Context and scope
Define the ISMS scope, the interested parties and the requirements that apply to the organization.
ISO/IEC 27001:2022
Manage every ISO 27001 control in one platform.
Audexa organizes your ISMS in a single workspace: clauses and Annex A assessed control by control, a Statement of Applicability, approved policies, evidence with expiry dates and an action plan to get you to the certification audit.
- 25 clauses + 93 Annex A controls
- Statement of Applicability
- 43 policy templates
118 assessable requirements: 25 from the clauses and 93 from Annex A
43 policy templates linked to ISO 27001
6 frameworks connected through mappings: NIS2, ENS, GDPR, NIST, ISO 9001 and ISO 14001
1 free ISO 27001 audit to try the platform
What the standard requires
ISO 27001 certification means proving a system, not filling in a checklist.
The 2022 edition reorganized Annex A into 93 controls and four themes. The transition from the 2013 edition ended on October 31, 2025, so valid certificates must now be on the 2022 edition.
Leadership and policy
Top management approves the information security policy, assigns roles and provides resources.
Risk assessment and treatment
A repeatable risk method and a treatment plan consistent with the selected controls.
Statement of Applicability
Which Annex A controls apply, which don't and why, with their implementation status.
Operational evidence
Records, procedures and proof that controls work, not just that they exist.
Continual improvement
Internal audit, management review and corrective actions to close the loop.
How Audexa helps
Your ISMS in one place, ready for the audit.
Assess, decide applicability, carry out remediation and keep the evidence without relying on shared folders.
Assess
Know the status of every clause and control.
Guided audit
Clauses 4 to 10 and Annex A grouped by theme, with guidance, weighting, remediation steps and the clause or control behind each question.
Focused view and Your path
With ISO 27001 as your focus, Audexa shows you only what the standard asks for and a single next step. One framework, on every plan.
Smart audit
Suggested answers with their source in your first audit, a consistency check before submitting (it warns, never blocks), points per gap and questions shared out across the team.
Re-audit and comparison
Repeat the audit with the same scope and compare progress between cycles.
Reuse across frameworks
Answers with high coverage are suggested as reviewable drafts in NIS2, ENS or GDPR.
Manage
Decisions and work with full traceability.
Statement of Applicability
Mark controls as applicable, not applicable or out of scope with a justification, and export them.
Risks and treatment
Likelihood and impact matrix, treatment and risk acceptance signed by management.
Asset inventory
Devices, software, SaaS and suppliers with an owner and periodic review.
Multi-site audit
With Sites and group, central controls are answered once at the main site and each site's controls come from its latest audit. Audexa proposes a sample by phase and risk; your certification body confirms the final one.
Prove
Organized evidence for auditors.
ISMS policies
43 templates linked to ISO 27001 with versions, approval and signature.
Evidence vault
Documents with an owner, review, expiry and history, linked to each control.
Hand over to the auditor
Check what is missing and download a package organized by control with an index and SHA-256 fingerprint, or share a read-only link that expires and that you can revoke.
Some features depend on your plan and active modules.
Statement of Applicability
Your Statement of Applicability, always consistent with the audit.
Before answering, decide which controls apply. Every exclusion keeps its justification, and the statement is exported with the organization's context and the applicability of each control.
- Applicable, not applicable or out of scope, with a reason
- Organization context saved with each audit
- Exclusions visible in results and exports
- No score penalty for controls that don't apply
Evidence
One piece of evidence, many controls, no duplicates.
Upload a document once and link it to controls, tasks, policies or risks. Audexa tracks its expiry and review so you never present out-of-date proof.
- PDF, Office files and images with preview
- Owner, reviewer, review and expiry dates
- Approved policy turned into immutable evidence
- Hand over to the auditor: a package with an index and SHA-256 fingerprint, or a link that expires
Before certification
Would you pass an external audit today?
From Premium, Audexa reviews your controls and marks each one as Ready, Needs evidence or Needs work, with a sample explained in one line and a Rehearsal with Aude. It is guidance only, never a verdict: your certification body decides.
- One row per control with expandable detail
- What is missing, linked to the task or the evidence that closes it
- Auditor package with an index and a SHA-256 fingerprint for each file
- Read-only link that expires on its own, that you can revoke and with every access logged
Would you pass an external audit today?Guidance
- A.5.15 Access controlReady
- A.8.13 Information backupNeeds evidence
- A.5.24 Information security incident management planning and preparationNeeds work
Several sites
Prepare your group's multi-site ISO 27001 certification.
With Sites and group, central controls are answered once at the main site, and site controls are read from each site's latest completed ISO 27001 audit. Audexa proposes a sample of sites based on each one's phase and risk, and you can change it.
- Initial certification, surveillance or recertification phase
- Indicative score and main findings across the whole scope
- PDF and Excel report with the scope statement
- Your certification body confirms the final sample
How it works
Three steps toward ISO 27001 certification.
Run your free audit
Assess the clauses and Annex A and get your score, your gaps and an executive report.
Close the gaps
Turn gaps into tasks, approve policies and link evidence to each control.
Arrive prepared
Re-audit, check whether you would pass an external audit today and hand the evidence package to your auditor.
Before and after
An ISMS in folders vs. an ISMS in Audexa.
AreaWithout a platformWith Audexa
Statement of Applicability
Excel disconnected from reality
Generated from the audit itself
Evidence
Folders with questionable versions
Vault with expiry, review and history
Policies
Word files without version control
Templates with approval and signature
Follow-up
Gaps in a static report
Tasks with owners and re-audits
Other frameworks
Starting from scratch for NIS2 or ENS
Reusable, reviewable answers
Frequently asked questions
What people usually ask us about ISO 27001.
Can I try Audexa with ISO 27001 for free?
Yes. The Free plan includes a complete ISO 27001 audit, an executive report in PDF and the tasks derived from the audit. You can sign up at app.audexa.es or ask us for a guided demo.
Does Audexa certify us for ISO 27001?
No. Certification is issued by an accredited certification body. Audexa helps you implement and maintain your ISMS and prepare the evidence and reports for the audit.
Is it up to date with ISO/IEC 27001:2022?
Yes. The audit follows the 2022 edition: clauses 4 to 10 and the 93 Annex A controls grouped into organizational, people, physical and technological controls.
Does it generate the Statement of Applicability?
Yes. You set the applicability of each control with its justification and export it together with the organization's context and the framework version.
Does it help if we also need to comply with NIS2 or ENS?
Yes. Audexa includes mappings from ISO 27001 to NIS2, ENS, GDPR, NIST CSF 2.0, ISO 9001 and ISO 14001 so you can reuse evidence and reviewable answers.
Does Audexa answer the audit for me?
No. Audexa suggests answers with their source, flags what doesn't add up and tells you which gaps raise your score the most, but a person decides every answer. Nothing is answered or submitted on its own.
Does it work for a multi-site ISO 27001 certification?
It helps you prepare for it. With Sites and group (a module Audexa activates on request, for Premium and Diamond), you answer the central controls once at the main site, each site's controls come from its latest ISO 27001 audit and Audexa proposes a sample of sites based on phase and risk, with the scope statement in the report. It is guidance only: your certification body confirms the final sample.
Where is the data hosted?
Audexa runs on EU infrastructure, with role-based access, two-factor authentication and activity traceability.
Request a demo
We'll show you the path to ISO 27001 certification.
In a 30-minute demo we walk through the audit, the Statement of Applicability, policies and the handover to the auditor.
- We review your ISMS starting point.
- We show you how controls, policies and evidence fit together.
- We set up your free audit so you can continue on your own.