ISO 27001: 2022 Complete Toolkit

Template packs sell you documents. The documents here are only the first third of the package. The rest is the part that actually gets you through an audit: a twelve-week roadmap where every task names the file to open and the record it produces, the questions auditors ask with model answers and the trap in each one, an evidence index telling you exactly what to put on screen for every requirement, a map of what your existing tooling already proves so you stop rebuilding records you own, an internal audit pack with the full checklist, and a mock audit script to rehearse the interviews. Plus 19 diagrams so you can see how the whole system connects rather than inferring it from 80 loose files.

It covers every piece of documented information ISO 27001:2022 requires across clauses 4 to 10, including clause 6.3 planning of changes that many older kits still omit, plus the policies auditors ask about and every record template you need to show the ISMS operating. The Implementation Roadmap sequences it, the readiness checklists confirm it, and the Mock Audit Script rehearses the part most people are unprepared for. Certification bodies also expect roughly three months of live records before Stage 2, so the roadmap starts the records in week one rather than week ten.

Because the policies are lean and the guidance is generous, which is the opposite of how template packs are built. The standard explicitly allows combining, so the eleven policy topics sit in one Policy Set beneath the Information Security Policy that clause 5.2 asks for, rather than scattered across separate documents an auditor has to reconcile - and if you prefer them apart, the separate edition ships those same eleven as standalone files. The file count then goes up again because of what document packs typically leave out: the roadmap, the auditor Q&A, the evidence index, the tooling map, the audit preparation pack and the diagrams. Fewer policies, far more help.

Yes, and the Tooling Map has a section on exactly this. Those platforms monitor technical controls continuously and collect evidence well. What they cannot do is decide your scope, judge which risks matter to your business, write justifications that reflect your reality, hold your management review or own a control - and those are precisely what a Stage 1 auditor tests. Use this as the governance layer the platform does not provide, and point the Statement of Applicability at the platform wherever it holds the record.

A ZIP with seven numbered folders. Documents are editable Word files, registers are Excel, and the diagrams are print-quality PNGs plus an A3 poster as both PDF and editable Word. Every place needing your details is marked with a placeholder like [COMPANY NAME] and listed in a find-and-replace table in the README, which takes about an hour to work through for the whole package.

Same content, same price, your choice at checkout. The all-in-one edition binds the eleven policy topics into a single Policy Set - fewer documents to version and control. The separate edition ships each policy as its own document, which is easier when different owners review different policies, or when a customer or auditor asks for one specific policy. Everything else in the package is identical.

The moment your payment clears, a download link is emailed to you. Each link is single use: it downloads the ZIP once, which is how we keep a single-company licence meaningful. Save the file somewhere safe. If a download fails or gets interrupted, you can request one replacement link from the shop and it is emailed to the same address; after that, email hello@featheron.com with your order reference and we will issue another. Links always serve the latest version.

Yes. One payment and the files are yours permanently - once downloaded they are on your machine, and the licence covers internal use by one company: edit them, adapt them, show them to your auditors, and use the diagrams in your own board packs and inductions. Updates are included, so a link issued later always serves the current version. Resale and redistribution are not permitted.

Book the free 15-minute intro call. The Certification Pass Programme covers implementation support, a pre-assessment before your certification body arrives, and accompaniment through the audit itself. We scope it on that call and issue a written proposal; once the proposal is agreed it is guaranteed to pass the standard named in it, and if you do not pass we refund the certification body's fee for those assessment days, so the audit itself does not cost you. It is quoted rather than listed because it depends on your organisation's size and the number of audit days your certification body allocates, and the full wording is on the Terms page. There is also a £150 advisory hour for a single blocker, and a £1,000 Accreditation Readiness Review for a full independent gap assessment.