Implement ISO 27001 in your organisation, with every file an auditor will ask for
A complete, implementation-grade toolkit for the IT, risk and compliance leads who must build an information security management system aligned to ISO/IEC 27001:2022 and take it through certification.
- A 22-sheet ISMS Master Workbook: 35-practice maturity self-assessment, risk register, treatment plan, a 93-control Statement of Applicability, evidence register, internal audit, CAPA and a dashboard with traffic lights
- A business case calculator that shows cost of doing it vs doing nothing in low, likely and high cases, and a crosswalk to SOC 2, NIST CSF 2.0, NIS2, Cyber Essentials and Essential Eight
- Five fillable forms, policy and procedure starters, leadership sign-off memos, 32 messages and 28 AI prompts with human-review rules
- A 45-minute team briefing, a 14-question LMS-ready knowledge check, a 40-week calendar and a task board
The ISO 27001 Implementation Toolkit · Bodhih Pro Kits · 313 by Bodhih Training, trainers to 2,000+ companies since 2008.
How do you implement ISO 27001?
Score where you stand, agree a business case and scope with leadership, assess and treat risk with fixed criteria, write a Statement of Applicability for all 93 Annex A controls, build controls and evidence, run internal audit and management review, then book an accredited certification body. The ISO 27001 Implementation Toolkit from Bodhih Training gives you every file.
Want the full free guide first? Read How to Implement ISO 27001 Step by Step: A Practical Guide.
You already feel the problem. Here is what it is costing you.
A folder is not a system
Most teams start with policies downloaded from somewhere and a folder called Security. Auditors test owners, decisions and records, not file names.
Nobody can answer 'how long and how much'
Leadership wants a number it can defend. Quotes vary widely and internal time is ignored, so the business case collapses at the first question.
The Statement of Applicability is a guess
93 controls, each needing a reason and evidence. Templates that mark everything implemented create findings, not certificates.
Every customer asks in a different language
SOC 2 checklists, NIS2 questions, Cyber Essentials and Essential Eight. Without one evidence base, every questionnaire is a week of work.
Picture the next few weeks with the kit open beside you.
Imagine the Monday ten days before your Stage 1 audit. You open the ISMS Master Workbook and the Dashboard shows, in numbers and colours, where you stand: maturity up from below 1 to above 2.5, no risks rated High after treatment, three acceptances to chase, 75% of applicable controls implemented and a dated plan for the rest.
As you send the auditor your scope, risk method, Statement of Applicability, internal audit reports and management review minutes, you notice something: every document has an owner, a version and a date, and every claim in the SoA points to evidence you can open in seconds.
When the auditor stops at a desk in week two and asks someone what they do with a suspicious email, the answer comes straight from the 45-minute briefing you ran in May. When a client sends a 180-question questionnaire, you answer it in a day from the same evidence.
Open the Start-here map tonight and give it one hour. Whether you begin with the self-assessment or the business case, you will know your gaps, your first decision and the file to open next.
23 files that do the work for you
The e-book shows you how. The tools make it happen. Here is exactly what you download.
The ISO 27001 Implementation Toolkit (e-book, PDF)
The guide: methods, worked examples, scripts and exercises
Start here: the implementation map
The whole job on one page, your first hour, your first week, the 30-60-90-day plan and the route to certification, with the file to open at each step.
ISMS Master Workbook
22-sheet workbook: settings, maturity self-assessment, gap-to-action plan, context, assets, risk register, treatment plan, 93-control SoA, objectives, metrics, evidence register, suppliers, incidents, internal audit, findings and CAPA, decision log, roadmap, RACI, a dashboard with five charts and traffic lights, What changed log and glossary.
ISMS Business Case Calculator
Cost of doing it vs cost of doing nothing over a three-year cycle: assumptions (all your estimates), internal time, costs, loss scenarios, three-case comparison and a summary with traffic lights and three charts.
Framework Crosswalk and Official Sources
Jurisdiction crosswalk for the US, Canada, UK, EU, Australia and New Zealand (20 instruments), a 16-row framework map (ISO/IEC 27001, SOC 2, NIST CSF 2.0, Cyber Essentials, Essential Eight, NIS2) and an official sources register with quarterly check dates.
ISMS Scope and Context Worksheet
Four pages to agree context, interested parties, scope boundaries, interfaces and exclusions with top management (clauses 4.1 to 4.4).
Risk Assessment Workshop Form
Run a 90-minute risk workshop with one department: criteria reminder, asset and threat prompts, scoring table, treatment choices and owner sign-off.
Supplier Security Assessment
Assess a supplier in proportion to the risk: criticality triage, 20 plain-English questions, assurance check (certificate scope and dates), contract terms and decision.
Security Incident Report and Review
Report, triage, contain, decide on notification and learn from a security event or incident, with a timeline and a lessons-learnt page.
Internal Audit Checklist and Corrective Action
Plan an internal audit, work through 36 evidence questions across clauses 4 to 10 and sampled Annex A themes, grade findings and record corrective action and effectiveness.
Policy and Procedure Starters
A one-page top-level information security policy, 8 topic policy starters and 7 procedure starters in plain English, with placeholders and a policy register.
Leadership Sign-Off and Management Review Pack
Three one-page decision memos (programme sign-off, risk acceptance above appetite, SoA approval) and a management review agenda and minutes template covering every required input.
Email and Message Library
32 ready-to-edit emails, chat messages and tender answers for leadership, staff, risk owners, suppliers, incidents, audits and clients.
Worked example pack: Harbourline Engineering, Auckland
The kit's main files completed for one fictional 220-person engineering consultancy: self-assessment, business case, scope, risk extract, SoA summary, objectives, audit findings, management review and an illustrative Stage 1 and Stage 2.
AI Prompt Pack for ISMS Work
28 tool-agnostic prompts grouped by step of the job, each with what to paste in and what to check, plus six human-review rules.
Team Briefing Session Plan and Answer Key
A 45-minute all-staff security briefing: timed plan, opening script, four scenario cards, a printable answer key for the 14-question knowledge check and an attendance record.
Numbers that matter: ISMS KPI card
Fourteen ISMS numbers with plain-words definitions, the formula, where each lives in the workbook and what to do if it moves.
Correct at November 2026: standards, laws and schemes
The dated sheet: edition and amendment status, transition, accreditation changes and specific dates, thresholds and fees for the UK, EU, US, Canada, Australia and New Zealand, each with its source.
Annex A at a glance: 93 controls
All 93 Annex A control themes in our own paraphrase, grouped organisational, people, physical and technological, with what each theme covers.
Audit-ready decision card
If-then rules for audit moments, how to choose an accredited certification body, ten mistakes to avoid and the route from Stage 1 to a certification decision.
40-week roadmap calendar
51 calendar entries: task starts, milestone checks, monthly metrics reviews and quarterly source checks, starting Monday 11 January 2027 (move them to your own start date).
ISMS task board import (CSV)
25 roadmap tasks with phase, owner, start and due dates, ready to import into Trello, Asana, Planner, Jira or Notion.
Knowledge check (14 questions, LMS-ready)
Scenario-based multiple-choice questions with explanations. Imports into Bodhih LMS or any LMS that accepts question, options A to D, correct and explanation columns.
Chapter by chapter
Each chapter opens with a real situation, gives you a method and ends with something to do today, using the tools in your kit.
- Format
- PDF e-book + XLSX + fillable PDF + DOCX + printable PDF + ICS + CSV
- Files
- 23 files plus a one-click ZIP
- E-book
- 68 pages
- Works with
- Excel, Google Sheets, Apple Numbers, LibreOffice, Word, Google Docs, Acrobat Reader, Google Calendar, Outlook, Apple Calendar, Trello, Asana, Planner, Jira, Notion and any LMS that imports CSV
- Best for
- Organisations of about 20 to 1,000 people implementing ISO/IEC 27001:2022 for the first time or rebuilding their ISMS
- Standards
- ISO/IEC 27001:2022 with Amendment 1:2024. Not affiliated with or endorsed by ISO or IEC
The Standard in Plain Words, and Where You Stand
Clauses 4 to 10 and the four Annex A themes in plain words, and how to score 35 practices from 0 to 4 to find your gaps.
Decide, Scope and Sign Off
An honest three-case business case, context and interested parties, a scope a client would recognise, the policy and leadership sign-off.
Risk Assessment That Holds Up
Criteria first, then assets, threats and specific vulnerabilities, scored the same way every time, with an owner on every risk.
Risk Treatment and the Statement of Applicability
Four treatment options, a dated treatment plan, all 93 Annex A controls with true reasons, and owners accepting residual risk in writing.
Policies, People and Proof
Short controlled documents, competence and awareness that work, a 45-minute team briefing and measurable objectives.
Suppliers, Cloud, Incidents and Continuity
Supplier and cloud security in proportion to risk, incident handling with a notification decision step, and continuity tests.
Checking It Works: Metrics, Internal Audit and Management Review
Monthly metrics with decisions, an internal audit programme with objective auditors, management review and corrective action.
The Certification Audit and the Three-Year Cycle
Choosing an accredited certification body, Stage 1 and Stage 2, grading of findings, surveillance and recertification.
One ISMS, Many Frameworks, and AI in the Work
One ISMS tagged to SOC 2, NIST CSF 2.0, NIS2, Cyber Essentials and Essential Eight, and the rules for using AI in the work.
Not just reading. Tools you will actually open again.
Start here
- 00-Start-Here-ISO-27001-Implementation-Map.pdf: the job in ten steps with the file for each, your first hour, your first week, the 30-60-90-day plan to certification and a 'Brand it in five minutes' box
Workbooks
- ISMS-Master-Workbook.xlsx: 22 sheets: Settings, a 35-practice maturity self-assessment, gap-to-action plan, context, assets, risk register, treatment plan, a 93-control Statement of Applicability, objectives, metrics, evidence register, suppliers, incidents, internal audit programme, findings and CAPA, decision log, 40-week roadmap, RACI, a dashboard with five charts and traffic lights, a What changed log and a UK/US glossary
- ISMS-Business-Case-Calculator.xlsx: cost of doing it vs cost of doing nothing over three years in low, likely and high cases, with every assumption labelled your estimate
- Framework-Crosswalk-and-Official-Sources.xlsx: 20 laws, standards and schemes across the US, Canada, the UK, the EU, Australia and New Zealand, a 16-row framework map and a sources register with quarterly check dates
Fillable forms
- ISMS-Scope-and-Context-Worksheet.pdf (4 pages)
- Risk-Assessment-Workshop-Form.pdf (4 pages)
- Supplier-Security-Assessment.pdf (4 pages)
- Security-Incident-Report-and-Review.pdf (4 pages)
- Internal-Audit-Checklist-and-Corrective-Action.pdf (4 pages, 36 evidence questions)
Word templates
- Policy-and-Procedure-Starters.docx: a one-page top-level policy, 8 topic policy starters, 7 procedure starters and a policy register
- Leadership-Sign-Off-and-Management-Review-Pack.docx: three decision memos and a management review agenda and minutes
- Email-and-Message-Library.docx: 32 emails, chat messages and tender answers
- Worked-Example-Pack-Harbourline-Engineering.docx: the main files completed for one fictional 220-person firm
- AI-Prompt-Pack-for-ISMS-Work.docx: 28 prompts with what to paste in, what to check and six human-review rules
- Team-Briefing-Session-Plan-and-Answer-Key.docx: a 45-minute all-staff briefing with script, scenario cards and the answer key
Cheat sheets
- Numbers-That-Matter-ISMS-KPI-Card.pdf: 14 numbers with formulas and what to do when they move
- Correct-at-November-2026-Standards-Laws-and-Schemes.pdf: the dated sheet of editions, dates, thresholds and fees, each with its source
- Annex-A-at-a-Glance-93-Controls.pdf: all 93 control themes in our own paraphrase
- Audit-Ready-Decision-Card.pdf: if-then rules, choosing a certification body and ten mistakes
Calendar, task board and LMS
- ISMS-40-Week-Roadmap-Calendar.ics: 51 calendar entries
- ISMS-Task-Board-Import.csv: 25 tasks for Trello, Asana, Planner, Jira or Notion
- Knowledge-Check-14-Questions-LMS.csv: 14 scenario questions with explanations, ready for Bodhih LMS or any LMS
E-book
- The ISO 27001 Implementation Toolkit e-book: 9 chapters, 23 figures and a running worked example
When you have worked through it, you will be able to…
Every outcome is practised with a worked example and a tool, not just described.
- Score your ISMS maturity from 0 to 4 across 35 practices and turn every gap into a dated action
- Build a three-case business case leadership can sign
- Write a scope, policy and RACI that satisfy clause 4 and clause 5
- Run risk workshops with criteria that give repeatable results
- Produce a true Statement of Applicability for all 93 Annex A controls
- Keep an evidence register an auditor can sample from
- Run internal audits, management review and corrective action that close the loop
- Choose an accredited certification body and prepare your team for Stage 1 and Stage 2
Know your starting point. Prove your progress.
People who measure before and after improve faster and can show it. AssessAll, our sister assessment platform, has AI-graded assessments that pair with this kit. Take one now, work through the kit, then re-take it.
Workplace Cybersecurity Awareness Assessment for Annual Recertification of All Staff
Take the assessment →AssessAll assessmentThird-Party and Vendor Assurance Assessment for Procurement, Security and Risk Teams
Take the assessment →AssessAll assessmentDecision-Making Under Uncertainty
Take the assessment →JobularyTurn what you learn into a measured development plan (Jobulary)
Make it a growth plan →A taste of Chapter 2
Aroha's three-year cost of doing it came to NZ$557,740, of which NZ$271,700 fell in year 1. Internal time was NZ$307,840 of the total; the cash cost was NZ$249,900. Her likely-case expected loss without an ISMS was NZ$65,950 a year, from four scenarios led by a ransomware outage and invoice fraud. The net over three years was a loss of NZ$76,090 in the low case, a gain of NZ$197,435 in the likely case and NZ$575,510 in the high case. In the likely case, each dollar spent returned about 1.35 in benefit. Aroha showed all three. Daniel's comment was the best thing that happened in the meeting: "I can live with the low case. I can't live with losing the council work." Grace signed memo 1 from the Leadership Sign-Off and Management Review Pack that afternoon.
The honest comparison
| Free templates and typical advice | This kit | |
|---|---|---|
| Where you start | A list of documents to write | A scored 35-practice self-assessment that turns gaps into a dated action plan |
| Business case | None, or a consultant's single number | Three-case calculator with internal time, quotes and loss scenarios, all labelled your estimate |
| Statement of Applicability | 93 rows marked implemented | 93 paraphrased controls with reasons, status, owner, evidence and linked risks, plus a check column |
| Audit readiness | Policies only | Evidence register, internal audit checklist, CAPA log, management review pack and a decision card |
| Other frameworks | Not covered | Crosswalk to SOC 2, NIST CSF 2.0, NIS2, Cyber Essentials, Essential Eight and privacy laws with official sources |
| Compared with a consultant or software | A consultant brings experience and capacity; compliance software brings automation and integrations, both at a recurring cost | You own the method and every file, can run it yourself, and can still hand it to a consultant or load it into software later |
Made for you if…
- IT managers and heads of IT asked to deliver ISO/IEC 27001 certification
- Compliance, risk and information security leads in small and mid-size organisations
- Operations directors and founders of professional services, engineering, technology and managed service firms
- ISMS leads restarting a stalled programme or preparing for surveillance audits
- Consultants and internal auditors who want a structured, editable toolkit for client work (consultant licence)
- Teams in the US, Canada, the UK, the EU, Australia and New Zealand that also face SOC 2, NIS2, Cyber Essentials or Essential Eight questions
Probably not for you if…
- Anyone looking for the text of the standard: buy ISO/IEC 27001 from ISO or your national standards body
- Organisations that want an audit, an attestation or a certificate from us: we train and equip, we do not certify
- Anyone needing legal advice on whether a law applies to them
- Very small firms that only need basic controls (see Information Security for Small Business)
Built by trainers, tested in real rooms.
Bodhih Training has designed and delivered corporate programmes since 2008. Bodhih Pro Kits package what works in those workshops into a guide plus the exact tools we use, so you can apply it the same day without a facilitator in the room.
From here to using it in three steps
- STEP 1
Tap Get the kit
Name, email and country. UPI, card or netbanking in India; international cards everywhere else. No account to create.
- STEP 2
Download instantly
Your download page opens at once, with every file and a one-click ZIP. A permanent link lands in your inbox too.
- STEP 3
Open the first tool
Start with the quick-start chapter, then the main spreadsheet or planner. Most buyers use something from the kit the same day.
Your ISMS, built in one place and ready to show
Open the Start-here map and give it one hour. Whether you start with the self-assessment tonight or the business case at your next leadership meeting, you will know your gaps and your next step.
Personal licence for the buyer's own use, including use within your own organisation with your team and risk owners. Please don't share or resell the files. Team, company, multi-site and consultant licences: solutions@bodhih.com.
What buyers say
No ratings yet. Only people who have bought this kit can rate it - every buyer gets a one-click rating link a couple of days after their purchase.
The Bodhih family, when you are ready for more
The Digital Accessibility Compliance Kit
Make websites, apps, documents and digital products accessible and manage the legal risk.
The Pay Transparency Readiness Kit
Prepare an employer for pay transparency laws and do it well.
The SOC 2 Readiness Kit for Startups
Take a SaaS or service startup from zero to ready for its first SOC 2 Type I and then Type.
AssessAll
250+ AI-graded assessments to measure skills and earn verified credentials.
Jobulary
Individual development plans that start from evidence and stay yours.
Bodhih Training
Run this topic as a live workshop for your team, in person or online.
Pewple
Book a vetted coach for career, leadership or communication. Pay per session.
Bodhih.org pathways
Certification pathways in Applied AI, Workplace English and management.
The ISO 27001 Implementation Toolkit: FAQs
Read the free guideAlready bought? Resend my linkWhat exactly is in the kit?
An e-book of 9 chapters and 22 working files: three workbooks (including a 22-sheet ISMS Master Workbook with a 93-control Statement of Applicability), five fillable forms, six Word templates, four cheat sheets, a start-here map, a 40-week calendar, a task board and an LMS-ready knowledge check. Every file follows one worked example so you can see what complete looks like.
Do I need to buy the ISO/IEC 27001 standard as well?
Yes. ISO/IEC 27001:2022 and the guidance standard ISO/IEC 27002 are copyrighted, and you should buy them from ISO or your national standards body. The kit paraphrases the clauses and the 93 Annex A controls in its own words and covers the 2024 climate amendment. It is not affiliated with or endorsed by ISO or IEC.
Can I implement ISO 27001 without a consultant?
Many small and mid-size organisations do, especially with a capable ISMS lead and leadership support. The kit gives you the method, the templates and a worked example. Some teams still buy a short independent gap review or a contract internal auditor, and the business case calculator lets you price that option.
How long does ISO 27001 certification take?
It depends on your starting point, scope and resources. The kit's sample plan runs 40 weeks from kick-off to the Stage 2 audit for a 220-person firm starting almost from scratch. Score the self-assessment first: your gaps tell you more about your timeline than any rule of thumb.
How much does ISO 27001 certification cost?
Costs include internal time, the standard, training, tools, testing, any outside help and the certification audits. Certification bodies quote from your scope, headcount and sites. The calculator builds your own three-year figure; in the sample, internal time was the biggest single line.
Is ISO 27001 required by law in the UK, the US or the EU?
ISO/IEC 27001 certification is voluntary. Laws such as NIS2 national laws, GDPR and UK GDPR, and sector rules require appropriate security, and clients often require certification in contracts. The crosswalk workbook maps where an ISMS helps; whether a law applies to you is a question for your adviser.
Does it work in my country?
The method is international because the standard is. The crosswalk covers the US, Canada, the UK, the EU, Australia and New Zealand with official links, and the dated sheet holds country specifics correct at November 2026. Laws need local checking with your adviser.
Can I use this with my team?
Yes, within your own organisation under the personal licence: share the workbooks, forms and briefing with your team and risk owners. Company-wide, multi-site and consultant licences are available from solutions@bodhih.com.
Do I need ISO 27001 or SOC 2, or both?
It depends on your buyers. SOC 2 is an attestation report by a CPA firm, common with US customers; ISO/IEC 27001 is an international certificate. One ISMS can provide most of the evidence for both, and the framework map shows where they overlap. The SOC 2 Readiness Kit for Startups goes deeper on SOC 2.
Will this kit get us certified?
No kit can promise that. Certification is the certification body's decision, based on your evidence at Stage 1 and Stage 2. The kit helps you build an ISMS that works and evidence an auditor can follow, and it is not an audit, a certification or legal advice.
How can I measure my team's starting point?
Score the 35 practices in the Self-assessment sheet first. To check people as well as processes, AssessAll offers the Workplace Cybersecurity Awareness Assessment for Annual Recertification of All Staff, the Third-Party and Vendor Assurance Assessment for Procurement, Security and Risk Teams and the Decision-Making Under Uncertainty assessments at assessall.com.
How do I turn this into a development plan for myself?
Running an ISMS is a strong career skill. Pick two competences from the competence matrix you build in chapter 5 and turn them into a measured individual development plan with Jobulary's guide at jobulary.com.
How much does The ISO 27001 Implementation Toolkit cost?
₹1,999 including 18% GST for buyers in India, or $49 for buyers outside India. One-time payment, no subscription, with an automatic invoice.
How do I get the files after paying?
Instantly. Your download page opens the moment payment succeeds, and a permanent download link is emailed to you. Download each file separately or everything in one ZIP.
What software do I need?
Any of the usual tools: Excel or Google Sheets for spreadsheets, Word or Google Docs for templates, Adobe Acrobat Reader, Preview, Xodo or GoodNotes for the fillable PDFs, and Google, Outlook or Apple Calendar for the calendar plan.
Can I get a refund?
Because it is a digital download, kits are not refundable once downloaded. We always refund a duplicate charge or a failed delivery, and if a file is corrupted and we cannot fix it within 3 working days. Full terms: bodhih.org/refunds.
Can my company buy this for a team?
Yes. Team and company licences, and workshops on this topic run by Bodhih Training, are available. Write to solutions@bodhih.com or call +91 99000 11601.
