// ToolkitISO27001.jsx — Verigo Global: ISO 27001:2022 implementation toolkit page const { V: TV, MAXW: TMW, FONT: TFT } = window; /* ── BREADCRUMB ──────────────────────────────────────────── */ const TCrumb = ({ onNav }) => (
/ / ISO 27001 Toolkit
); const tcrumbBtn = { background: 'none', border: 'none', cursor: 'pointer', color: '#7A7A8A', fontSize: 13, fontWeight: 600, padding: 0, fontFamily: "'DM Sans', system-ui, sans-serif" }; /* ── HERO ────────────────────────────────────────────────── */ const THero = ({ onNav }) => (
Implementation Toolkit ISO/IEC 27001:2022

The ISO 27001 toolkit, ready to deploy.

A complete, practitioner-maintained document set — 24 policies, 20 procedures, and all 93 Annex A control templates — tailored to your organization so you build a certifiable ISMS without starting from a blank page.

onNav('evaluation')}>Start the readiness evaluation document.getElementById('downloads')?.scrollIntoView({ behavior: 'smooth', block: 'start' })}>See what's inside
Inside the toolkit
{[['doc', '24', 'Approval-ready policies'], ['file', '20', 'Operational procedures'], ['layers', '93', 'Annex A control templates'], ['clipboard', '120+', 'Documents, checklists & samples']].map(([ic, n, l], i) => (
{n}
{l}
))}
); /* ── OVERVIEW ────────────────────────────────────────────── */ const TOverview = () => (
Overview

Everything the standard asks for — pre-built and tailored.

The Verigo ISO 27001 toolkit is the document backbone of a certifiable Information Security Management System. It pairs the management-system documentation required by Clauses 4–10 with implementation templates for every one of the 93 Annex A:2022 controls.

Each artefact is maintained by senior practitioners and tailored to your organization, industry, and risk appetite — then embedded into how you operate, the Compliance by Design way, so evidence is produced by the process itself.

{[ ['compass', 'Tailored, not generic', 'Every policy and procedure is shaped to your scope, structure, and existing tooling — not a one-size-fits-all template dump.'], ['network', 'Cross-framework ready', 'Controls are mapped so the same evidence supports SOC 2, CMMC, NIST, and HITRUST without duplication.'], ['refresh', 'Maintained for the 2022 edition', 'Aligned to ISO/IEC 27001:2022, including the 11 new controls and the four-theme Annex A structure.'], ].map(([ic, t, d], i) => (

{t}

{d}

))}
); /* ── COVERAGE ────────────────────────────────────────────── */ const CLAUSES = [['4', 'Context'], ['5', 'Leadership'], ['6', 'Planning'], ['7', 'Support'], ['8', 'Operation'], ['9', 'Performance'], ['10', 'Improvement']]; const TCoverage = () => (
Management system · Clauses 4–10
{CLAUSES.map(([n, t], i) => (
{n}
{t}
))}
Annex A:2022 · 93 controls, four themes
{window.TK_ISO.ANNEX.map((g, i) => (
{g.items.length}

{g.theme}

))}
); /* ── CONTENTS EXPLORER + GATED DOWNLOADS ─────────────────── */ const TContents = ({ onDownload, unlocked }) => { const [tab, setTab] = React.useState('policies'); const A = window.TK_ISO.ASSETS; const tabs = [['policies', 'Policies', A.policies.count], ['procedures', 'Procedures', A.procedures.count], ['controls', 'Annex A Controls', A.controls.count]]; const meta = A[tab]; const renderList = () => { if (tab === 'controls') { return (
{window.TK_ISO.ANNEX.map((g, gi) => (
{g.theme} {g.items.length} controls
{g.items.map(([code, title], i) => (
{code} {title}
))}
))}
); } const list = tab === 'policies' ? window.TK_ISO.POLICIES : window.TK_ISO.PROCEDURES; return (
{list.map(([t, d], i) => (
{String(i + 1).padStart(2, '0')}
{t}
{d}
))}
); }; return (
{/* tabs */}
{tabs.map(([id, label, count]) => ( ))}
{/* download bar */}
{meta.label}
{meta.blurb}
onDownload(tab)} style={{ flexShrink: 0 }}> {unlocked ? `Download PDF · ${meta.count} ${meta.unit}` : `Download PDF (${meta.count} ${meta.unit})`}
{/* list */}
{renderList()}
); }; /* ── SAMPLE DOCUMENTS VIEWER ─────────────────────────────── */ const TSamples = ({ onDownloadSample }) => { const [s, setS] = React.useState('policy'); const tabs = [['policy', 'Policy', 'doc'], ['procedure', 'Procedure', 'file'], ['control', 'Control template', 'layers'], ['checklist', 'Checklist', 'clipboard']]; return (
{tabs.map(([id, label, icon]) => ( ))}
Want the full sample?

Preview the complete package index as a branded PDF — we'll ask for a few details first.

Preview / download sample PDF

Samples are illustrative. Delivered documents are tailored to your organization and branding.

 ); }; const DocHeader = ({ docId, title, ver = '2.1', owner }) => (
{docId}

{title}

{[['Classification', 'Internal'], ['Version', ver], ['Owner', owner], ['Framework', 'ISO/IEC 27001:2022']].map(([k, v], i) => (
{k}
{v}
))}
); const DocSection = ({ n, h, children }) => (
{n}{h}
{children}
); const SamplePaper = ({ kind }) => { if (kind === 'policy') return (
This policy establishes the requirements for controlling access to information and information processing facilities, ensuring access is granted on a least-privilege, need-to-know basis in support of Annex A controls A.5.15–A.5.18. Applies to all employees, contractors, and third parties who access organizational systems, applications, and data, across all four operating regions.
  • Access is provisioned through a formal request and approval workflow tied to documented roles.
  • Privileged access is restricted, logged, and reviewed at least quarterly.
  • Multi-factor authentication is enforced for remote and administrative access.
  • Access rights are recertified every 90 days and revoked within 24 hours of a leaver event.
 System owners approve access; IT operations provisions it; the CISO owns this policy and its annual review. Reviewed annually or upon significant change. Next review: 12 months from approval.
); if (kind === 'procedure') return (
Define the repeatable steps for granting, modifying, and removing user access across the joiner–mover–leaver lifecycle.
2.0Process steps
{[['1', 'Request raised', 'Manager submits an access request specifying role and systems.'], ['2', 'Approval', 'System owner validates least-privilege and approves or rejects.'], ['3', 'Provision', 'IT Operations creates accounts and assigns role-based entitlements.'], ['4', 'Verify', 'Requester confirms access; evidence logged to the ticket.'], ['5', 'Deprovision', 'On a leaver event, access is revoked within 24 hours and recorded.']].map(([n, t, d], i) => (
{n}
{t}
{d}
))}
Access request tickets, approval logs, and quarterly access-review reports are retained for the certification cycle.
); if (kind === 'control') return (
Ensure secure authentication technologies and procedures are implemented based on access restrictions and the access control policy.
{[['Applicability', 'Applicable — all production systems'], ['Implementation status', 'Implemented'], ['Control owner', 'Head of IT Security'], ['Test frequency', 'Quarterly']].map(([k, v], i) => (
{k}
{v}
))}
MFA is enforced for all remote and privileged access; password policy meets length and complexity baselines; failed-attempt lockout and anomalous-login alerting are enabled. IdP configuration export, MFA enrolment report, authentication policy, and a sample of access logs demonstrating lockout behaviour.
); // checklist return (
{[['done', 'Statement of Applicability complete and signed off', 'A.5 / Clause 6'], ['done', 'Risk assessment & treatment plan current', 'Clause 6.1'], ['done', 'All 93 Annex A controls assessed for applicability', 'Annex A'], ['progress', 'Internal audit completed; findings logged', 'Clause 9.2'], ['progress', 'Management review minutes for the period', 'Clause 9.3'], ['todo', 'Corrective actions closed or with target dates', 'Clause 10.1'], ['todo', 'Awareness training records for all staff', 'A.6.3']].map(([st, t, ref], i) => { const map = { done: [TV.purple, 'check', 'Complete'], progress: [TV.orange, 'refresh', 'In progress'], todo: [TV.g300, 'clipboard', 'Outstanding'] }; const [c, ic, lab] = map[st]; return (
{t}
{ref} {lab}
); })}
); }; /* ── PAGE ────────────────────────────────────────────────── */ const ToolkitISO27001Page = ({ onNav }) => { const [modalAsset, setModalAsset] = React.useState(null); const [unlocked, setUnlocked] = React.useState(false); const sessionOk = () => { try { return !!sessionStorage.getItem('verigo_dl_ok'); } catch (e) { return false; } }; React.useEffect(() => { if (sessionOk()) setUnlocked(true); }, []); const onDownload = (asset) => { if (sessionOk()) { window.TK_ISO.generatePDF(asset, window.TK_ISO.getUser() || {}); } else { setModalAsset(asset); } }; const onModalSubmit = (form) => { window.TK_ISO.storeLead(form); try { sessionStorage.setItem('verigo_dl_ok', '1'); } catch (e) {} setUnlocked(true); const asset = modalAsset; setModalAsset(null); setTimeout(() => window.TK_ISO.generatePDF(asset, form), 60); }; const A = modalAsset ? window.TK_ISO.ASSETS[modalAsset] : null; return (
onDownload('standard')} /> onDownload('standard')} onNav={onNav} /> {A && ( setModalAsset(null)} onSubmit={onModalSubmit} /> )}
); }; Object.assign(window, { ToolkitISO27001Page });