ISO 27001:2022
Annex A controls aligned to the 2022 revision — 93 controls across organizational, people, physical, and technological themes. Statement of Applicability with versioned applicability rationale. Internal audit and management-review workflows. Ready for Stage 1 and Stage 2 certification cycles.
What we cover
Norven implements the ISMS clauses (4–10) as practice, not a folder of PDFs: context and scope, leadership commitments, risk treatment, internal audit, and management review — each with auditable artifacts produced as a side effect of the work, not as a separate writing exercise.
For Annex A, every applicable control has an owner, an evidence cadence, and an exception register. Controls de-scoped at the SoA level are recorded with the rationale; reviewers see history, not declarations.
Norven cross-maps SOC 2 CC controls to ISO 27001:2022 Annex A so adding a second framework is not a second project.
