How it works
How a first ISO 27001 audit goes with GapLedger.
Seven steps, in the order the standard expects them: scope, risk assessment, Statement of Applicability, evidence, internal audit, management review, and the audit pack you hand your certification auditor. For each step, what you do and what GapLedger records.
GapLedger is software, not a certification body or a consultancy. It keeps the records an auditor asks for. Your certification body decides the outcome, and how long the work takes depends on your organization.
- Step 1
Define the scope
Clause 4.3What you do
Decide what the ISMS covers: the whole organization, or a site, subsidiary or product line. The certification auditor audits against this boundary, so write it down plainly.
What GapLedger records
- ✓ Each scope has a name, a kind (site, subsidiary, product line) and a description of what it covers.
- ✓ Pick the frameworks that apply to the scope. ISO 27001 brings all 93 Annex A controls plus the 18 clause 4-10 requirements, each with plain-English guidance.
- ✓ Run one organization-wide ISMS, or several scopes side by side with their own readiness figures.
- Step 2
Assess and treat risk
Clauses 6.1.2 and 6.1.3What you do
List the information security risks to what is in scope, score them, and decide how to treat each one. Most first-time teams find this the hardest step, because it is the one that decides everything after it.
What GapLedger records
- ✓ A risk register with a 5 x 5 likelihood and impact score, a treatment (mitigate, accept, transfer or avoid), a treatment plan, an owner and a due date.
- ✓ Optional ISO 27005 detail per risk: the asset, the threat and the vulnerability.
- ✓ Each risk links to the controls that treat it, so the link from risk to control is recorded rather than implied.
- Step 3
Write the Statement of Applicability
Clause 6.1.3 dWhat you do
For every Annex A control, state whether it applies and why, and whether it is implemented. Exclusions need a justification an auditor will accept.
What GapLedger records
- ✓ Mark each control applicable or not applicable, set its status (not started, in progress, implemented) and write the justification.
- ✓ Applicable controls that treat no recorded risk, and controls with no documented justification, are flagged so you can fix them before the auditor finds them.
- ✓ Download the SoA as a PDF at any time. It is built from the decisions you recorded, not a template you keep in sync by hand. If you already have one in a spreadsheet, you can import it.
Sample: fictional company, sample data. Download the sample Statement of Applicability (PDF). It is rendered by the same code as the in-app download.
- Step 4
Implement controls and collect evidence
Clause 8 and Annex AWhat you do
Put the applicable controls into practice and keep proof that they operate: policies, records, screenshots, review sign-offs.
What GapLedger records
- ✓ Attach evidence files to the controls they support. Files are stored write-once and content-hashed (SHA-256), so you can show an auditor they have not been altered.
- ✓ Recurring work (access reviews, risk reviews, drills) becomes tasks with due dates, and reminders arrive before they lapse.
- ✓ Each scope has an evidence pack PDF: readiness and the evidence behind each control at that moment.
- Step 5
Run an internal audit
Clause 9.2What you do
Before the certification audit, check the ISMS yourself against clauses 4-10 and your applicable controls, using someone objective and impartial about the area being audited.
What GapLedger records
- ✓ Plan each audit with a title, the framework, the planned date, the scope, the auditor and the auditor's qualifications, then track it from planned to completed with a summary.
- ✓ Log findings as conformity, nonconformity, observation or opportunity for improvement.
- ✓ Turn a nonconformity or observation into a tracked nonconformity in one step, with corrective actions, owners, due dates and an effectiveness note (clause 10.2).
- Step 6
Hold the management review
Clause 9.3What you do
Top management reviews whether the ISMS is working and decides what to change. Record who attended, what was reviewed, what was decided and the actions.
What GapLedger records
- ✓ The review form starts with a live snapshot of inputs: open nonconformities, corrective actions in progress, open and high or critical risks, and the last completed internal audit.
- ✓ Record the date, attendees, inputs, decisions and actions, and set the next review date so a reminder comes round.
- Step 7
Hand the auditor the audit pack
Stage 1 and Stage 2What you do
Your certification body runs the audit and makes the certification decision. Your job is to show them a system that exists and operates.
What GapLedger records
- ✓ One PDF with scope readiness, the risk register and the controls each risk is linked to, nonconformities and corrective actions, internal audits, management reviews and an evidence summary.
- ✓ Alongside it: the SoA PDF and the per-scope evidence pack.
- ✓ Invite the auditor as a read-only guest with an expiry date. You can see each page they view and each file they download.
See the artifacts before you start
The sample Statement of Applicability is a fictional company with sample data, not a customer. The live demo is a read-only workspace for a fictional company a few months into ISO 27001: open the risk register, the SoA, internal audits, management reviews and the audit pack without an account. More on the SoA itself on the Statement of Applicability page, and on the product as a whole on the ISO 27001 software page.
Start your 7-day trial
Card required; cancel before day 7 and you won't be charged. $500/mo after trial, or $5,400/yr and save 10%. If you cancel, your workspace stays read-only with export for 30 days after cancellation.