Annex A
Relevant controls
Identify which of the 93 Annex A controls apply. Record your selection and justify exclusions in a tailored Statement of Applicability.
ISO 27001 
certification.Fast. Secure.
Build an Information Security Management System (ISMS) that protects your business. We help you prepare for ISO 27001 certification and meet enterprise buyers’ security expectations.
Tailored ISMS- Pentest included
- Expert guidance
Your ISMS.
Built for your business.
Turn ISO 27001 requirements into a working security management system, with relevant controls and evidence for your audits.
Controls that apply
We help you select relevant Annex A controls and document the reasons for inclusion or exclusion in your Statement of Applicability.
A working ISMS
Combine security tools, automated evidence, and expert guidance to run your ISMS as your business grows.
Surveillance readiness
Continuous monitoring helps keep your controls and evidence current between annual surveillance audits.
Security tools.
Evidence built in.
Built-in tools help protect your systems and collect evidence for your ISMS.
IncludedPenetration testing
OSCE-certified experts test your systems and report security gaps. Included in your program.
IncludedCode security scanning
Automated vulnerability detection in every commit. Catches issues before they ship.
IncludedDevice compliance
A lightweight agent monitors encryption, firewall, and screen lock.
IncludedAttack surface monitoring
Discover external assets around the clock. Find exposed services and shadow IT.
IncludedSecurity training
Help your team spot threats with phishing simulations and security awareness courses.
IncludedvCISO support
Get expert security leadership to build and run your ISMS beyond certification.
Certification in 4 steps.
Prepare your ISMS and evidence for each stage of the certification process.
Gap analysis
We assess your current state against ISO 27001 requirements and build your roadmap.
Build your ISMS
Tailored policies, risk assessments, and controls that fit your organization.
Stage 1 audit
Documentation review with your certification body. We prepare you thoroughly.
Stage 2 and certification
Implementation audit, then certification. We keep you ready for surveillance audits.
Security first. Compliance follows.Already have SOC 2?
Already have SOC 2?
You’re 70% there.
Map your SOC 2 policies, controls, and evidence to ISO 27001. Reuse shared work and focus on the ISMS requirements still to address.
Security first. Compliance follows.Already have SOC 2?
Already have SOC 2?
You’re 70% there.
Map your SOC 2 policies, controls, and evidence to ISO 27001. Reuse shared work and focus on the ISMS requirements still to address.
Real security.
Starts with a closer look.
We test the systems you actually run, not a questionnaire. Every check shows what’s working, what isn’t, and which frameworks each gap touches.
One gap.
More than one framework.
Every result maps to the frameworks it belongs to. One gap can hold back several at once.
Your agent fixes what it can.
It prepares the fix, you approve it, and we retest. One verified fix counts toward every framework that needs it.
An expert handles the rest.
Some gaps need human judgment. Your Oneleet expert works through the details with you and verifies the result.
One fix. Progress everywhere.
The same security work moves SOC 2, ISO 27001, GDPR, HIPAA, FedRAMP and ISO 42001 forward together. Explore the checks they share.
ISO 27001 questions,
answered plainly.
Your ISMS, audit scope, and the path to certification.
What is an ISMS?
An Information Security Management System combines security policies, risk assessment, responsibilities, and controls. ISO 27001 certification assesses that system within a defined scope.
Do we need every Annex A control?
Selection follows your risks and applicable requirements. Your Statement of Applicability records necessary controls and justified exclusions. Controls cannot be removed simply to shorten the checklist.
What is the difference between Stage 1 and Stage 2?
Stage 1 reviews ISMS documentation and readiness. Stage 2 examines implementation and operation. We help prepare your policies, evidence, and control owners for both.
Can we reuse our SOC 2 work?
Yes. We map existing policies, technical controls, and evidence to ISO 27001, then identify the remaining ISMS and control gaps.
How long does ISO 27001 certification take?
Timing depends on scope, existing security, remediation, and certification-body availability. We build a plan around your starting point and the required audit stages.
Who issues the ISO 27001 certificate?
An independent certification body issues the certificate. Oneleet helps build your ISMS, prepare evidence, and address gaps. ISO itself does not certify organizations.
Build your ISMS.
Prepare for certification.
Let’s scope your ISO 27001 program and build on the security work you already have.