21RISK is ISO 27001 software for security and compliance teams, at one company or across a group with many sites. Adopt clauses 4 to 10 and all 93 Annex A controls as a ready-made requirement list, map what you actually do to them once, and see which requirements still have no control.
ISO 27001 sits next to your other frameworks in Frameworks and Controls. The standard calls the 93 Annex A items controls. In 21RISK they are requirements, and a control is what you do to meet one. Open a clause or a theme to see what covers each requirement, which have no control yet and which you have marked not applicable.
ISO 27001 asks for a management system that is kept up all year. Most of the effort goes into keeping requirements, controls, policies and evidence connected to each other.
One row per Annex A control, a column for what covers it and a column for why it is left out. It is correct on the day of the audit and drifts from then on.
The quarterly access review was done, but the export sits in someone’s inbox. Each audit starts with a search for files that should already be in one place.
Access reviews, incident response and supplier checks appear in all three. Written up separately for each, the descriptions stop matching.
Start from the requirements, describe what you actually do once, and follow up what the audits find.
Add ISO/IEC 27001:2022 in Frameworks and Controls: 119 requirements, covering clauses 4 to 10 and the 93 Annex A controls, as reference codes and short titles. Everything in your copy stays editable.
45 suggested controls come already mapped. Edit them to match what you do, write your own for the requirements that have none, and mark what does not apply, with the reason.
Give each control an owner and link the policy behind it. A nonconformity from the internal audit lands on a findings board, linked to the control it affects, and stays open until the fix is done.
An auditor asks two things about most controls: where is the evidence for the period, and which approved policy stands behind it?
Set an evidence task, such as the quarterly access review, to come back each calendar quarter. With a Files attached rule it cannot be completed until a file from that quarter is attached, and each period keeps its own files.
Valid until the end of each period of 3 months. Periods start on 1 January.
Upload the policy, link the controls it covers and approve it. 21RISK records who approved it and on which day, keeps every version it replaces and moves it to Needs review when the year is up.
Evidence is a file on a finding, kept period by period. Approvals, versions and review dates are covered in policy management.
Clauses 4 to 10 and the four Annex A themes, 119 requirements with their reference codes. Paste your licensed text into your copy.
NOT APPLICABLEMark an Annex A requirement, or a whole section, as not applicable and give the reason. It stays on record and leaves the coverage count.
CONTROLSWrite a control once, with its code, owner and description, and map it to ISO 27001, NIS2 and SOC 2. Change it in one place.
POLICIESThe document, its owner and the controls it covers. Who approved it and when is recorded, and a review comes due every year.
FINDINGSLink each finding to the control it affects. Owners, due dates, statuses and history show who fixed what.
AIConnect Claude or another assistant through the MCP server. It reads your requirements and controls and can draft the ones that are missing.
Frameworks and Controls is a board, so User Access decides who sees it and who edits it, by user or by group.
Most of what NIS2 and SOC 2 ask for is already in an ISO 27001 control set. When you adopt a second framework, the suggested controls you already have are linked to its requirements instead of being created again.
An empty place is a control that does not carry over. NIS2 also adds 12 controls of its own, such as registration with the authority and the incident notification procedure.
38 of the 50 controls suggested for NIS2 are also mapped to ISO 27001. The rest cover what the directive adds, such as registration and incident notification.
SOC 238 of the 45 controls suggested for ISO 27001 are also mapped to SOC 2 criteria. Adopt the template and they are linked.
COMPLIANCEHow frameworks, controls, policies and findings fit together in 21RISK.
21RISK has held a SOC 2 Type 2 report since 2024, and runs its own compliance programme in 21RISK.
No. Certification is done by an accredited certification body, after its own audit. 21RISK keeps the requirements, controls, policies and findings in one place, with their history, which is what the auditor asks to see.
No. Coverage shows that each applicable requirement has a control mapped to it. 21RISK does not test or score whether a control works. Your internal audits and the certification audit show that, and the findings linked to a control are where it shows up.
No. ISO standards are copyrighted, so the template has the reference codes and short titles in our own words: clauses 4 to 10 and the 93 Annex A controls, 119 requirements in all. You need your own licensed copy of the standard, and you can paste its text into your copy of the framework.
Not as a finished document: there is no Statement of Applicability export. 21RISK keeps the record behind it. Every Annex A requirement shows the controls mapped to it, or the reason it is not applicable. An excluded requirement stays on record with its reason and leaves the coverage count.
No. It does not connect to your cloud accounts, scan systems or collect logs. Evidence is a file that someone attaches to a finding. A finding can come back every month, quarter or year, and a Files attached rule can require a new file in each period before it can be completed.
No. A control is written once and mapped to requirements in any number of frameworks. Of the 45 controls suggested for ISO 27001, 38 are also mapped to NIS2 and 38 to SOC 2. When you adopt the second framework, the suggested controls you already have are linked to its requirements instead of being created again. What it asks for beyond them shows as requirements with no control yet.
In a findings board’s settings, pick ISO 27001 as a framework the board works with. Each nonconformity, incident follow-up or evidence task can then be linked to the controls it affects. The Controls column shows and filters them, and every link is in the finding’s history, next to its owner, due date, status and files.
Yes. Every framework, control and policy operation is available through the REST API and the MCP server. An assistant such as Claude can answer which ISO 27001 requirements have no control, or draft controls for them. Changes made through the AI chat inside 21RISK wait for your approval.
It is not a certification body and not a security tool. It does not scan systems, collect logs or pull evidence from cloud accounts. It has no risk-scoring engine, no Statement of Applicability export and no step where employees read and sign a policy. 21RISK covers the management side: requirements, controls, policies, approvals, evidence files and the follow-up on findings.
Requirements, controls, policies and evidence, on the same platform as your sites, audits and insurance.