ISO 27001 Advisor
Run ISO 27001 gap analysis, write policies, build the Statement of Applicability and risk register, apply Annex A controls, and prepare for certification — including the 2013-to-2022 transition.
ISO 27001 certification is the security checkbox enterprise customers demand — but between the Statement of Applicability, risk treatment, Annex A controls, and the 2013-to-2022 transition, most teams don't know where to start or how close they actually are.
Who it's for: security and compliance teams pursuing ISO 27001, startups facing enterprise security questionnaires, ISMS owners building or maintaining the program, teams transitioning from the 2013 to 2022 control set, anyone writing security policies or a risk register
Example
"Run an ISO 27001 gap analysis and draft our Statement of Applicability" → A clause-and-Annex-A gap report, an SoA, a risk register and treatment plan, and a prioritized certification-readiness roadmap
CLAUDE.md Template
New here? 3-minute setup guide → | Already set up? Copy the template below.
# ISO 27001 Compliance Skill
You are an expert ISO 27001 Lead Auditor and ISMS implementation consultant assisting a **security or compliance team**. You have deep knowledge of both ISO 27001:2013 and ISO 27001:2022 and can help with gap analysis, policy authoring, control guidance, and risk management.
## How to Respond
Always clarify which version (2013, 2022, or both) the user is working with if not stated. Default to **2022** if unspecified.
Match your output to the task type:
| Task | Output Format |Get new playbooks like this one
One email a week with new Claude Code workflows. Free, like everything here.
No spam. Unsubscribe anytime.
What This Does
Turns Claude Code into an ISO/IEC 27001 compliance assistant. It runs gap analysis and audits, writes security policies, generates the Statement of Applicability (SoA), builds risk assessments, risk registers, and risk treatment plans, applies Annex A controls (2013 and 2022), guides ISMS implementation and clause requirements, supports the 2013-to-2022 transition, and produces certification-readiness checklists.
The Problem
ISO 27001 is the de-facto security credential for selling to larger customers, but the management-system requirements (Clauses 4-10) plus Annex A controls, the SoA, and a defensible risk process are a lot to assemble. Teams either over-engineer it or discover gaps weeks before an audit. The 2013-to-2022 control restructuring adds another layer for organizations already certified.
Quick Start
Step 1: Create Your Workspace
mkdir -p ~/Documents/ISO-27001
Step 2: Download the Template
mv ~/Downloads/CLAUDE.md ~/Documents/ISO-27001/
Step 3: Add Context (Optional)
Add existing policies, your asset inventory, and a description of your systems and data flows.
Step 4: Run Claude Code
cd ~/Documents/ISO-27001
claude
Step 5: Start
Say: "Run an ISO 27001 gap analysis and tell me how far we are from certification."
Example Commands
"Run an ISO 27001 gap analysis against Clauses 4-10 and Annex A"
"Generate a Statement of Applicability"
"Build a risk register and risk treatment plan"
"Write an access control policy" (or incident response, supplier security, etc.)
"Which Annex A 2022 controls apply to us?"
"Plan our transition from the 2013 to the 2022 controls"
"Create a certification-readiness checklist"
What You Get
| Output | Contents |
|---|---|
| Gap Analysis | Clause and Annex A findings with priorities |
| Statement of Applicability | Controls, applicability, and justification |
| Risk Register | Risks, treatment decisions, and owners |
| Policies | Ready-to-edit ISMS policies |
| Readiness Roadmap | Path to certification |
Tips
- Anchor the SoA in real risks — auditors check the link between risk and controls.
- Write policies you'll actually follow — evidence of operation matters more than length.
- Plan the 2022 transition if you're already certified to 2013.
Important Disclaimer
This is a compliance support tool, not a certification audit. Certification requires an accredited body. Have qualified security and audit professionals review outputs before relying on them.