The kit
109 rows, five values, one dated plan
The kit is the record as a working document: every control, every published attribute value, the evidence an auditor asks for, the gaps commonly found, an owner and a due date. It is built from the same record as the site and exported in three formats.
What arrives
- The attribute register. 93 controls and 16 structural units, with control type, information security properties, cybersecurity concepts, operational capability and security domain, plus a column for your own value and the reason it differs from Table A.1.
- The evidence list. 550 records an auditor asks for, by control and category, with an owner and a status column.
- The dated plan. The milestones from today to the publication window and to your next audit, with the evidence to keep at each one.
- The extension worksheet. A method for defining an attribute of your own, with the value list, the owner and the review date, labelled as our method rather than the standard's list.
- The internal audit checklist. The attribute questions and the rows to sample, ready to add to the programme.
- The change statement. A one-page record of the decision to adopt, defer or decline the attribute view, with the owner and the date.
| Column | What it holds |
|---|---|
| Your value | A local value where it differs from the published one. |
| Why it differs | The reason for the difference, in the same row. |
| Evidence to keep | The record an auditor asks for. |
| Owner, Due, Status | The working columns that make it a register. |
Five labelled rows before you buy
The specimen is the first five rows of the register and the first rows of the evidence list, labelled as a specimen. It is free, has no account gate and downloads as a PDF and a CSV. Check the column order and the source line against the control pages before you decide.
USD 799, one off
No subscription, no seat price and no renewal. After the standard publishes, the register is reissued against the published text and sent to kit buyers at no extra charge. The change watch is separate and optional.
Buy the kit, USD 799 See both prices
One click to checkout. Your account is created from the email you give at Stripe.
What the kit does not do
It does not reproduce the ISO text, it does not certify and it is not legal advice. It does not decide your Statement of Applicability for you. It does not promise that an auditor will accept a value; that is the auditor's judgement, and the kit gives you the source line and the evidence to hold the conversation.