Managing ISO 27001 in Excel is not a strategy. It’s the next problem.
Organizations that fail certification don’t do so for lack of willingness, they fail for lack of a system.
Drive folders with files named v1_final_definitive, controls in spreadsheets with no history, evidence nobody knows where to find.
Skuld GRC is the platform we designed so that ISO 27001 implementation is a real process, not a document collection.
One implementation, fifteen standards and frameworks on the same foundation
Most of the work behind a management system serves more than one standard. Skuld GRC is built on that idea: ISO 27001 is implemented once, and from that backbone fifteen standards and frameworks are derived or assessed, without redoing the analysis or duplicating the evidence.
The backbone
ISO/IEC 27001 in both its 2022 and 2013 versions, with the 93 Annex A controls, their ISO 27002:2022 attributes and the criticality defined per client. Everything else hangs from here.
Assessable annexes
ISO 27017 (cloud services), 27018 (personal data in the cloud), 27701 (privacy management) and 42001 (artificial intelligence systems), each with its own statement of applicability. ISO 22301 is assessed clause by clause for business continuity.
Applied methodologies
ISO 27005 for risk management, 23894 for artificial intelligence risk, 27035 for incidents, 27032 for cybersecurity and 27036 for supplier relationships. ISO 27002 remains the implementation guidance for each control.
Derived coverage
Progress on Annex A automatically translates into CIS Controls v8 and NIST CSF 2.0 coverage. Useful for answering a client or head-office questionnaire without surveying anything again.
Everything a real ISMS needs, in one place
Eight interconnected modules covering the complete cycle of ISO 27001 implementation, maintenance, and audit management.
Asset inventory
Registration and classification of information assets by criticality, owner, and type. The foundation without which any risk analysis is just an estimate.
Risk analysis
Threat identification and scoring by likelihood and impact, with inherent and residual risk on the same matrix. Every risk carries its treatment, its owner and its date, and those still above the acceptance threshold are escalated for formal acceptance by management, as clause 6.1.3 requires.
ISO 27001 Controls
Complete management of Annex A with per-control criticality and ISO 27002:2022 attributes, implementation status, evidence attached to each one, and real-time overall compliance level.
Internal audits
Planning, findings, non-conformities, and corrective actions with follow-up until closure. Complete history for the external auditor.
Document management
Centralized repository for policies, procedures, and records required by the standard. Built-in version control and approvals.
Executive dashboard
Real-time compliance metrics. PDF export for presenting to the board, regulators, or the certification auditor.
Global dashboard
Unified view across the entire client portfolio: average ISO compliance, critical and high risks, and action progress by client. One screen to monitor the status of every engagement.
Audit requirements
Track auditing bodies per client (national cybersecurity authority, internal audit, external or private auditors) with requirements, received date, response deadline, and official response on record. Automatic overdue alerts.
Statement of applicability
The SoA the auditor asks for first, generated from the actual state of the controls. Every exclusion carries its written justification, and each assessable standard keeps its own.
Gap analysis and maturity
Initial assessment with CMM maturity from 0 to 5 per control, a heat map crossing criticality against maturity, and gaps ranked by priority. It is the picture the plan is built from and the baseline progress is measured against. Exportable to PDF.
Standards library
A reference library of the fifteen standards and frameworks, inside the system. Consultants and internal staff read the requirement in the same place where they have to meet it, without going elsewhere for the text.
Policies and procedures
Drafting and lifecycle of the information security policy and the body of procedures, with review states, a competence matrix by area and export to PDF or Word. The document submitted for formal approval comes from here.
This is not a staged demo. It is the system at work.
Twenty-five seconds of an actual walkthrough: the fifteen assessable standards, the risk matrix with its residual values, the statement of applicability, and CIS Controls and NIST CSF coverage calculating itself.
Click here and request a live demo with our team. We walk you through the whole system, module by module, with your own scenario on the table, answering anything you want to ask.
Each year opens its own cycle and closes the previous one, with what was done and when. That continuity is what carries you through surveillance audits, which is where most implementations fall apart.
The same matrix shows what the risk was worth and what it is worth once treatment is applied. Anything left above the threshold is escalated for formal acceptance, with a name and a role attached, as clause 6.1.3 requires.
It comes from the actual status of all 93 controls, with a written justification for every exclusion. It is the first document an auditor asks for, and the one that eats the most time when it is built by hand.
The memo, minutes, or resolution approving each item is recorded with its number and date. Without that, a document approved in practice cannot be relied on in an audit.
Every control carries its file where it belongs. When the auditor arrives there is nothing to go and collect, which is the week nobody budgets for.
Progress on Annex A translates by itself into CIS Controls v8 and NIST CSF 2.0 coverage. Enough to answer a client or head-office questionnaire without reassessing anything.
From zero to certification with the system that goes with you
Onboarding in hours
Your organization loaded, users configured, and roles assigned from day one of consulting. No weeks of setup, no complex integrations.
Real collaborative work
AllSafe consultants, internal stakeholders, and management working on the same platform with differentiated roles. Each person sees what they need to see.
Always traceable evidence
Every documented control, every treated risk, every recorded audit, with complete history, assigned responsible, and date. Nothing gets lost.
Stress-free audit
When the auditor arrives, everything is organized, traceable, and exportable. Every requirement with its received date, agreed deadline, and official response on record, nothing to search for.
Licensed on its own, or together with the implementation
Skuld GRC is an AllSafe product and is licensed as such. If your organization has its own security, quality or compliance team, it takes the platform and runs it with its own people and its own timeline.
If you also want the engagement, our consultants work inside the same system during implementation and certification, alongside your team and with separate roles. In both arrangements the system stays up and running well after the certificate.
Built for real ISO 27001. Not adapted from something else.
It’s not an ERP with a compliance module. It’s not a spreadsheet with macros. It’s a platform designed specifically for this process.
Eliminates document chaos
Goodbye to shared folders with files named v1_final_v2_OK_definitive. A single source of truth for the entire organization.
Traceability for auditors
Every decision recorded, every piece of evidence linked to its control. The auditor finds in minutes what used to take days to prepare.
Consultants inside the system
If you take the engagement, the AllSafe team works inside the same system, loading controls, reviewing risks and preparing the audit. There is no separate tool for us and another one for you.
The system continues after certification
Certification is the beginning, not the end. Skuld GRC lets you maintain and improve your management system without starting from scratch every year.
Request Skuld GRC demo
We show the platform running on a real case, and we work out which of the two arrangements fits your organization.