Compliance Colleague · Standards · Global

ISO/IEC 27001:2022: cited answers and gap reviews

An AI compliance assistant for ISMS owners, lead auditors and consultants · updated 2026-10-03

ISO/IEC 27001 is the international standard for an information security management system (ISMS). Compliance Colleague explains what clauses 4 to 10 require, works through the 93 Annex A controls, and reviews your Statement of Applicability, risk register and policies against the standard, with the clause cited each time.

Try it on your own ISO 27001 work: one document review or two questions, free for 30 days, no card required. Start free →

What it covers

Clauses 4 to 10 and the 93 Annex A controls of ISO/IEC 27001:2022
Statement of Applicability, risk assessment, risk treatment and residual risk acceptance
ISMS scope, including cloud and outsourcing boundaries
Certification audits: stage 1, stage 2, surveillance and recertification
The 2013 to 2022 transition and Amendment 1:2024 (climate change)

Questions you can ask

“Do we have to include every Annex A control in the Statement of Applicability, and how do we justify exclusions?”
“What evidence will a stage 2 auditor expect for control 5.23 (cloud services)?”
“How should risk owners accept residual risk under clause 6.1.3?”

Every answer cites the ISO 27001 requirement, article or control it rests on, so you can check it in seconds.

What you can upload for review

Your Statement of Applicability (Excel) checked for missing justifications and controls
A risk register (Excel or CSV) checked row by row against clause 6.1
An access control or supplier security policy checked against Annex A

Files: PDF, Word, Excel or CSV, Visio (.vsdx), draw.io, or an image such as a screenshot. Choose a full review, a prioritized fix list (each gap with its fix and the evidence an assessor will expect) or a short summary, and download the result as Word or PDF.

Crosswalk ISO 27001 to other standards

With ISO 27001 in your plan you can compare it against any standard in the library and see where they align and exactly where they don’t. Common pairings:

Example answers

How many Annex A controls are in ISO 27001:2022, and how are they grouped?

What it’s built from

Compliance Colleague works from our own clause-referenced material, checked against: ISO/IEC 27001:2022 catalogue page (Information security management systems: Requirements) (ISO / IEC); ISO/IEC 27001:2022/Amd 1:2024 catalogue page (Climate action changes) (ISO / IEC); NQA ISO 27001:2013 to 2022 control mapping (NQA (certification body)). It cites the clause so you can check it against your own copy.

Re-checked every month for new versions, deadlines and penalty changes. Full list on the sources page.

More Global standards

PCI DSS · ISO 27701 · ISO 42001 · SOC 2 · SWIFT CSP · WCAG

Compliance Colleague covers 30+ security, privacy and AI governance standards. It reviews policies, spreadsheets and diagrams and answers questions with the clause cited; your judgment and sign-off stay with you. Try it free, no card required →

Research aid, not legal or audit advice, and not an audit opinion or certification. Verify findings against the official text before relying on them.