Effivity for ISO/IEC 27001: how the software runs your ISMS from risk register to audit

What an auditor sees when the ISMS runs in Effivity

Certification auditors examine the ISMS itself; the software is simply where they find its evidence. Their Stage 2 method is to follow threads: an asset to its owner and the risks that involve it; a risk to its treatment, its line in the Statement of Applicability and the working control; a leaver to the removal of access; an incident to its lesson.

Threads break at the joins: a control the Statement of Applicability calls implemented against a risk the register shows untreated, or an incident closed in a ticketing tool that never reached management review. Clause 6.1.3 binds treatment and the Statement of Applicability together, so such a gap is a potential nonconformity, not an untidy file.

In Effivity the pieces share one system, each with a named owner prompted by reminders when tasks fall due. The standard does not require software; the gain is how quickly your people can show a complete, dated thread.

Module by module: evidence for clauses 4 to 10 and Annex A

The table uses Effivity's own module names; each record exists because the work was done there, not because an audit is due.

Controls without their own module, such as access reviews, backup restore tests and vulnerability remediation, run as configured workflows with an owner, due date and recorded outcome; logs stay in the tools that produce them.

A worked trace: one lost laptop

A sales manager reports a laptop left in a taxi, logging it in Incident Management that evening. The IT lead finds the device in Information Asset, confirms its disk was encrypted, sends a wipe command and records what data it held and whether any client or authority must be told. The device management console shows the laptop stopped checking in a week before the loss, so the risk owner revisits the endpoint risk in Risk Management and a corrective action in Non-Conformance adds a weekly check for silent devices. Management review sees the lesson; an auditor sampling the case finds every step dated and owned.

Implementing with Sterling: Effivity from the first week

Effivity, Sterling's ISO and GRC software used in 50+ countries, is configured at the start of the engagement, so the ISMS is built where it will run.

• One plan. Gap analysis actions sit in Effivity with owners and milestones management can follow.
• Context and assets, captured live. Interested parties, their requirements and the scope go into Context of the Organization; each function lists its information and systems, with owners, in Information Asset.
• Criteria before risks. Top management agrees consequence, likelihood and acceptance criteria; risk owners then assess and treat their risks in Risk Management, and the Statement of Applicability follows.
• Documents reviewed, not reproduced. Working policies move into Documented Information; gaps are filled from Effivity's pre-built templates, rewritten to fit how you operate.
• Recurring controls from the start. Access reviews, supplier re-assessments, backup tests and awareness sessions are scheduled with reminders, so each has a history by Stage 2.

Internal audit, covering clauses and Annex A controls, runs in Internal Audit, with findings closed through Non-Conformance before the Stage 1 readiness review; see ISO/IEC 27001 internal audit: planning, conduct and reporting.

Multi-site scopes, remote teams and cloud platforms

Many ISMS scopes span several offices, home-based staff, a data centre and cloud platforms holding client data. Effivity's multi-site structure puts every location on identical forms within a single system, and the ISMS lead sees assets, incidents and control checks across the whole scope. Because Effivity is cloud-based, with a browser interface and an app, a remote employee can report a security event within minutes.

Treat each cloud platform as both asset and supplier: record the shared-responsibility split in the supplier evaluation, and justify in the Statement of Applicability the controls the provider operates for you. Name client-dedicated environments in the scope so nobody debates at Stage 2 where your responsibility ends. A certification body that samples sites relies on central control and internal audits reaching every site; one system and one audit programme show both.

Surveillance, recertification and Sustain™

A certificate runs for three years, with a surveillance audit each year and recertification before expiry. Surveillance samples part of the ISMS and checks the routine kept running: risk assessments repeated as planned and after significant change, a Statement of Applicability matching treatment decisions, access reviews done, incidents learned from, internal audit and management review held.

Change is where an ISMS falls behind: a new cloud service, acquisition or office move should reach the context, asset inventory and risk assessment within weeks. Owners, reminders and ISMS Dashboards keep that from resting on one person's memory, and Sustain™ keeps Sterling alongside you for internal audits, repeat risk assessments, refresher learning, surveillance readiness and scope extensions.

What Effivity does not do

Effivity is management system software, not a security tool: it does not scan for vulnerabilities, collect logs, manage identities, protect endpoints or back up data. Those controls run in your own technology, whose output remains the primary evidence; the vulnerability assessment in a Sterling engagement is separate, with findings tracked to closure in Effivity. Judgement stays with people: the auditor will ask whoever entered a risk score, applicability decision or root cause to justify it. Neither Effivity nor Sterling issues certificates; a certification body accredited to ISO/IEC 17021-1 and ISO/IEC 27006-1 audits and decides.

Three habits undermine a sound set-up:

• A shadow Statement of Applicability. A spreadsheet copy drifts from Effivity, and the auditor finds both.
• Incidents logged only when serious. A record with no weaknesses or near misses suggests nobody reports them.
• Access reviews that change nothing. A year of reviews without a single removal invites the auditor to test them.

Effivity for ISO/IEC 27001: questions buyers ask