Start with the job, not the feature list
ISO 27001 software should make a real implementation task easier to see, own and review. Before comparing products, write down the work that currently creates the most coordination: identifying gaps, finding evidence, assigning actions, preparing for an audit or following findings through to closure.
Then ask each supplier to demonstrate that task with realistic data. For example, take one assessment gap and follow it to an assigned action. Can you see the rationale, owner, due date, supporting evidence and review outcome without reconstructing the story across separate files? That walkthrough is more useful than a long feature checklist.
Five jobs small ISO 27001 teams need to coordinate
1. Find what is missing
Record an assessment answer, its rationale and the evidence reviewed. A score alone does not tell the team what to do next. Use the free readiness checker if you first need a high-level baseline.
2. Organise evidence
Connect a policy, approval, ticket or operating record to the work it supports. Check how the tool handles ownership, review and reuse instead of treating every uploaded file as equally useful.
3. Turn gaps into actions
Give each action an owner, due date and clear completion test. The team should be able to distinguish work that is merely marked complete from work that has been reviewed.
4. Prepare for audit
Bring assessment decisions, evidence and follow-up work together so reviewers can trace why a status was reached. The gap analysis guide explains the underlying review process.
5. Follow findings through closure
Record the finding, resulting action, evidence of completion and review decision. Closure should preserve the decision trail rather than hide it behind a changed status.
Worked example: a three-person team choosing its operating model
Fictional scenario. A small software company has an IT manager leading ISO 27001, a security analyst collecting evidence and an operations lead approving priorities. The team already has a gap spreadsheet and shared folders. The spreadsheet lists 47 actions, but several have no owner, evidence links point to superseded files and completed rows do not show who reviewed closure.
The team selects one live example for its product demonstrations: quarterly privileged-access review. It asks each option to show how it would record the gap, identify the scoped systems, assign the review, connect the completed access-review record and preserve the closure decision.
| Question | What the team needs to see | Why it matters |
|---|---|---|
| What is missing? | The current state, expected outcome and evidence gap are recorded together. | The owner receives an actionable problem rather than a vague red status. |
| Who owns the work? | A named owner and due date are visible to the team. | Assessment results become managed implementation work. |
| Which evidence supports closure? | The completed review record can be found from the action and checked for scope and period. | A file link alone does not show that the right population was reviewed. |
| Who reviewed the result? | The review decision, date and any follow-up are retained. | The team can explain why the item was closed or reopened. |
The result may be a better-structured spreadsheet, a document toolkit or a platform. The important point is to compare the whole workflow using the same example.
Spreadsheet, document toolkit or working platform?
| Approach | Usually fits when | Watch for |
|---|---|---|
| Spreadsheet and shared folders | The scope is small, relationships are simple and one person can maintain the register consistently. | Manual links, version control, unclear review decisions and reporting work as the programme grows. |
| Word/Excel toolkit | The team mainly needs starting documents and registers it can tailor to its organisation. | Templates still need owners, decisions, operating records and review. Check update and reuse rights. |
| Working platform | The team wants assessment, evidence, assigned actions and audit follow-up connected in one workflow. | Confirm that the workflow matches the way the team works and that administration is proportionate. |
| Hosted platform | The team prefers a vendor-operated service and is comfortable with its hosting, subscription and data arrangements. | Review access, data handling, exit, integration and recurring-cost terms for the specific product. |
A spreadsheet is not automatically the wrong answer, and a platform is not automatically the right one. Choose the simplest approach that lets the team preserve ownership, evidence and review decisions without creating a second administrative problem.
Questions to answer before you buy
Can the tool complete your real workflow?
Use a representative gap, not a polished supplier example. Walk from assessment through evidence, ownership and review. If you cannot explain the result after the demonstration, the workflow may not fit your team.
Who will operate it?
Identify the product owner, everyday users and technical administrator. For customer-managed software, confirm supported systems, access arrangements, backups, updates and network requirements. Review the AuditPrepared installation requirements for the current platform setup.
What does the licence cover?
Record the price, taxes, permitted installations or users, client-use rights, included support and update terms. Keep confirmed costs separate from internal estimates.
Can you recover and leave cleanly?
Understand backup, recovery, export and licence-transfer options. If important records only exist in one tool, the team needs a practical continuity plan for that tool.
What will still be manual?
Clarify which integrations, reminders, tests and reports actually exist. A clear manual step may be acceptable; an assumed automated step is a future control gap.
One-time purchase versus subscription
Compare the commercial model with the full operating model. Include internal administration, infrastructure, support and update terms rather than treating licence price as the total cost.
The AuditPrepared ISO 27001 Platform is listed at $220 USD once for one active installation, with Windows and Linux packages. Internet is required for activation and ongoing licence checks. Review the published price and licence details.
A seven-step demonstration checklist
- Open an assessment and inspect the questions and guidance.
- Record a gap and explain why the current answer needs improvement.
- Connect supporting evidence and find it again from the assessment or action.
- Assign follow-up work with an owner and due date.
- Record the completion evidence and review decision.
- Inspect how audit findings and further actions stay connected.
- Review the actual installation, licence, support, update and recovery conditions.
Keep the same test case for every candidate. That gives the team a comparable decision record instead of four unrelated sales demonstrations.