Lists the reference controls (ISO/IEC 27001 Annex A) and your own controls with their owner, implementation status (from a selected questionnaire or assessment, or stated by you), the evidence expected and the date of their next review. The register other services read for gaps, the SoA and evidence.
The reference controls, grouped by theme, plus the controls specific to your organisation.
2
Owner and status
Who is responsible for each control and where it stands today.
3
Evidence and review
What an auditor will look for, and when each control is reviewed next.
What you provide
How the controls are assessed
Controls not applicable — Annex A references, e.g. “8.25”, with the reason in the notes.
Controls in place — Only needed if you do not select a compliance questionnaire as a source. Annex A references, e.g. “5.15”, “8.5”.
Controls partly in place — Only needed if you do not select a compliance questionnaire as a source. Annex A references, e.g. “5.15”, “8.5”.
Controls not in place — Only needed if you do not select a compliance questionnaire as a source. Annex A references, e.g. “5.15”, “8.5”.
Your own controls — Controls of your organisation outside the reference list, one row each, e.g. Weekly firewall rule review; Network lead; in place
Review of each control
Roles and owners — Who is responsible for which area. Owners in the deliverable are taken from here; where no role covers an area, the owner is left for you to fill.
Additional context — Anything the service should take into account.
Title — As it will appear on the deliverable.
Author — Shown as the author of the deliverable; never filled in by the AI.
