ISO 27001

Start with ISO 27001, make the work actionable

Bring your scope, risks and controls together. Assign the work and collect the evidence your ISMS needs, with room to add ISO 42001 later.

See the approach

Hosted in the Netherlands. Your data stays in the EU.

In brief

Scope: Defined up frontOrganisation, services and systems
Risks: Linked to controlsWith an owner for every control
Work: Tasks and checksIncluding the evidence you expect
Certificate: IndependentA certification body decides

01 / Approach

From setup
to execution

A practical approach for your first ISO 27001 management system. Each step builds on the one before.

Four steps

01Define your scope
Establish which parts of your organisation, services and systems are in scope.
02Assess risks and controls
Connect your risk assessment to suitable controls and responsibilities.
03Assign the work
Create tasks, schedule checks and define the evidence you expect.
04Show that it works
Use execution records, reviews and improvement actions as evidence for your audit.

02 / One control library

A foundation
you can build on

Shared processes can be linked to multiple standards, such as ISO 42001 later on. Check for each standard that scope, content and evidence are suitable.

Example mapping4 standards

See where each control counts. And where it does not

Control	ISO 42001	ISO 27001	NIS2	GDPR
Risk assessment
Supplier management
Documented information
Internal audit & management review
Access control
AI impact assessment

Check per organisation whether the control and evidence are adequate. According to Basenorm’s published mapping, ISO 27001 and NIS2 share 70 to 80% of their controls, so the next standard starts mostly complete.

Also availableEU AI Act · DORA · SOC 2 · ISO 9001 · ISAE 3402 · PCI DSS · HIPAA · BIO · All Frameworks

03 / Next steps

Where to go next

ISO 27001 in Basenorm

Clauses, Annex A controls and how they work in the platform.

Add ISO 42001

Build your AI management system on the ISMS you set up.

Combine multiple standards

Add NIS2, DORA or SOC 2 on the same control library.

04 / Questions

Questions about
starting with ISO 27001

Do we need ISO 27001 before ISO 42001?

No. You can start with ISO 42001 without an ISO 27001 certificate. If you already have a management system, you can reuse suitable processes and evidence. Assess what your AI scope requires for each part.

What does AI do, and what do we review ourselves?

AI helps identify and pre-check evidence. Agents and integrations can carry out tasks within the available permissions and configured workflow. You define who reviews results and which decisions need approval.

Does Basenorm issue our certificate?

No. Basenorm supports setting up and evidencing your management system. An independent certification body conducts the certification audit and decides whether to issue a certificate.

Start with your own question

Show us where you are, and we will show you what is possible

Your first standard, a move from another tool, or AI governance. We tailor the demo to your situation.

See how we secure your data

In the demo we look at

How you map your scope and risks.
How you set up policies, controls and tasks.
How you keep room for future AI governance.

ISO 42001 + ISO 27001