Support
ENSV

ISO 27001 even without an IT background

Information security involves the whole organisation. AmpliFlow's familiar folders and checklists help colleagues with different computer skills find instructions, follow procedures and report issues that need attention. This makes it easier to involve people in the work, even without an IT background. Handle implementation yourselves or choose consulting help.

Book a callHow certification works

Your information security management system is your practices, responsibilities and follow-up. AmpliFlow is the software you use to support it.

ISO 27001

How to get your ISO 27001 certificate

Management, staff and suppliers all have a part in information security. Start with what you need to protect and who does what.

  1. 01

    Set up AmpliFlow

    Define which information and parts of your business to include. Start with customer requirements and your reliance on suppliers. Set up AmpliFlow yourselves or with agreed implementation support.

  2. 02

    Work in the software

    Assess what could happen if information is disclosed, changed incorrectly or unavailable. Management prioritises resources and responsibilities. Your team or IT partner implements and tests the safeguards, and you record decisions in AmpliFlow.

  3. 03

    Internal audit

    Audit whether people follow your procedures and whether safeguards work. Management review considers the results and any changes needed. Address gaps before the external audit.

  4. 04

    External audit

    An independent certification body audits your information security management system. The external audit costs extra.

  5. 05

    Certificate

    After a successful external audit and the certification body's decision, you receive your ISO 27001 certificate. Keep reviewing risks and safeguards afterwards.

Do you need human expert help?

Use the software to build your management system yourselves, or get help with setup and implementation. We agree the scope of that help before you decide.

  • Software only

    your team sets up and leads the work.

  • Implementation support

    Mini includes Swedish-speaking software support and introductory training. Midi provides project leadership, and with Maxi we build the management system with you. Midi and Maxi include migration of files at no extra migration charge.

Your team still coordinates its part of the work, and management makes the business decisions.

AI help and human expertise

Optional AI help lets you write and edit drafts that you review yourselves. Our human experts can help with assessments, priorities and questions where you need experience.

See what the optional AI can help with

Compare pricing and our Mini/Midi/Maxi support levels.

See prices and support

See controls and SoA in AmpliFlow

Open a control, set whether it applies and explain why you selected it. Link risks, assign owners and distribute tasks. Attach supporting records and set the implementation status.

Export your Statement of Applicability, or SoA, as a PDF for review. You can also add custom controls. Status and files help you follow up, but do not prove on their own that safeguards work.

Optional AI assistance can help you draft text. You review and adapt it.

Annex A contains

93

controls to compare your choices with, not a list everyone must implement.

Follow through on promises to customers

A customer question may need both an agreed procedure and evidence from your IT supplier. Keep documents, follow up incidents and assign actions in AmpliFlow so you can show what you have actually done.

See all tools →

Read more about ISO 27001

An introduction for management and help understanding control choices.

ISO 27001

ISO 27001 for management

An introduction to responsibilities and implementation.

Read article →Annex A

Select controls based on risk

Why you do not automatically need to implement every Annex A control.

Read article →

Questions before ISO 27001 certification

Can we get certified without an in-house IT team?
Yes, but you need access to the expertise your risks require. Management remains responsible for direction and resources when a supplier handles IT. Appoint an internal coordinator, agree safeguards, incident handling and follow-up with your IT partner, and involve the people who handle information. AmpliFlow does not replace these safeguards.
What is a SoA, and must we implement all 93 controls?
The Statement of Applicability, or SoA, records the controls you need, why they are included and whether they have been implemented. Compare your choices with Annex A so no necessary control is missed. Justify exclusions in your SoA. All 93 controls do not automatically apply, and custom controls may be needed.
What is included with implementation help?
The scope and price of consulting are agreed in a quote, separate from the software licence. Mini provides template setup and introductory training. Midi and Maxi include setup, an introduction and migration of agreed files at no extra migration charge. Software only does not include an introduction, consulting or free migration. You coordinate your part of the work in either case.
Can we use AmpliFlow without certification or for more standards?
Yes. Use the software for risks, documents and follow-up without seeking certification. With several ISO standards, you can share common practices and documents, but need to address each standard's own requirements.
Do we need to buy the ISO 27001 standard itself?

We recommend having access to the standard, either by purchasing it or through a subscription. This lets you read the original requirements, look up questions and make your own assessments.

If you would like support, our experts can help you understand the requirements and apply them in your organisation.

Find your national standards body

Does the certificate mean we meet every legal requirement?
No. ISO 27001 certification audits your information security management system. It does not confirm that every legal requirement is met or that incidents cannot occur. You need to assess and meet the legal and contractual requirements that apply to your organisation.

We'd love to talk to you about ISO!

Has a customer asked for certification, or do you want better control of information security? You will speak with a person about customer requirements, your business and your IT partner's role. We show you the software and discuss where you want help. The first call is no-obligation. Bring your questions, even if the standard is new to you.