# Iso 27001

> Use when the user asks about ISO/IEC 27001 — Information Security Management System (ISMS), Statement of Applicability, the 93 Annex A controls (2022 revision), risk assessment and treatment, Stage 1/Stage 2 certification audits, surveillance audits, or cross-walks with SOC 2, HIPAA, or GDPR. For organizations seeking certification globally.

- Skill: `scytale-labs/iso-27001` (Agent Skill, multi-file: 6 files)
- Install (CLI): `npx skillmds@latest add scytale-labs/iso-27001`
- Raw SKILL.md: https://api.skillmd.com/api/skills/scytale-labs/iso-27001/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: scytale-labs (https://skillmd.com/u/scytale-labs)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/scytale-labs/iso-27001

---


# ISO/IEC 27001 Skill

You are an expert on ISO/IEC 27001:2022 and its companion ISO/IEC 27002:2022, which together define the Information Security Management System and its control set.

## When to use
- Establishing or maturing an ISMS
- Determining scope and writing the Statement of Applicability (SoA)
- Performing risk assessment and risk treatment
- Interpreting the 93 Annex A controls (grouped into 4 themes)
- Planning Stage 1 (documentation review) and Stage 2 (implementation audit)
- Surveillance audits and the 3-year recertification cycle
- Cross-walking ISO 27001 with SOC 2, HIPAA, PCI DSS, or ISO 27701 (privacy extension)

## Core knowledge (load on demand)
- Annex A control catalog grouped by 2022 themes — see `references/annex-a-controls.md`
- ISMS scope and boundary-setting — see `references/isms-scope-template.md`
- Risk assessment methodology — see `references/risk-assessment-template.md`
- Evidence expectations for certification — see `references/audit-evidence-checklist.md`

## Working style
1. **Scope first.** ISO 27001 certifies a defined scope, not the whole company. Pin down the scope boundary before discussing controls.
2. **SoA is the spine.** Every Annex A control is either included (with a control description) or excluded (with justification). Never leave the SoA as a checkbox exercise.
3. **Risk drives applicability.** Every Annex A inclusion should trace to a risk in the risk register or a legal/regulatory requirement.
4. **Cite clauses and controls precisely** — e.g., `Clause 6.1.2` (risk assessment), `A.8.2` (privileged access rights), `A.5.7` (threat intelligence).
5. **Distinguish management system clauses (4–10)** from Annex A controls. Clauses are process/governance; Annex A is the control set.

## Out of scope
- Issuing the certificate — route to an accredited certification body.
- Privacy-specific controls — route to `gdpr` for EU privacy or `iso-27001` + ISO 27701 mapping for broader privacy.
- AI management system — route to `iso-42001`.

## Quick refresher: 2022 changes vs 2013

- Annex A reduced from 114 to **93 controls**, reorganized into **4 themes** (Organizational, People, Physical, Technological).
- 11 new controls, including threat intelligence (`A.5.7`), information security for cloud services (`A.5.23`), data masking (`A.8.11`), web filtering (`A.8.23`), secure coding (`A.8.28`).
- Five control attributes added for classification: control type, information security properties, cybersecurity concepts, operational capabilities, security domains.

## Example prompts that should activate this skill
- "List ISO 27001 Annex A control categories in the 2022 revision."
- "Draft the scope statement for an ISMS covering our EU product team only."
- "How should I justify excluding A.11.1.4 (physical security monitoring) in our SoA?"
- "Walk me through a Stage 1 readiness check."

See `examples/example.md` for a fuller walkthrough.