ISO 27001 Toolkit: What a Complete One Contains (2026)

An ISO 27001 toolkit is supposed to hand you the whole documented management system on day one: scope, policies, risk method, Statement of Applicability, registers and the audit records that prove the thing runs. Most packs sold as one do not. They ship the seven headline policies, skip the records clauses 9 and 10 ask for, and leave you drafting the hardest half yourself three weeks before stage 1.

This is the inventory a complete pack contains, measured against what the standard actually requires. ISO/IEC 27001:2022 is still the current edition — edition 3, published October 2022, at stage 60.60 with one amendment — so any pack still indexed to the 2013 clause numbering is selling you a transition that closed on 31 October 2025.

What an ISO 27001 toolkit has to cover

Documentation for an ISMS sits in three layers, and the distinction matters because only one of them is literally compulsory.

• Layer 1 — clause 4 to 10 documents and records. These are named in the requirements text. You cannot exclude any of them and still claim conformity.
• Layer 2 — the Annex A control layer. Ninety-three controls, each one included or excluded with a justification recorded in the Statement of Applicability. The controls are selectable; the SoA that records your selection is not.
• Layer 3 — operating evidence. Registers, logs, review records and test results. Nothing here is a policy, and this is where thin packs run out.

A pack that only does layer 1 and part of layer 2 looks complete on a feature list and collapses at the first audit, because an auditor samples evidence, not intentions. For the wider picture of how the standard fits together, start with our complete guide to ISO 27001.

The mandatory documents inside a complete ISO 27001 toolkit

The requirements clauses call for documented information in roughly a dozen places. Here is each one against the artefact a serious pack should hand you.

Clause	What the standard requires	What the toolkit should give you
4.3	ISMS scope, documented	Scope statement with boundaries, interfaces and recorded exclusions
5.2	Information security policy	Top-level policy with an approval and review block
6.1.2	Risk assessment process	Risk methodology with impact, likelihood and acceptance criteria
6.1.3 d)	Statement of Applicability	All 93 controls, each with applicability, justification and status
6.1.3 e)	Risk treatment plan	Treatment plan mapped to risk IDs, owners and dates
6.2	Information security objectives	Objectives with measures, targets and a review cadence
6.3	Planning of changes	Change planning step inside the ISMS operating procedure
7.2	Evidence of competence	Competence matrix plus a training record log
7.5	Control of documented information	Document control procedure and a master document register
8.1	Confidence that processes ran as planned	Operational records and a measurement schedule
9.1	Monitoring and measurement results	Metrics plan and a populated KPI log
9.2	Audit programme and audit results	Audit programme, clause-by-clause checklist, report template, findings log
9.3	Management review results	Agenda built on the clause 9.3 inputs, plus minutes and actions
10.2	Nonconformity and corrective action records	Corrective action register with root cause and verification fields

Clause 6.3, planning of changes, is the one requirement added in the 2022 edition, and it is the single most common omission in packs built on the old text. If you want the requirement-side view rather than the buyer-side view, our ISO 27001 mandatory documents checklist works through the same list from the standard outwards.

Why 93 controls does not mean 93 documents

Annex A in the 2022 edition carries 93 controls across four themes, down from 114 in 2013 because controls were merged rather than deleted.

Theme	Annex A clause	Controls	Typical toolkit artefacts
Organizational	A.5	37	Policies, supplier and asset registers, legal register, classification scheme
People	A.6	8	Screening procedure, contract clauses, disciplinary process, awareness log
Physical	A.7	14	Physical security policy, visitor and maintenance logs, clear desk rules
Technological	A.8	34	Access control, cryptography, logging, secure development, backup records

The mapping is many-to-many. One access control policy can satisfy four or five controls; one control such as A.8.8 on technical vulnerabilities needs a procedure and a running register. So the document count printed on an ISO 27001 toolkit listing tells you very little about coverage — what tells you something is whether every applicable control traces to a named file. ISO/IEC 27002:2022 is the companion guidance that explains the implementation intent behind each one, and our Annex A controls explainer breaks the four themes down control by control.

The registers a thin ISO 27001 toolkit leaves out

This is the reliable test. Ask for the register list, not the policy list. A complete ISO 27001 toolkit carries the working artefacts an auditor will sample:

• Information asset inventory and risk register
• Statement of Applicability, with all 93 rows present
• Supplier and third-party register, with assurance status per supplier
• Legal, statutory and contractual requirements register
• Interested parties register feeding clauses 4.1 and 4.2
• Access rights review log and privileged account list
• Incident log, with categories and lessons-learned fields
• Exception and risk acceptance register for controls you run differently
• Awareness and training log
• Internal audit findings and corrective action registers
• Continuity test records and management review minutes
• Document master list with version and owner per file

If a pack is all .docx policies and no spreadsheets, it has given you layer 1 and 2 and nothing of layer 3. The Statement of Applicability guide is worth reading before you judge any SoA template, because that one file is where most packs quietly fail.

Seven gaps that make an ISO 27001 toolkit fail an audit

1. An SoA with the wrong control count. 114 rows means 2013. Fewer than 93 means someone deleted rows instead of marking them not applicable, which removes the justification the clause asks for.
2. No climate consideration. Amendment 1:2024 added climate change to the clause 4.1 and 4.2 requirements across the ISO management system standards. It is a short amendment, published free of charge, and auditors do check that context analysis mentions it.
3. Policies with no approval evidence. A policy with an empty version table is not documented information under clause 7.5. It is a draft.
4. Risk method with no acceptance criteria. Clause 6.1.2 asks for criteria explicitly. A scoring matrix with no stated threshold for acceptance does not meet it.
5. Blank workbooks where worked examples belong. An empty risk register teaches nothing about the method. Registers should ship with sample rows you delete.
6. Stale normative references. ISO/IEC 27000, the overview and vocabulary standard the family points at for terms, reached its sixth edition in July 2026. A pack citing the 2018 edition was not reviewed recently.
7. Clause 6.3 missing. Planning of changes is new in 2022 and absent from most pre-2022 document sets.

Toolkit, consultant or platform

An ISO 27001 toolkit solves documentation. It does not solve implementation, and the three options are not really competing for the same job.

	Document toolkit	Consultant	Compliance platform
What you get	Editable documents and registers you own outright	Interpretation, decisions and audit coaching	Hosted workflow, task tracking, evidence collection
Typical cost	Low hundreds, one payment	Four to five figures per engagement	Recurring subscription, per year
Best when	You have someone internal who can own the ISMS	Scope is complex or contested	You need continuous monitoring after certification
Weakness	No one tailors it for you	Knowledge leaves with the consultant	Documents are often locked inside the tool

Most small and mid-size teams buy the documents first and add help where it is actually scarce. For the audit-fee side of the budget, our 2026 certification cost breakdown separates certification body fees from everything else.

How to check an ISO 27001 toolkit before you buy

Seven questions, all answerable from a product page or a sample:

• Does the SoA carry all 93 controls as rows?
• Is the clause map 2022, including 6.3?
• Are the files editable Office formats, not locked PDFs?
• Does the licence allow internal use across your whole organization?
• Are there registers and records, or only policies?
• Do workbooks ship with worked examples?
• Is there a document register so you can see the inventory before you pay?

Our own ISO 27001 Toolkit is built to answer all seven: 165 templates in Microsoft Office format, a 93-row Statement of Applicability, the clause 4 to 10 record set and the registers above, for $99 as a one-time purchase. If you would rather test the format first, five sample documents are available through our free ISO 27001 templates.

Frequently asked questions

Is an ISO 27001 toolkit enough to get certified?

No. Documents are necessary and not sufficient. A certification body audits whether the system operates, so you still have to run the risk assessment, hold a management review, complete an internal audit and generate real records. What a toolkit removes is the drafting, which is typically the longest single block of work in a first-time implementation.

How many documents should an ISO 27001 toolkit contain?

There is no required number. Around 14 documents and records are named in clauses 4 to 10, and commercial packs run from roughly 40 to over 160 files depending on how finely they split policies and how many registers they include. Judge coverage by tracing applicable controls to files, not by the headline count.

Can I use a free ISO 27001 toolkit?

Free sets are useful for seeing house style and structure, and they are usually partial by design — typically policies without the registers, or a sample SoA with a handful of rows. They are a reasonable way to test fit before buying, but a free pack that claims full clause and Annex A coverage is worth checking line by line against the table above.

Does a toolkit still need to handle the 2022 transition?

Not any more. The transition window from ISO 27001:2013 closed on 31 October 2025, and certificates against the 2013 edition are no longer valid. In 2026, the only question is whether a pack is natively 2022 — 93 controls, four themes, clause 6.3 present — not whether it offers a migration path.

Will an auditor reject template documents?

Not for being templates. Auditors reject documents that do not describe what the organization actually does. The failure mode is leaving placeholder text, example company names or unedited sample rows in a live document, which reads as evidence that nobody reviewed it. Tailoring is the work the toolkit does not do for you.

The short version

A complete ISO 27001 toolkit covers all three layers: every document and record named in clauses 4 to 10, a 93-row Statement of Applicability with justifications, and the registers and logs an auditor samples. Check the register list and the clause map before the document count — those two tell you in five minutes what a feature list will not.