Teammate App
Book a demo
ProductIndustriesISO standardsResourcesPricingClient login

ISO 27001 · Information Security

The standard we hold ourselves.

Teammate is ISO 27001 certified — so the discipline the standard asks for is already built into how the system records access, change and evidence. Then it helps you run your own ISMS on top.

Information security management dashboard in Teammate App

TEAMMATE

Security incident reporting on the Teammate App mobile app
ISO 27001 — Information Security

An ISMS is mostly evidence of discipline.

Risk treatment plans, access reviews, supplier assessments and incident records — each one easy to do once and hard to prove you keep doing.

Everything carries a date

Who did it, when, and what they attached — recorded as it happens, not reconstructed later.

Everything links backwards

A corrective action points to the finding, the finding to the inspection, the inspection to the form.

Filter by clause

Tag records against the clause they satisfy, then export the pack the auditor asked for.

Clause map

Where each clause and Annex A control lives.

Not a feature list — the modules your auditor will end up opening, clause by clause.

Clause register · ISO/IEC 27001:2022

Hover a clause to open it

1–3Reference terms3 parts
4Context of the organization4 parts
5Leadership3 parts
6Planning5 parts
7Support5 parts
8Operation3 parts
9Performance evaluation3 parts
10Improvement2 parts

Clause 1–3

Reference terms

The three opening clauses set what the standard covers and the language the rest of it is written in. Nothing is recorded against them.

1Scope — information security management systems
2Normative references
3Terms and definitions

How Teammate assists

The whole platformTeammate supports the implementation and ongoing maintenance of the standard, and sits underneath it as the place every record required by the clauses is captured and kept.
Built by practitionersConfigured by people who ran management systems before they built software, so the structure follows the standard rather than a generic form builder.

Nothing to evidence here — this clause sets the terms the rest of the standard is written in.

Clause 4

Context of the organization

Your interested parties, the ISMS boundary and what sits inside it.

4.1Understanding the organisation and its context
4.2Understanding the needs and expectations of interested parties
4.3Determining the scope of the information security management system
4.4Information security management system

How Teammate assists

External PartiesCustomers, processors and regulators with their obligations recorded.
Document ManagementScope statement and ISMS documentation under control.
Workplace CentreSites and entities inside the boundary, kept current.

Nothing to evidence here — this clause sets the terms the rest of the standard is written in.

Clause 5

Leadership

Commitment, the security policy and who owns which control.

5.1Leadership and commitment
5.2Information security policy
5.3Organisational roles, responsibilities and authorities

How Teammate assists

NoticeboardPolicy issued with acknowledgement per person.
Human ResourcesControl ownership recorded against roles.
Document ManagementPolicy set with approvals and version history.

Nothing to evidence here — this clause sets the terms the rest of the standard is written in.

Clause 6

Planning

Risk assessment, risk treatment and the Statement of Applicability.

6.1.1Actions to address risks and opportunities — general
6.1.2Information security risk assessment
6.1.3Information security risk treatment and Statement of Applicability
6.2Information security objectives and planning
6.3Planning of changes

How Teammate assists

Risk ManagementRisk register with owners, treatment plans and residual scores.
Task ManagementTreatment actions tracked to closure with evidence.
Reports & ChartsObjectives and treatment progress on one dashboard.

Nothing to evidence here — this clause sets the terms the rest of the standard is written in.

Clause 7

Support

Competence, awareness, communication and documented information.

7.1Resources
7.2Competence
7.3Awareness
7.4Communication
7.5Documented information and its control

How Teammate assists

Human ResourcesSecurity training records and role-based competence.
NoticeboardAwareness campaigns with a read receipt each.
Document ManagementPolicies and procedures, current version only.
RemindersRecurring reviews raised on their due date.

Nothing to evidence here — this clause sets the terms the rest of the standard is written in.

Clause 8

Operation

Running the ISMS, and evidencing the Annex A controls you selected.

8.1Operational planning and control
8.2Information security risk assessment, performed as planned
8.3Information security risk treatment, performed as planned

How Teammate assists

Online FormsAccess reviews, supplier assessments and change records.
AssetsAsset inventory with an owner and a classification.
Audit InspectionAnnex A control checks on a schedule.
Task ManagementFindings and exceptions raised as actions.

Nothing to evidence here — this clause sets the terms the rest of the standard is written in.

Clause 9

Performance evaluation

Measurement, internal audit and management review.

9.1Monitoring, measurement, analysis and evaluation
9.2Internal audit and the audit programme
9.3Management review

How Teammate assists

Reports & ChartsControl performance and overdue treatment at a glance.
Audit InspectionAudit programme covering clauses and Annex A.
Task ManagementReview decisions as dated actions.

Nothing to evidence here — this clause sets the terms the rest of the standard is written in.

Clause 10

Improvement

Nonconformity, corrective action and continual improvement.

10.1Continual improvement
10.2Nonconformity and corrective action

How Teammate assists

Online FormsIncident and weakness reporting from anyone, anywhere.
Task ManagementCorrective actions with root cause and verification.
Risk ManagementRisks reassessed once the treatment lands.

Nothing to evidence here — this clause sets the terms the rest of the standard is written in.

Clause and Annex A references are to ISO/IEC 27001:2022. This map is a guide to where records sit — it isn't a certification guarantee, and your certification body has the final say. Teammate App holds ISO 27001 certification; your own certification is separate.

Getting there

Whether you're certifying or maintaining.

Going for certification

We help you build the risk treatment register, load your Statement of Applicability, and get access reviews and supplier assessments on a schedule.

  • Risk treatment register built with you
  • Annex A controls mapped to records
  • Access review schedule with reminders

Already certified

Surveillance audits stop being a fortnight of preparation — and you inherit a platform that is itself certified, which shortens your own supplier assessment.

  • Teammate's own certificate available on request
  • Access and change logged automatically
  • Run 27001 alongside 9001 and 45001

The other standards

45001

Health & Safety

Hazards, incidents, participation and worker safety.

9001

Quality

Document control, non-conformance and management review.

14001

Environmental

Aspects and impacts, obligations, monitoring and reporting.

22000

Food Safety

HACCP plans, prerequisites, verification and traceability.

17025

Labs

Calibration, method validation and analyst competence.

13485

Medical devices

Design controls, CAPA, complaints and traceability.

Ask us for our certificate.

We'll share it, walk you through our own controls, and show you how your ISMS records would sit in the system.

Book a demo See pricing