How many occur, and how fast you detect and resolve them.
- Incidents resolved within target time. For example, serious incidents within 24 hours and less serious ones within 72 hours.
- Anti-malware coverage. The percentage of systems that need protection and have it active and up to date.
- Security roles filled. Whether leadership, risk management, internal audit and control owners are assigned.
- Non-conformities and improvements. How many are raised, and how quickly they are closed.
- Follow-through on management reviews and risk assessments. How fast the agreed actions get done.
Does ISO 27001 require us to track KPIs?
The standard does not name specific KPIs, but Clause 9.1 requires you to decide what to monitor and measure across your information security processes and controls, and to evaluate the results. In practice, KPIs are how you prove this to an auditor.
How many KPIs should we start with?
Start with a small set you can measure reliably each month, not a long list that nobody maintains. Tie each KPI to a security objective that management has approved. You can tighten the targets as your ISMS matures, or relax them if they prove unrealistic.
What is a good target for security incident response time?
A common starting point for a standard organization is to resolve serious incidents within 24 hours and less serious ones within 72 hours. The right target depends on your risk appetite, your resources and the severity of the incident, so treat these numbers as a baseline to adjust.
How can we track ISO 27001 KPIs without managing spreadsheets?
Spreadsheets break down once several people own different controls and evidence lives in different places. A compliance platform keeps tasks, incidents, audits and evidence in one system, so KPI data comes from the same place your auditor will look. Reservar una demostración to see how Compleye supports ISMS monitoring for SaaS teams.
