AmpliFlow brings together risks, 93 controls, the SoA, ownership, nonconformities, and management follow-up. You get a project plan and optional expert support before certification. After the audit, you continue in the same software.
Free, with no preparation needed. After the call, you receive a quote with the proposed setup, support, and price.
ISO/IEC 27001 requires an information security management system that is established, implemented, maintained, and continually improved. Its documented scope determines which parts of the organization are included. Within that scope, information security must be part of working methods, decisions, and management follow-up to protect the confidentiality, integrity, and availability of information.
Management
Management sets the policy and objectives, ensures that responsibilities and resources are in place, and checks that the ISMS achieves its intended outcomes. In AmpliFlow, you keep decisions, owners, tasks, and results together.
Risks
Assess each information security risk, decide how to treat it, document the required controls, and specify who can approve the decision.
The business
The ISMS covers people, processes, suppliers, physical environments, and technical systems within its defined scope. The organization decides who does what. For example, management can make decisions, affected business functions can implement working methods, and IT can monitor the selected technical safeguards. Decisions, ownership, and follow-up results are recorded in AmpliFlow.
During the certification project, connect controls to risks, processes, legal requirements, and governed pages with policies and procedures. After the audit, use the same platform for risk decisions, actions, objectives, nonconformities, audit results, and management review.
Screenshots showing work with risks, controls, and documents
The screenshots show a project overview, the information security control register, an operational risk analysis, and a published policy.
ISO/IEC 27001:2022 has 93 controls in Annex A. The AmpliFlow control register contains them, organized by code and category. Assess the controls against your approved risk treatment, legal requirements, customer requirements, and contractual requirements, and add custom controls where your business needs them.
Follow up the status and owner of each control, create tasks, and attach records such as approvals, test reports, procedures, or screenshots that show what has been completed.
Optional AI assistance can produce text drafts for you to review and edit. In the control register, you can export the Statement of Applicability (SoA) as a PDF.
Book a free call about the control work →Annex A contains
93
controls available in the control register.
Reuse processes, customer requirements, competence requirements, nonconformities, and objectives in the same platform. Activate only the modules you need and assess each standard's requirements separately.
Requirements, processes, and controls
Assign each customer requirement to an owner and specify the affected processes. Link each legal requirement to the controls you assessed as contributing to compliance and record an owner, review interval, and the material to be checked.
Verify corrective actions
Record the nonconformity, assign an owner, approve the corrective action, and document who verified its effectiveness and what evidence they reviewed.
Input for management
Compile documented competence requirements, completed training, objective results, overdue actions, and current audit reports for management review.
Build the management system step by step with risk management, controls, SoA, documentation, and follow-up. Use the same records in ongoing work after the audit.
Define the management system scope, identify relevant stakeholders, and map the requirements your information security work must address.
Approve the policy, roles, and risk criteria, then document competence requirements and objectives.
Treat risks, review control status, approve actions, and assign an owner and due date to each action.
Close the remaining gaps and compile risk decisions, control records, internal audit results, and management-review input. A certification body conducts the external certification audit.
Every package includes AmpliFlow, system setup, file migration, templates, and an introduction to the software and templates. The difference is how much support you get with project leadership, internal audit, training, and adaptation. Every level requires management involvement and an internal owner.
You lead and carry out the work yourselves
For teams with an internal project lead that want to build the management system themselves on a ready-made foundation in AmpliFlow.
Included
You share project leadership with AmpliFlow
For teams that want to combine their own work with project leadership, internal audit, training, and help adapting the setup.
Included
AmpliFlow leads the implementation
For teams that want us to lead the implementation and adapt the system for an efficient way of working.
Included
Not sure which package fits? We recommend a level based on your current position, available time, and internal capacity.
Book a callYou do not need to prepare anything. We start with your scope, risks, and the time your internal lead can set aside. Based on that, we propose Mini, Midi, or Maxi. After the call, you receive a quote with the proposed setup and price.
