Home / Essentials pack
Essentials pack
22 editable Word and Excel files: the core ISMS documents, 15 policies, and the registers and logs that produce your evidence.
Essentials gives you every document and record an ISO 27001 information security management system (ISMS) needs, ready to tailor. It suits businesses with someone who already understands the standard, or who are working with a consultant and want to save on writing time.
Core ISMS documents (5 files)
Your top-level policy, with management commitment, measurable objectives, roles and the list of supporting policies.
Defines what your ISMS covers, with worked examples of issues, interested parties, exclusions and supplier dependencies.
A five-step method with likelihood and impact scales, a colour-coded risk matrix, acceptance criteria and a worked example.
30 common small-business risks ready to score, automatic risk levels, drop-down lists and a dashboard with a heat map.
All 93 Annex A controls with plain-English explanations, suggested decisions, links to policies and risks, and audit-readiness checks.
Policies (15 files)
Everyday rules for devices, email, internet, AI tools and information, with a staff acknowledgement form.
Joiners, movers and leavers, access reviews, admin accounts and multi-factor authentication.
Three classification levels, a handling table for each, and a retention schedule.
UK GDPR principles, lawful basis, individuals' rights, breaches, and a record of processing template.
Reporting, severity levels, the response team, ICO notification, a contact list and a first-hour checklist.
Malware, patching, secure configuration, logging, networks and change control, with a recurring task schedule.
What to back up, ransomware-resistant copies, monitoring and restore testing, with a test record form.
Supplier tiers, due diligence, contract clauses, cloud services and a supplier questionnaire.
Asset register, ownership, return of assets and secure disposal.
Home working, travel, personal devices and working abroad, with a remote worker checklist.
Screening, contract terms, induction, training, disciplinary process and leavers, with an induction checklist.
Business impact analysis, disruption scenarios, IT readiness and a quick guide for disruptions.
Security zones, entry, visitors, secure areas and equipment, with an office security check.
Where encryption is required, acceptable standards, and managing keys and certificates.
For businesses that develop software: secure coding, testing, environments and outsourced development.
Records and registers (2 workbooks)
Asset, supplier, legal and contractual, and encryption registers, with a dashboard flagging overdue reviews and expiring certificates.
Incident, change, corrective action, training, approved software, visitor and key logs, with a dashboard.
What you need
- Microsoft Word and Excel (Microsoft 365 or a recent desktop version). Other software can open the files, but formatting and formulas may not display exactly as designed.
- Your own copy of ISO/IEC 27001:2022, available from BSI or ISO. It is not included, for copyright reasons.
- Time: most small businesses take six to twelve months to reach certification. The templates save most of the writing; running the ISMS long enough to produce evidence takes the rest.
Want the step-by-step guidance and audit kit as well? The Complete pack adds the Implementation Guide, everything you need to audit yourself and prepare for certification, and a free one-hour consultation. Already bought Essentials? You can upgrade within 30 days by paying the difference.
Licence, downloads and refunds
Licensed for use within your organisation. Your download link arrives by email straight after payment, and you get free updates for 12 months. If a file is faulty we will replace it or refund you; because the packs are digital, we do not normally refund them once downloaded. See the terms and licence and refund policy for details.