— RegulationISO 27001 : Information Security
The international information security standard. Structure your ISMS, prepare for certification, and assess your suppliers.
Annex A controls
Normative clauses
ISMS domains
Max. preparation
ISO 27001 is the leading international standard for information security management. It defines the requirements for an Information Security Management System (ISMS) and provides the basis for globally recognized certification.
For many organizations, ISO 27001 certification has become a commercial prerequisite: clients demand it, tenders make it a criterion, and regulators recognize it as evidence of sound security governance.
But certification is only the visible part. What matters is the actual structuring of your ISMS: risk analysis, Annex A controls, documentation, continual improvement. And above all: supplier assessment, since ISO 27001 explicitly requires managing risks related to third parties (controls A.5.19 to A.5.23).
What ISO 27001 covers
Governance
Security policy, roles and responsibilities, management commitment.
Risk management
Threat identification, vulnerability analysis, risk treatment. This is the core of the ISMS.
Annex A controls
93 organizational, people, physical, and technological controls. From access management to business continuity.
Documentation
Policies, procedures, statement of applicability (SoA), risk registers. Certification requires a high level of formalization.
Continual improvement
Internal audits, management reviews, corrective actions. ISO 27001 is a PDCA cycle, not a one-time exercise.
Why you should also assess your suppliers
ISO 27001 explicitly requires managing risks related to suppliers and service providers with access to your information. Annex A controls A.5.19 to A.5.23 cover supplier security policy, contractual requirements, supply chain management, and performance monitoring.
Annex A controls
In practice, this means you must assess your critical suppliers' security posture, formalize contractual requirements, and track changes in their risk level. The certification auditor will verify that you have implemented a structured and proportionate process. Conitiv provides exactly the necessary tools: automated cyber scoring, ISO 27001 questionnaires, and evidence-based audits.
How Conitiv helps you
ISO 27001 questionnaire
Structured and aligned with the standard's requirements, including Annex A. Maturity measurement and certification preparation.
Cyber rating of your suppliers
Non-intrusive cyber posture scoring. Assessment of controls A.5.19 to A.5.23 (supplier relationships).
Evidence-based audit
Document-based verification by expert consultants. Enforceable reports for strategic third parties.
Gap analysis
Gap identification, action prioritization, realistic plan to reach your certification audit with confidence.
No. Conitiv prepares you for certification by assessing your maturity, identifying gaps, and structuring your action plan. The certification audit is still conducted by an accredited body (Bureau Veritas, AFNOR, etc.). Conitiv helps you get there with confidence.
It depends on your current maturity level. On average, allow 6 to 12 months to structure your ISMS and prepare for the initial audit. Conitiv's self-assessment allows you to quickly identify gaps and prioritize actions.
Yes. The questionnaire is structured to cover the requirements of the standard's body (clauses 4 to 10) and all 93 Annex A controls. It allows you to measure your maturity in each domain and identify uncovered controls.
Ready to assess your ISO 27001 maturity?
expert Conitiv