ISO 27001 Toolkit: What to Check Before You Buy One
“ISO 27001 toolkit” is a buying-decision search, not a curiosity search. Nobody types it to learn what ISO 27001 is — they type it because they have already decided to get certified, and they are deciding how to get the documentation done: build it themselves, hire a consultant, or buy a set of templates and adapt them.
That third option covers a wide range of things sold under the same word. Some toolkits are four Word documents and a cover page. Some are 140 files with a worked example for every register. The word “toolkit” tells you nothing about which one you are looking at — only the contents do, and most buyers check those contents after paying, not before.
The search term itself is a useful signal of where you are in the decision: “toolkit” almost always means you have ruled out doing nothing, and you are choosing between doing it yourself, paying for structure, or paying for judgement. This article is about the middle option, but it only makes sense against the other two — which is why the comparison below covers all three rather than treating the toolkit decision as though it happens in isolation.
This is what to check first, whichever toolkit you are looking at, including ours.
Want the short version? The ISO 27001 Compliance Suite is 43 audit-ready files covering clauses 4 to 10 and the Annex A controls, with the Statement of Applicability pre-populated. €590 excl. VAT.
What a complete ISO 27001 toolkit actually has to cover
ISO/IEC 27001:2022 asks for two different kinds of documentation, and a toolkit that only delivers one of them will get you through a document review and stall at the first interview.
The first kind is the management-system layer: the seven clauses from 4 (context) to 10 (improvement) that every ISO management standard shares — scope, leadership commitment, objectives, competence, operational planning, monitoring, internal audit, management review. This layer is mostly policy and procedure documents, and it is the layer every toolkit on the market covers reasonably well, because it barely changes between standards.
The second kind is Annex A: the reorganised set of controls the 2022 revision restructured into four themes — organisational, people, physical, technological — covering roughly ninety controls, eleven of them new to the 2022 edition (threat intelligence, cloud security, and data masking among them). This is the layer that separates a real toolkit from a padded one, because it needs a document, register or procedure behind every control an organisation’s risk assessment marks applicable — not a policy statement that mentions the control by name and moves on.
A genuinely complete toolkit produces evidence for both layers: policies and procedures for clauses 4 to 10, and a working document, register or procedure trail for every applicable Annex A control, tied together by a Statement of Applicability that says which is which.
The free-toolkit trade-off
Free ISO 27001 templates are genuinely useful, and dismissing them outright would be dishonest — several cover the mandatory documents competently and get a small organisation most of the way to a first draft.
What the free tier reliably trades away is not quality of writing, it is completeness of the operational layer. A pattern repeats across most free offerings: strong coverage of policies (information security policy, acceptable use, access control), thin or absent coverage of the registers an auditor actually samples during stage 2 — asset inventory, supplier register, training matrix, non-conformity log — because registers are less reusable across organisations and cost more to build well. A free set can look complete by document count while missing the records that generate evidence over time rather than on day one.
The other recurring gap is currency. A toolkit built for the 2013 edition’s fourteen-category Annex A structure, never rebuilt for the 2022 four-theme reorganisation, will misalign your Statement of Applicability with what a certification body’s checklist now expects — and whether it reflects the 2024 climate-change amendment to clauses 4.1 and 4.2 tells you how actively it is maintained at all.
Neither gap disqualifies a free toolkit from being a reasonable starting point. Both are worth checking before you build a certification programme on top of one.
Seven checks before buying an ISO 27001 toolkit
Ask these regardless of price — a low price with honest answers beats a high price you never verified.
- Does the Statement of Applicability come pre-populated, or blank? A blank SoA template is a spreadsheet, not documentation. A populated one with real justifications is a starting point you edit, which is a materially different amount of work.
- Are the registers included, or only the policies? Ask for the actual file list, not a page count. A ten-page information security policy and a one-line asset register both count as “documents” in marketing copy.
- Does it reflect ISO/IEC 27001:2022’s four-theme Annex A structure, and the 2024 amendment? If a vendor cannot answer this in one sentence, the toolkit predates one of the two and needs rework you will do yourself.
- Is the pricing per-seat, per-org, or a one-time fee? Per-seat licensing on a document set — not a running platform — often costs more over three years than a flat purchase, and the difference rarely appears until checkout.
- What updates are included, and for how long? Annex A does not change often, but it has changed twice in three years. A toolkit with no update path ages the moment you buy it.
- Can you see a real sample document before paying? Not a screenshot of a table of contents — an actual page, so you can judge the writing and the depth before committing.
- Is there a mapping showing which document or register satisfies which clause or control? Without one, you are left reverse-engineering the standard’s structure from a folder of files during your own internal audit prep.
Red flags that predict a rough audit
A few patterns show up often enough in weak toolkits to be worth naming plainly.
Inflated file counts. Splitting a single procedure into a cover page, a revision-history page and a one-paragraph body counts as three files and reads as padding to anyone who opens them.
Placeholder text left in the writing itself. Not the company-name fields, which are expected — sentences that read “insert your risk appetite statement here” inside what is sold as a finished policy.
No version control fields. No version number, no approval date, no owner. In an audit, a document without a visible revision history reads as untested, whether or not it actually is.
Generic Annex A justifications. Every control marked applicable with the same one-line reasoning, regardless of what the control actually does — the surest sign the Statement of Applicability was assembled from a checklist rather than a risk assessment.
No cross-references between documents. A risk register that never mentions the risk treatment plan, a Statement of Applicability that never points back to the risk assessment — each document exists as an island, which is exactly what an auditor is trained to notice.
What changes as the price goes up
Not every gap costs money to close — some just cost time you would rather spend elsewhere. Roughly, though, price tends to track four things: whether registers are included alongside policies, whether the SoA arrives populated or blank, whether updates are included past the purchase date, and whether there is a real person to ask when a control does not obviously apply to your organisation.
None of the four is optional if the goal is certification rather than a folder of documents. A cheaper toolkit that is missing one is not a bad toolkit — it is a toolkit that assumes you, or someone you hire, will supply what is missing. Knowing which one it assumes, before you buy, is the entire point of the checklist above.
Three paths, and what each one actually costs
A toolkit is one of three ways organisations get to a documented ISMS, and the other two are worth naming honestly rather than treating the toolkit decision in isolation.
Building from scratch costs no licence fee and the most internal time — typically several months of part-time work for someone who has not written ISO documentation before, much of it spent re-deriving structure the standard already specifies. The risk is not effort, it is drift: without a reference structure, it is easy to write policies that describe good practice in general without mapping cleanly to a specific clause or control, which surfaces as findings during the document review stage.
Hiring a consultant costs the most in fees and the least in internal time, and buys judgement a document set cannot: which controls matter for your specific risk profile, how deep implementation needs to go, what a specific certification body tends to push on. It does not remove the need for someone internal to own the system afterwards — a consultant builds it, your organisation has to run it.
Buying a toolkit sits between the two on both axes: real cost, but far less than a consultancy engagement; real internal time, but weeks of customisation rather than months of authoring. It converts the “what should this document contain” question into a “does this match our organisation” question, which is a faster one to answer.
None of the three is categorically right. A five-person startup with a straightforward scope often does fine building from scratch with a checklist for structure. A regulated financial entity facing its first audit within a fixed regulatory deadline often needs the consultant’s judgement on where scrutiny will concentrate. Most organisations in between — enough complexity to make writing everything from zero slow, not enough novelty to need bespoke judgement on most decisions — are exactly who a complete toolkit is built for.
Where our suite lands on this list
Applying our own checklist to our own kit, since asking the reader to trust a claim we would not test ourselves defeats the purpose of writing this: the ISO 27001 Compliance Suite ships 43 files covering clauses 4 to 10 and the Annex A controls under the 2022 four-theme structure, updated for the 2024 climate-change amendment. The Statement of Applicability is pre-populated with control-by-control justifications rather than left blank, registers are included alongside the policy set — not sold separately — and it is a one-time purchase with lifetime free updates rather than a per-seat licence. €590 excl. VAT.
That is not a claim that it is the only complete option on the market — several are, at various prices. It is what “complete” means when we apply the same seven questions to ourselves that this article asks you to apply to anyone.
If you are past the buying decision and already assembling documentation, what’s actually mandatory separates the documents ISO 27001 requires from the records that support them, the Statement of Applicability guide covers how to justify Annex A exclusions defensibly rather than generically, and what certification actually costs breaks down the audit fees a toolkit’s purchase price never includes.
Frequently asked questions
Is a free ISO 27001 toolkit enough to get certified? For a very small, low-complexity organisation, sometimes — but check the seven items above before assuming so, particularly the registers and the SoA. Most gaps surface at stage 2, not stage 1, because that is when an auditor samples operational evidence rather than reading policy prose.
How long does it take to adapt a toolkit to an organisation? For a genuinely complete set, a small organisation typically needs four to eight weeks of part-time work: customising policies to actual practice, populating registers with real data, and running the risk assessment the Statement of Applicability has to trace back to. A toolkit shortens the writing, not the thinking.
Do toolkits need to be rewritten for the 2022 revision if we last looked at ISO 27001 under the 2013 edition? Yes. The Annex A structure changed from fourteen categories to four themes, eleven controls were added, and several were merged or reworded. A 2013-vintage toolkit will not map cleanly onto a 2022 Statement of Applicability.
What is the difference between a toolkit and hiring a consultant? A toolkit gives you the documents; a consultant gives you judgement on the decisions the documents record — which controls genuinely apply, how deep a control needs to go for your risk profile, what an auditor will actually push on. Many organisations use both: a toolkit for the writing, a few hours of consulting for the decisions that do not have a template answer.
Does a more expensive toolkit guarantee certification? No toolkit guarantees certification — a certification body assesses whether your organisation operates what the documents describe, not whether the documents exist. Price correlates with completeness, not with the outcome of your audit.
Can a toolkit be used for more than one certification cycle? Yes, and it should be — the recurring cost is not buying a new toolkit every three years, it is keeping the one you have current: revising it when your scope changes, when Annex A is amended, and ahead of each recertification audit. A toolkit with no update path effectively expires the day a standard it depends on changes.
Sources
ISO/IEC 27001:2022 and Amendment 1:2024; general patterns observed across publicly available ISO 27001 documentation resources, described here without naming or characterising any specific vendor’s product.