# ISO 27001 readiness starts with knowing exactly where your ISMS stands.

XGRC® MSXCyber® gives organisations a structured way to assess ISO 27001 readiness, close control gaps, and manage the information security management system on an ongoing basis — not just in the weeks before an audit.

**Frameworks:** ISO 27001, ISO 27002, ISMS, NIST CSF, GDPR, POPIA

## Without continuous ISMS oversight, gaps accumulate quietly.

When asset registers, risk assessments, and Annex A controls are managed across disconnected spreadsheets, control weaknesses build up unnoticed between certification cycles — and surface as audit findings instead of managed decisions.

- Asset inventories maintained in spreadsheets, disconnected from risk assessment
- Control gaps only discovered when the external auditor finds them
- Statement of Applicability out of date with the actual control environment
- No structured evidence trail linking risks, controls, and corrective actions

## The ISO 27001 implementation lifecycle, in one system.

- Define ISMS scope and information security context
- Run a structured gap assessment against Annex A controls
- Build the asset inventory and complete risk assessment
- Implement controls and complete the Statement of Applicability
- Conduct internal audit against ISMS clauses and controls
- Hold management review and track continual improvement

## How it works

- Central asset register linked to risk assessment
- Configurable risk methodology aligned to ISO 27001:2022
- Statement of Applicability tracked against Annex A controls
- Incident management with regulatory disclosure tracking
- Real-time dashboards for audit and management review

## On the platform

**One connected view of your ISMS** — MSXCyber® links the asset register, risk assessments, and Annex A controls to internal audit and incident management, so every control has a traceable evidence trail. Management gets a live view of ISMS status without waiting for the next audit cycle.

## The same ISMS, without the spreadsheet chaos.

| Manual approach | With XGRC® |
| --- | --- |
| Asset inventories in spreadsheets | Centralised asset and risk register |
| Gaps found only at audit time | Continuous gap and control monitoring |
| Statement of Applicability out of date | Live Statement of Applicability |
| No linkage between risks and controls | Risks, controls, and actions fully linked |

## One platform across the full ISMS.

- ISO 27001 gap assessment
- Information security risk management
- Annex A control implementation
- Data protection compliance (GDPR, POPIA)

## Frequently asked questions

### What is ISO 27001 compliance software?

ISO 27001 compliance software assesses ISMS readiness, tracks Annex A control implementation, and manages the information security management system on an ongoing basis, rather than reconstructing evidence in the weeks before an audit.

### Does MSXCyber® keep the Statement of Applicability current?

Yes. The Statement of Applicability is tracked directly against Annex A controls as they are implemented, so it reflects the actual control environment rather than drifting out of date between audits.

### How are risks and controls linked for audit evidence?

The asset register, risk assessments and Annex A controls are linked to internal audit and incident management, so every control has a traceable evidence trail rather than scattered supporting documents.

### Which frameworks does ISO 27001 readiness align to?

ISO 27001 readiness aligns to ISO 27001:2022, ISO 27002, NIST CSF, GDPR and POPIA, reflecting how information security and data protection obligations typically overlap.

## Related solution

- [MSXCyber®](https://xgrcsoftware.com/msxcyber)

---

Source: https://xgrcsoftware.com/use-cases/iso-27001-readiness