ISO 27001 Documentation Pack: Everything You Need for ISMS Certification
The ISO 27001 documentation pack from ISO Gorilla gives you a ready-written ISMS manual, information security policies, procedures, SOPs and forms, built for ISO/IEC 27001:2022, so you can prepare for your certification audit in weeks and skip the consultant's drafting fees.
- 120 editable MS Word and Excel documents
- Built for the current ISO/IEC 27001:2022 edition
- Instant download, questions answered within 24 hours
What is an ISO 27001 documentation pack?
An ISO 27001 documentation pack is a ready-made set of editable documents that covers what an information security management system (ISMS) needs on paper: an ISMS manual, information security policies, procedures, SOPs, process flowcharts and record forms. It is also called an ISO 27001 documentation toolkit. You add your company details and adapt each document to how you work, instead of writing every page yourself. New to the standard? Start with our guide to ISO 27001 templates.
The ISO 27001 documentation pack from ISO Gorilla contains 120 editable documents: a 14-file information security manual, 23 information security policies, 19 procedures, 9 SOPs, 6 process flowcharts and 45+ forms and formats, including a Statement of Applicability. It is built for ISO/IEC 27001:2022 and costs $499 as a one-time download.
What's inside the ISO 27001 documentation pack
Every document is editable, so you can change the wording, branding and processes. Here is the contents, as listed on the product page.
Information security manual files
10 chapters and 3 annexures explaining how each clause of the standard is met.
Information security policies
Ready-written policies to adapt, covering the rules your people follow.
Procedures
Information security and ISMS procedures, from risk management to audit and review.
SOPs
Standard operating procedures that turn policy into day-to-day practice.
Process flowcharts
Visual process maps you can edit for your own organization.
Forms and formats
Record templates that give your auditor evidence the system is running.
Statement of Applicability
A form to record which Annex A controls apply to you and why.
Risk and asset templates
Risk assessment and asset identification forms in Word and Excel.
Audit checklist report
A form to record and report your internal ISMS audit.
Skip months of drafting
Download the complete ISO 27001 documentation pack today and start customizing this afternoon.
Which documents does the ISO 27001 documentation pack cover?
ISO 27001 requires "documented information": some you maintain as documents and some you retain as evidence. Certification auditors will ask to see the following.
Documents to maintain
Scope of the ISMS
Information security policy
Risk assessment and risk treatment process
Statement of Applicability
Information security objectives
Records to retain
Competence and training evidence
Risk assessment and treatment results
Monitoring and measurement results
Internal audit programme and results
Management review results
Nonconformities and corrective actions
ISO 27001 documentation pack vs free templates vs a consultant
Free templates are a start, and a consultant is a full service. The pack sits between them: complete documents for a one-time price, with your team in control.
| Free templates | Consultant | ISO Gorilla pack | |
|---|---|---|---|
| Cost | Free | Often thousands in fees | $499 one-time |
| Edition | Often the 2013 version | Depends on consultant | Built for ISO/IEC 27001:2022 |
| Coverage | Single documents | Full service | 120 documents, manual to forms |
| Ownership | Yours, but unconnected | Know-how often leaves with them | Your team learns and owns the system |
| Support | None | Billed by the hour | Questions answered within 24 hours |
How to get ISO 27001 certified with the pack
Download the pack
Buy once and download the Word and Excel files straight after checkout.
Define scope and assess risk
Decide what the ISMS covers, list your assets and rate the risks. This decides which Annex A controls apply.
Customize and implement
Add your company details, adapt policies and procedures, train staff and keep the records.
Audit and certify
Run an internal audit and management review, then book the Stage 1 and Stage 2 audits with an accredited body.
Who needs an ISO 27001 documentation pack?
SaaS and IT companies
Enterprise customers ask for an ISO 27001 certificate before they sign. The pack gets your documentation ready without a long consulting project.
Managed service and data processing providers
Show clients and regulators that you protect the information you handle.
Security and compliance managers
You own the project and want a proven structure to adapt rather than a blank page.
Consultants and auditors
Serve more clients faster from one consistent document base.
ISO 27001:2013 is no longer accepted
The transition to ISO/IEC 27001:2022 ended on 31 October 2025, so certificates are now issued against the 2022 edition, whose Annex A has 93 controls. Read the official overview on the ISO website. Our pack is built for the 2022 edition, so you don't rework documents before your audit.
Keep building your management system
Most security teams add business continuity or IT service management next. These kits share the same structure, so your documents fit together.
ISO 27001 documentation pack: frequently asked questions
What is included in the ISO 27001 documentation pack?
The pack contains 120 editable documents: a 14-file information security manual, 23 information security policies, 19 procedures, 9 SOPs, 6 process flowcharts and 45+ forms and formats, including a Statement of Applicability, risk assessment and asset templates, and an audit checklist report.
Is an ISO 27001 documentation pack the same as a toolkit?
Yes. "Pack", "toolkit" and "kit" all describe the same thing: a ready-made set of editable ISMS documents. Our product page lists it as the ISO 27001:2022 Documentation Toolkit.
Can I get ISO 27001 certified without a consultant?
Yes. ISO 27001 does not require a consultant. Many organizations build their ISMS in-house with a documentation pack and then pass the audit carried out by an accredited certification body.
Does the pack guarantee certification?
No pack can guarantee certification, because the auditor assesses how well you run the ISMS, not only your documents. The pack removes the biggest workload, which is writing the documentation.
Is the pack updated for ISO/IEC 27001:2022?
Yes. The product is listed as the ISO 27001:2022 Documentation Toolkit and is built for the 2022 edition, the only edition now used for new certificates.
What format are the documents in?
All documents are editable MS Word and Excel files, so you can change the company name, logo, processes and wording.
Can I get a refund?
Because the pack is a digital download, all sales are final except in the limited cases described in the refund policy. If you are unsure whether it fits your needs, contact us before you buy and we'll help you choose.
Get the ISO 27001 documentation pack today
Join 600+ organizations in 109 countries that built their management systems with ISO Gorilla. One-time price, instant download, editable Word and Excel files.
- Instant digital download
- Questions answered within 24 hours
Build your ISO knowledge with globally recognised training
Develop practical ISO knowledge through self-paced training designed for professionals, auditors and organisations looking to strengthen their understanding of international management standards.
Training is delivered through our recommended training provider, Itmad Academy. Choose from ISO courses covering quality, environmental, occupational health & safety, information security and other management standards.
Use this code at checkout
Browse all courses →Redeem this code at itmadacademy.com. Itmad Academy is an independent training provider. ISO Gorilla may earn a commission on qualifying purchases made through this link.