ISO/IEC 27001 is the global standard for information security, and the auditor comes back every year. Thiqa’s agent maps the controls, collects the evidence and keeps you certified.
A blank spreadsheet is a slow start. The agent reads the standard clause by clause and matches each control to your systems, owners and documents, so you begin with a gap list.
93
Annex A controls in ISO/IEC 27001:2022, in four themes. Each one gets an owner in Thiqa.
Evidence gathered by hand goes stale. Connect your cloud, identity and code tools and the agent collects on schedule. On-premise, the Thiqa Collector keeps your data where it is.
Clause 9
asks you to monitor, measure and audit the ISMS. With evidence always current, no audit starts from zero.
Risks change faster than policies. The agent drafts your ISMS policies and Statement of Applicability, links each to its controls and risks, and flags what to update. Nothing is published until you approve it.
Clauses 4–10
the mandatory ISMS requirements, each tracked with its policy, risk and evidence.
Read the new CBE requirements, pull out every obligation and route it to the controls it applies to.
Stop proving controls twice. Each counts for every framework that shares it, and Thiqa shows the overlap up front.
Updated every time a control decision changes.
Score each risk and link it to its controls.
Plan audits and track every finding to closure.
Log nonconformities and keep proof of each fix.
Scheduled reviews, recorded for your auditor.
Shared controls, separate scopes and certificates.
The international standard for an information security management system (ISMS). It sets out how to find your security risks, choose controls to treat them and keep improving. An accredited certification body certifies you after an external audit, and the certificate is recognised worldwide.
Two stages. Stage 1 reviews your ISMS documents and scope. Stage 2 checks that your controls work in practice. After certification, a surveillance audit follows every year and a full recertification audit every three years.
No. Only an accredited certification body can certify you. Thiqa gets you ready: it maps controls, collects evidence, drafts policies and tracks risks, then gives your auditor organised, read-only access to all of it.
No. Your data is never used to train models, and the agent works inside a secure sandbox. Every policy, risk decision and piece of evidence waits for someone on your team to approve it.
Yes. Thiqa maps each control once and shows where it also counts for PCI DSS and other frameworks, so the evidence and policies you have carry into the next certification instead of being rebuilt.
