Context and scope
Define the ISMS scope, the interested parties and the requirements that apply to the organization.
ISO/IEC 27001:2022
Manage every ISO 27001 control in one platform.
Audexa organizes your ISMS in a single workspace: clauses and Annex A assessed control by control, a Statement of Applicability, approved policies, evidence with expiry dates and an action plan to get you to the certification audit.
- 25 clauses + 93 Annex A controls
- Statement of Applicability
- 43 policy templates
118 assessable requirements: 25 from the clauses and 93 from Annex A
43 policy templates linked to ISO 27001
6 frameworks connected through mappings: NIS2, ENS, GDPR, NIST, ISO 9001 and ISO 14001
1 free ISO 27001 audit to try the platform
What the standard requires
ISO 27001 certification means proving a system, not filling in a checklist.
The 2022 edition reorganized Annex A into 93 controls and four themes. The transition from the 2013 edition ended on October 31, 2025, so valid certificates must now be on the 2022 edition.
Leadership and policy
Top management approves the information security policy, assigns roles and provides resources.
Risk assessment and treatment
A repeatable risk method and a treatment plan consistent with the selected controls.
Statement of Applicability
Which Annex A controls apply, which don't and why, with their implementation status.
Operational evidence
Records, procedures and proof that controls work, not just that they exist.
Continual improvement
Internal audit, management review and corrective actions to close the loop.
How Audexa helps
Your ISMS in one place, ready for the audit.
Assess, decide applicability, carry out remediation and keep the evidence without relying on shared folders.
Assess
Know the status of every clause and control.
Guided audit
Clauses 4 to 10 and Annex A grouped by theme, with guidance, weighting and remediation steps.
Re-audit and comparison
Repeat the audit with the same scope and compare progress between cycles.
Reuse across frameworks
Answers with high coverage are suggested as reviewable drafts in NIS2, ENS or GDPR.
Manage
Decisions and work with full traceability.
Statement of Applicability
Mark controls as applicable, not applicable or out of scope with a justification, and export them.
Risks and treatment
Likelihood and impact matrix, treatment and risk acceptance signed by management.
Asset inventory
Devices, software, SaaS and suppliers with an owner and periodic review.
Prove
Organized evidence for auditors.
ISMS policies
43 templates linked to ISO 27001 with versions, approval and signature.
Evidence vault
Documents with an owner, review, expiry and history, linked to each control.
Audit pack
A ZIP with an index, a summary and only approved evidence to share with the auditor.
Some features depend on your plan and active modules.
Statement of Applicability
Your SoA, always consistent with the audit.
Before answering, decide which controls apply. Every exclusion keeps its justification, and the statement is exported with the organization's context and the applicability of each control.
- Applicable, not applicable or out of scope, with a reason
- Organization context saved with each audit
- Exclusions visible in results and exports
- No score penalty for controls that don't apply
Evidence
One piece of evidence, many controls, no duplicates.
Upload a document once and link it to controls, tasks, policies or risks. Audexa tracks its expiry and review so you never present out-of-date proof.
- PDF, Office files and images with preview
- Owner, reviewer, review and expiry dates
- Approved policy turned into immutable evidence
- Exportable pack with approved evidence
How it works
Three steps toward ISO 27001 certification.
Run your free audit
Assess the clauses and Annex A and get your score, your gaps and an executive report.
Close the gaps
Turn gaps into tasks, approve policies and link evidence to each control.
Arrive prepared
Re-audit, compare progress and share the evidence pack with your auditor.
Before and after
An ISMS in folders vs. an ISMS in Audexa.
AreaWithout a platformWith Audexa
Statement of Applicability
Excel disconnected from reality
Generated from the audit itself
Evidence
Folders with questionable versions
Vault with expiry, review and history
Policies
Word files without version control
Templates with approval and signature
Follow-up
Gaps in a static report
Tasks with owners and re-audits
Other frameworks
Starting from scratch for NIS2 or ENS
Reusable, reviewable answers
Frequently asked questions
What people usually ask us about ISO 27001.
Can I try Audexa with ISO 27001 for free?
Yes. The Free plan includes a complete ISO 27001 audit, an executive report in PDF and the tasks derived from the audit. You can sign up at app.audexa.es or ask us for a guided demo.
Does Audexa certify us for ISO 27001?
No. Certification is issued by an accredited certification body. Audexa helps you implement and maintain your ISMS and prepare the evidence and reports for the audit.
Is it up to date with ISO/IEC 27001:2022?
Yes. The audit follows the 2022 edition: clauses 4 to 10 and the 93 Annex A controls grouped into organizational, people, physical and technological controls.
Does it generate the Statement of Applicability?
Yes. You set the applicability of each control with its justification and export it together with the organization's context and the framework version.
Does it help if we also need to comply with NIS2 or ENS?
Yes. Audexa includes mappings from ISO 27001 to NIS2, ENS, GDPR, NIST CSF 2.0, ISO 9001 and ISO 14001 so you can reuse evidence and reviewable answers.
Where is the data hosted?
Audexa runs on EU infrastructure, with role-based access, two-factor authentication and activity traceability.
Request a demo
We'll show you the path to ISO 27001 certification.
In a 30-minute demo we walk through the audit, the Statement of Applicability, policies and the evidence pack.
- We review your ISMS starting point.
- We show you how controls, policies and evidence fit together.
- We set up your free audit so you can continue on your own.