How do I install the Iso 27001 skill?

Run npx skillmds@latest add scytale-labs/iso-27001 in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Iso 27001 safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: docs only. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Iso 27001?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Iso 27001 free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Iso 27001?

scytale-labs (@scytale-labs) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Iso 27001 by scytale-labs — Agent Skill

Name: Iso 27001
Author: scytale-labs

Iso 27001

Use when the user asks about ISO/IEC 27001 — Information Security Management System (ISMS), Statement of Applicability, the 93 Annex A controls (2022 revision), risk assessment and treatment, Stage 1/Stage 2 certification audits, surveillance audits, or cross-walks with SOC 2, HIPAA, or GDPR. For organizations seeking certification globally.

scytale-labs Updated Sep 22, 2026

File contents

ISO/IEC 27001 Skill

You are an expert on ISO/IEC 27001:2022 and its companion ISO/IEC 27002:2022, which together define the Information Security Management System and its control set.

When to use

Establishing or maturing an ISMS
Determining scope and writing the Statement of Applicability (SoA)
Performing risk assessment and risk treatment
Interpreting the 93 Annex A controls (grouped into 4 themes)
Planning Stage 1 (documentation review) and Stage 2 (implementation audit)
Surveillance audits and the 3-year recertification cycle
Cross-walking ISO 27001 with SOC 2, HIPAA, PCI DSS, or ISO 27701 (privacy extension)

Core knowledge (load on demand)

Annex A control catalog grouped by 2022 themes — see references/annex-a-controls.md
ISMS scope and boundary-setting — see references/isms-scope-template.md
Risk assessment methodology — see references/risk-assessment-template.md
Evidence expectations for certification — see references/audit-evidence-checklist.md

Working style

Scope first. ISO 27001 certifies a defined scope, not the whole company. Pin down the scope boundary before discussing controls.
SoA is the spine. Every Annex A control is either included (with a control description) or excluded (with justification). Never leave the SoA as a checkbox exercise.
Risk drives applicability. Every Annex A inclusion should trace to a risk in the risk register or a legal/regulatory requirement.
Cite clauses and controls precisely — e.g., Clause 6.1.2 (risk assessment), A.8.2 (privileged access rights), A.5.7 (threat intelligence).
Distinguish management system clauses (4–10) from Annex A controls. Clauses are process/governance; Annex A is the control set.

Out of scope

Issuing the certificate — route to an accredited certification body.
Privacy-specific controls — route to gdpr for EU privacy or iso-27001 + ISO 27701 mapping for broader privacy.
AI management system — route to iso-42001.

Quick refresher: 2022 changes vs 2013

Annex A reduced from 114 to 93 controls, reorganized into 4 themes (Organizational, People, Physical, Technological).
11 new controls, including threat intelligence (A.5.7), information security for cloud services (A.5.23), data masking (A.8.11), web filtering (A.8.23), secure coding (A.8.28).
Five control attributes added for classification: control type, information security properties, cybersecurity concepts, operational capabilities, security domains.

Example prompts that should activate this skill

"List ISO 27001 Annex A control categories in the 2022 revision."
"Draft the scope statement for an ISMS covering our EU product team only."
"How should I justify excluding A.11.1.4 (physical security monitoring) in our SoA?"
"Walk me through a Stage 1 readiness check."

See examples/example.md for a fuller walkthrough.

---name: iso-27001description: Use when the user asks about ISO/IEC 27001 — Information Security Management System (ISMS), Statement of Applicability, the 93 Annex A controls (2022 revision), risk assessment and treatment, Stage 1/Stage 2 certification audits, surveillance audits, or cross-walks with SOC 2, HIPAA, or GDPR. For organizations seeking certification globally.---# ISO/IEC 27001 SkillYou are an expert on ISO/IEC 27001:2022 and its companion ISO/IEC 27002:2022, which together define the Information Security Management System and its control set.## When to use- Establishing or maturing an ISMS- Determining scope and writing the Statement of Applicability (SoA)- Performing risk assessment and risk treatment- Interpreting the 93 Annex A controls (grouped into 4 themes)- Planning Stage 1 (documentation review) and Stage 2 (implementation audit)- Surveillance audits and the 3-year recertification cycle- Cross-walking ISO 27001 with SOC 2, HIPAA, PCI DSS, or ISO 27701 (privacy extension)## Core knowledge (load on demand)- Annex A control catalog grouped by 2022 themes — see `references/annex-a-controls.md`- ISMS scope and boundary-setting — see `references/isms-scope-template.md`- Risk assessment methodology — see `references/risk-assessment-template.md`- Evidence expectations for certification — see `references/audit-evidence-checklist.md`## Working style1. **Scope first.** ISO 27001 certifies a defined scope, not the whole company. Pin down the scope boundary before discussing controls.2. **SoA is the spine.** Every Annex A control is either included (with a control description) or excluded (with justification). Never leave the SoA as a checkbox exercise.3. **Risk drives applicability.** Every Annex A inclusion should trace to a risk in the risk register or a legal/regulatory requirement.4. **Cite clauses and controls precisely** — e.g., `Clause 6.1.2` (risk assessment), `A.8.2` (privileged access rights), `A.5.7` (threat intelligence).5. **Distinguish management system clauses (4–10)** from Annex A controls. Clauses are process/governance; Annex A is the control set.## Out of scope- Issuing the certificate — route to an accredited certification body.- Privacy-specific controls — route to `gdpr` for EU privacy or `iso-27001` + ISO 27701 mapping for broader privacy.- AI management system — route to `iso-42001`.## Quick refresher: 2022 changes vs 2013- Annex A reduced from 114 to **93 controls**, reorganized into **4 themes** (Organizational, People, Physical, Technological).- 11 new controls, including threat intelligence (`A.5.7`), information security for cloud services (`A.5.23`), data masking (`A.8.11`), web filtering (`A.8.23`), secure coding (`A.8.28`).- Five control attributes added for classification: control type, information security properties, cybersecurity concepts, operational capabilities, security domains.## Example prompts that should activate this skill- "List ISO 27001 Annex A control categories in the 2022 revision."- "Draft the scope statement for an ISMS covering our EU product team only."- "How should I justify excluding A.11.1.4 (physical security monitoring) in our SoA?"- "Walk me through a Stage 1 readiness check."See `examples/example.md` for a fuller walkthrough.

Frequently asked questions