Professional ISMS documentation, ready to adapt
Editable templates and tools to implement and manage an information security management system based on ISO/IEC 27001:2022. In Word and Excel, with no macros.
Buy the toolkit · US$59Secure payment and instant download on Payhip.
⬇ Download the free sample: risk matrix in Excel
- 43 Word documents
- 35 Excel tools
- 22 topic-specific policies
- 16 completed examples
What's inside
Start here
Customization guide, phased implementation guide and a master index with links to every file.
Context and scope
Context analysis, interested parties, legal requirements, ISMS scope and process map.
Risk
Risk methodology, risk matrix with heat map, treatment plan and Statement of Applicability.
Policies
A general information security policy and 22 topic-specific policies with roles, verifiable rules and monitoring records.
Operation and evidence
Evidence register with a progress dashboard, incidents, suppliers, objectives and metrics.
Audit and improvement
Internal audit program, checklist and report, management review minutes and nonconformity register.
ISO 27001 and ISMS guides
ISO 27001:2022 mandatory documents: list by clause
The documented information ISO/IEC 27001:2022 requires, clause by clause (scope, policy, risk, SoA, objectives, internal audit, management review), plus the documents commonly expected for Annex A controls.
ISO 27001 risk assessment template: what it must include and how to use it
What ISO/IEC 27001:2022 requires for risk assessment, the columns an ISMS risk register needs, and how to calculate risk levels. Includes a free Excel sample.
ISO 27001 Statement of Applicability (SoA): what it is and how to write it
What the ISO/IEC 27001:2022 Statement of Applicability must contain for the 93 Annex A controls, how to justify exclusions and the mistakes auditors find most. With an Excel template.
What is an ISMS and how do you implement it with ISO 27001?
What an information security management system (ISMS) is, what ISO/IEC 27001:2022 requires, which documents you need and how certification works.
More NexoDocs products
AI literacy course for staff
A ready-to-use AI literacy course for staff: 6 video modules with subtitles, editable presentations, guides and an auto-graded final assessment. Supports EU AI Act Article 4 and ISO/IEC 42001 clauses 7.2 and 7.3.
Document your ISMS and train your staff
The 84-file Word and Excel toolkit to document your ISO/IEC 27001:2022 ISMS and the awareness course to train your staff, together for US$89.
Document your AI management system and train your staff
The 67-file Word and Excel toolkit to document your ISO/IEC 42001 AI management system and the AI literacy course to train your staff, together for US$89.
ISO 42001 Toolkit: documentation for your AI management system
61 Word and Excel templates to implement ISO/IEC 42001:2023: AI policy, AI system impact assessment, AI risk register, Statement of Applicability for the 38 controls and an EU AI Act crosswalk.
Information security awareness course
A ready-to-use course to train your staff: 6 video modules with subtitles, editable presentations, guides and an auto-graded final assessment. Evidence for ISO/IEC 27001 clauses 7.2 and 7.3.
Try before you buy
Download a reduced version of the toolkit's risk matrix for free (Excel, 10 scenarios, heat map). See how it calculates risk level and category before you decide.
Get the free sampleHow it works
Download and unzip
One ZIP file with numbered folders that follow the ISMS cycle.
Customize once
Set your organization's name, logo and details; global fields and a CONFIGURATION sheet guide you.
Adapt to your reality
Complete the templates with your context, risks and decisions. The NubeSur examples show the expected level of detail.
Run and improve
Use the Excel tools to track risks, evidence, metrics and audits.
Who it is for
- ISMS managers and information security officers
- Consultants who support ISO/IEC 27001 projects
- IT, compliance and risk teams in small and medium organizations
- Organizations preparing their first ISMS
What it is not
Available editions
The toolkit is available in English, Spanish, German, French, Italian and Brazilian Portuguese. Each edition is a separate purchase.
Frequently asked questions
Does the toolkit guarantee ISO/IEC 27001 certification?
No. Certification depends on how the ISMS is actually implemented and on the assessment by the certification body.
Which version of the standard does it cover?
ISO/IEC 27001:2022 and its Amendment 1:2024 (climate action changes).
What software do I need?
A program that opens Word (.docx) and Excel (.xlsx) files. The files contain no macros or add-ins. The publisher tested the files in Microsoft Word and Excel and in LibreOffice; Google Docs and Google Sheets have not been tested.
How many organizations does the license cover?
One organization, including its departments and sites, with no limit on internal users. External consultants may use it only to work on your organization's ISMS.
How long does it take?
Initial customization takes about 2 to 3 hours, as an estimate. Implementing an ISMS usually takes several months depending on your starting point.
How were the translated editions produced?
The German, French, Italian and Brazilian Portuguese editions were produced with substantial AI assistance and several layers of AI-assisted linguistic quality control. Every file was opened and recalculated without errors in Microsoft Word and Excel 16 (Windows). They have not been reviewed by a human native speaker.
Updates and new editions
The toolkit is on sale now. Leave your email to hear about updates, new editions and related NexoDocs products.