ISO 27001 Policy Pack — Core

Overview

The ISO 27001 Policy Pack — Core gives small businesses and startups a ready foundation for an information security management system, or ISMS. It is made for lean teams that have little or no security documentation yet. You need a credible starting point, and you need it fast. The pack delivers 16 editable ISO/IEC 27001:2022 documents plus the full 93-control Statement of Applicability. Every file is Microsoft Word or Excel, so you edit, rename, and brand it as your own. Download is instant. The license covers a single organization.

Most buyers arrive here under real pressure. A large customer sends a security questionnaire and expects written policies in return. A prospect asks for proof of your security program before they will sign. An investor or partner wants to see governance on paper, not just promises. A missed questionnaire can stall a deal you have spent months earning. Suddenly you need an information security policy, an access control policy, and an incident response procedure that did not exist last week. Drafting all of that from scratch is slow and stressful. A blank page is the hardest place to begin, and the deadline rarely moves.

This pack maps directly to how ISO/IEC 27001:2022 expects you to work. The Information Security Policy sets the top-level mandate and records leadership commitment. The Information Security Roles and Responsibilities policy assigns clear ownership. The Risk Assessment and Treatment Procedure drives a risk-based approach rather than a checkbox one. Focused policies then cover the areas auditors probe most. These include the Access Control Policy and the Asset Management and Information Classification Policy. You also get the Human Resources Security Policy and the Supplier and Cloud Services Security Policy.

The set adds a Logging and Monitoring Policy, a Backup and Recovery Policy, and a Remote Working and Mobile Device Policy. Operational documents round out the pack. There is an Information Security Incident Response Procedure, a Business Continuity and ICT Readiness Plan, and a Security Awareness and Training Procedure. An AI Acceptable Use Policy covers the new tools your team has already started using.

The Statement of Applicability ties the whole pack to the standard. This Excel workbook lists all 93 Annex A controls across the four themes. For each control, you record whether it applies, how you meet it, and the reason behind your decision. Auditors expect this document early, and it anchors the rest of your evidence. The policies in the pack give you concrete language to point to as you complete it. Together they show a reviewer that your program is deliberate, not improvised.

Tailoring a structured set beats drafting from nothing. The documents read consistently and reference each other clearly. Terms, roles, and cross-references line up across the whole pack. Bracketed placeholders show exactly what to fill in. You add your company name, your owners, and your review cadence. You shape the language to your real operations instead of inventing structure from an empty page. That turns weeks of policy writing into focused, confident editing. You can have a complete first draft in days, then refine it as your controls mature. The result is a coherent paper trail you can put in front of a customer, a partner, or an auditor.

Be clear about what these documents do and do not do. They form the readiness layer of your security program. They do not make you certified or compliant on their own. ISO 27001 certification comes only from an accredited certification body. It follows a Stage 1 and Stage 2 audit of a working ISMS, not a folder of templates. You still operate the controls, keep the records, and improve the system over time. What this pack does is remove the hardest first step. It helps you document a complete program quickly and start that work on solid ground.

What customers say