What an ISMS needs before you buy tooling
ISO 27001 asks for a defined list of documented information and records. None of it names a product. This page is the list, then the honest question of when software is worth paying for.
An ISO 27001 management system needs eleven documented outputs before it needs any software: a scope statement, an information security policy, a risk assessment method, a risk assessment result, a risk treatment plan, a Statement of Applicability, the operational records the controls produce, competence and awareness records, internal audit records, management review minutes, and a log of nonconformities and corrective actions. Clauses 4 through 10 name all of them. None of the clauses names a vendor, a category of vendor, or a format. A certification body will accept a folder structure and a spreadsheet, and plenty of certified companies use exactly that.
11 Documented outputs the clauses require by name
$0 Minimum defensible year-one tooling cost, CAD
The artifacts the standard actually names
The left column is what you have to hand over, the right is the smallest thing that satisfies it. A certification body audits the content, not the container.
| Artifact | Where it is required | Minimum acceptable form |
|---|---|---|
| Scope statement | Clause 4.3 | One page naming services, systems, locations and legal entities |
| Information security policy | Clause 5.2 | A short approved document signed by the accountable executive |
| Risk assessment method | Clause 6.1.2 | A written method: criteria, scale, who scores, how often |
| Risk assessment results | Clause 6.1.2 | A register with an owner, a level and a decision per risk |
| Risk treatment plan | Clause 6.1.3 | Treatments with owners and dates, traceable to risks |
| Statement of Applicability | Clause 6.1.3 d) | 93 rows, four columns, justifications written as sentences |
| Security objectives | Clause 6.2 | Measurable objectives with a target and a review date |
| Competence and awareness records | Clauses 7.2 and 7.3 | Training completion records with dates and names |
| Operational evidence | Clause 8.1 | Access reviews, supplier reviews, backup and change records |
| Internal audit program records | Clause 9.2 | A plan, the audit report, and the findings raised |
| Management review minutes | Clause 9.3 | Minutes covering the required inputs, with decisions recorded |
| Nonconformity and corrective action log | Clause 10.2 | A log with root cause, action, owner and closure date |
Twelve rows for eleven outputs, because objectives and the policy are often written into the same document and audited separately. The documentation page goes through what each one should contain. The Statement of Applicability is the one worth reading first, because it is where the other artifacts join up.
Documents and records are not the same problem
Most tooling arguments are arguments about the second category, and the two behave differently once an audit window opens.
- Documented information
- Things you write once and then maintain: the scope, the policy, the risk method, the Statement of Applicability. Volume is low, change is slow, and version control plus an approval date is the entire requirement.
- Records
- Things the system produces as it runs: quarterly access reviews, supplier reviews, training completions, incident tickets, backup restore tests. Volume grows every month, and the auditor samples them by date.
- Evidence register
- The index that says which record answers which control, who owns it, how often it must be produced, and when it was last produced. It is not required by name in the standard. It is what stops the fortnight of hunting before stage 2.
Documents are a filing problem and any drive solves it. Records are a recurrence problem, and that is where a company either builds a register or spends the run-up to the audit reconstructing nine months of history. Whether to buy software is almost always a question about the records.
Comparing firms for this? Tell us what you need and it goes to the ones in the directory that do this work. No charge, and no phone number required.
The order to produce them in
Producing these out of order is the most expensive mistake available, and it is easy to make because the Statement of Applicability is the artifact everyone has heard of.
- Write the scope. Everything below is scoped by it, and it goes on the certificate.
- Build the asset, data and supplier inventory. It is not a required artifact, and every required artifact below depends on it.
- Write the risk method, then run the assessment against the inventory.
- Decide treatments, and only then write the Statement of Applicability, so each control decision traces to a risk you can point at.
- Set up the evidence register before the controls start running, naming the record, the owner and the frequency for each one.
- Operate for at least three months and let the records accumulate on their own schedule.
- Run the internal audit, hold the management review, log what came out of both.
The full eleven-phase version with durations is on the implementation page. Step 5 is the only one where tooling changes the outcome, and it is the step most companies leave until the auditor is booked.
Check what you already have
Most companies partway through discover they hold more than they thought and that none of it is indexed. Work down this list before pricing anything.
0 of 0 in place ·
What the tooling options cost in CAD
Three ways companies hold this material. The year-one difference is why the question comes up.
| Approach | Year one (CAD) | What you get | Where it strains |
|---|---|---|---|
| Drive and spreadsheets | $0 | Documents versioned, records filed by hand | No index from control to record, so the run-up to stage 2 is manual |
| Free compliance workspace | $0 | Control set written out, evidence register, risk register, policy templates, readiness scoring, daily checks against the systems it connects to | Seven integrations. Anything else has to be described as a check, and there is no endpoint agent |
| Paid compliance platform | $7,500 to $50,000 | Hundreds of pre-built integrations including endpoint agents and HR systems, continuous monitoring, multi-framework mapping | Priced per year and renews, and it collects nothing your cloud does not emit |
| Difference over three years | $22,500 to $150,000 | Platform subscriptions renew. Budget them as an operating cost, not a project cost. | |
The platform band is wide because it covers a single framework at a small company up to several frameworks with an audit-support tier attached. A Canadian company buying a platform for ISO 27001 alone usually lands in the lower half, around $8,000 to $30,000 CAD a year. The cost breakdown puts that next to the certification body fee and the testing line, which is the comparison that settles the argument.
What a free workspace covers
A free workspace sits in the middle row of that table. TrazTech, which operates this site, runs one. traztech Workspace covers 10 frameworks including ISO 27001, with guided self-assessments, an evidence register mapped to controls, 40 policy templates with approval history, a risk register, vendor risk questionnaires and readiness scoring. It also runs scheduled checks against AWS, Okta, Google Workspace, GitHub, GitLab, Cloudflare and Jira. Those checks run daily and file the result as evidence against the control it proves. Anything else with an API is described as a check rather than picked off a list.
Free means no credit card, no trial period, no paid tier, no seat limit and no export fee. Hiring the firm does not change the price. Your data stays in the workspace when an engagement ends. It is one option among several, and the row above it is still defensible if your record volume is small.
When a paid platform is the right purchase
Vanta and Drata carry hundreds of pre-built integrations, including endpoint agents and HR systems, maintained by teams who do only that. Buy one when that breadth is what your evidence needs: an endpoint fleet you have to show posture for, HR as the system of record for onboarding and training, or a long tail of SaaS tools you do not want to describe check by check. Seven integrations and no endpoint agent is not parity with that, and it is not close. TrazTech will tell a client when a platform is the right purchase and will help set it up.
The question that decides it
Not headcount, and not budget. Ask where your evidence lives. If it sits in a handful of cloud and identity systems, something can check them on a schedule and file the result, and a free workspace does that. If it is spread across an endpoint fleet, an HR system and a long tail of SaaS nobody has written a connector for, the integration count is what you are buying and the paid platforms have hundreds. If it is quarterly access reviews done by a person, supplier reviews done by a person and training records exported once a year, no product collects it and you are paying for a control mapping you could have written down.
Either way, the artifacts come first. A platform bought before the scope is written produces a mapped control set for a scope nobody has agreed to, which is the most common way a company spends money in month one and still fails stage 1. Work through the gap assessment first, and price tooling against what it finds.
Get a view on what you already have
Tell us your scope and where you are, and we will match you with Canadian firms that do ISO 27001 readiness work.
Get matchedCommon questions
Can we get ISO 27001 certified using only spreadsheets?
Yes. ISO 27001 predates the compliance platforms by two decades and certification bodies audit content rather than format. What a spreadsheet does not give you is an index from each control to the record that proves it, so build that index deliberately or the weeks before stage 2 become a search operation.
Is a free compliance workspace enough for a first certification?
For a first certification in a small cloud estate, yes. A workspace that holds the control set, the evidence register, the risk register and the policies covers every artifact this page lists, and scheduled checks against the systems it connects to cover the recurring technical records. What it does not cover is an estate wide enough to need hundreds of integrations, endpoint posture across a fleet, or HR as the source of training evidence. Those are the reasons to buy a platform, and you buy it as well as the artifacts rather than instead of them.
When should we buy Vanta or Drata instead?
When the integration count is what you are buying. Hundreds of pre-built connectors, endpoint agents and HR systems, across an estate too wide to describe check by check. Two or more frameworks running at once with overlapping control sets is the other case. What no longer separates them from a free workspace is automated collection on its own, because a workspace that connects to your cloud and runs the checks daily does that too. Any firm that tells you a workspace matches them on breadth is selling you something.
How many Annex A controls do we have to document?
All 93, in the Statement of Applicability, including the ones you exclude. Exclusions need a written justification. Separately, the 25 clause requirements in clauses 4 through 10 are not optional and cannot be excluded, which is why they are never expressed as a combined number with the Annex A controls.
Does a compliance platform write the Statement of Applicability?
It generates a draft from its own control mapping. The justification column comes out generic, and a stage 1 auditor reads that column first. Treat a generated Statement of Applicability as typing you did not have to do, then rewrite the justifications in your own words against your own risk assessment.