Find your way to ISO 27001 certification
A complete ISO/IEC 27001:2022 toolkit for UK businesses of 10 to 100 people. Policies, risk tools, registers and an audit kit, written in plain English and ready to tailor in Word and Excel.
Built by an information security professional who runs ISO 27001 for a living. Instant download.
The pack follows the route most small businesses take to certification, with a step-by-step guide for each stage.
Built for businesses without a security team
Most small firms come to ISO 27001 because a customer or tender asks for it. Then they find that consultants are expensive and most toolkits are written for large enterprises.
Sized for small businessesPolicies of three to five pages that people will actually read, with rules that match how a small business really works.
Plain English throughoutEvery template explains what to change and why. No jargon you need a consultant to translate.
More than documentsRegisters, logs and an audit kit that produce the evidence certification auditors ask to see, not just policies on a shelf.
What's included
28 editable Word and Excel files, organised in the order you will use them. Every document is cross-referenced to the standard and to the rest of the pack.
Start here1 file
- Implementation Guide: a step-by-step route from starting out to certification
Core ISMS documents5 files
- Information Security Policy
- ISMS Scope Statement
- Risk Assessment Methodology
- Risk Register with 30 common risks and a dashboard
- Statement of Applicability covering all 93 Annex A controls
Policies15 files
- Acceptable Use
- Access Control
- Information Classification and Handling
- Data Protection
- Incident Management
- Operations Security
- Backup
- Supplier Security
- Asset Management
- Remote Working
- HR Security
- Business Continuity
- Physical Security
- Cryptography
- Secure Development
Records and registers2 workbooks
- Asset, supplier, legal and encryption registers
- Incident, change, training, visitor and corrective action logs
- Dashboards that flag overdue reviews and expiring certificates
Audit kit5 files
- Internal audit programme and 118-point checklist
- Internal audit report template
- Management review pack
- Certification readiness checklist
- Guide to internal audits for small businesses
How it works
Download
Buy the pack and download it straight away. Everything is in Word and Excel, so there is no software to learn.
Tailor
Follow the guidance box in each template. Replace the highlighted placeholders and adjust the rules to fit how you work.
Run it
Use the registers and logs day to day. The dashboards show what needs attention, so the evidence builds up as you go.
Get certified
Audit yourself with the audit kit, hold a management review, then work through the readiness checklist before you book.
Choose your pack
One-off price. Licensed for use within your organisation.
| What's included | Essentials£199The documents and records See full contents |
Complete£349Everything, with guidance to certification See full contents |
|---|---|---|
| Information Security Policy, scope and risk methodology | ||
| Risk Register and Statement of Applicability | ||
| 15 topic-specific policies | ||
| Registers and logs workbooks | ||
| Implementation Guide | Not included– | |
| Audit kit: programme, checklist, report, management review, readiness checklist | Not included– | |
| Guide to internal audits for small businesses | Not included– | |
| Free one-hour consultation with an ISO 27001 specialist | Not included– | |
| Buy Essentials | Buy Complete |
Secure checkout and VAT handled by Payhip. You will receive a download link and receipt by email straight away, and free updates for 12 months. See our refund policy. The Complete pack includes a free one-hour consultation. Need more help? See our consultancy and fractional services.
See the quality before you buy
Download the Acceptable Use Policy free. It shows exactly how every template in the pack is written and laid out, with tailoring guidance, numbered rules and an Annex A mapping.
Questions
Will this guarantee certification?
No toolkit can. Certification depends on your ISMS working in practice, which an independent certification body checks. The pack gives you everything you need to build and run it, and shows you what auditors look for.
Do I need my own copy of ISO/IEC 27001?
Yes. The pack explains the requirements in plain English, but you should buy the standard itself from BSI or ISO. It is not included, for copyright reasons.
Is it up to date?
Yes. It is written for ISO/IEC 27001:2022, including the 93 Annex A controls introduced in that version.
What size of business is it for?
It is designed for UK businesses of roughly 10 to 100 people without a dedicated security team. Smaller and larger firms can use it, but may need to adjust more.
Will it help with Cyber Essentials?
Many of the controls overlap, particularly in the Access Control and Operations Security policies. The pack is built for ISO 27001, though, and does not replace the Cyber Essentials requirements.
Can I share it with other businesses?
The licence covers use within your own organisation. If you are a consultant wanting to use it with clients, get in touch.
What if something is wrong with my files, or I bought the wrong pack?
If a file is faulty or does not match its description, we will replace it or refund you. If you bought Essentials and want Complete, you can upgrade within 30 days by paying the difference. Because the packs are digital files, we do not normally refund them once downloaded, which is why you can download a free sample first. Full details are in our refund policy.
Will I get updates?
Yes. If we update a pack within 12 months of your purchase, to fix an error or reflect a change in the standard or UK law, we will email you the new version free of charge.
What if I need more help?
The Complete pack includes a free one-hour video consultation, to use within 90 days of purchase. Beyond that, we offer gap analyses, independent internal audits and a fractional Head of Information Security service. See consultancy and fractional services.
About Waymark Assurance
Waymark Assurance helps small UK businesses get to ISO 27001 certification without the cost of a full consultancy project. The name comes from the waymarks on British footpaths: a plain sign at the point you need it, telling you which way to go.