ISO 27001 compliance software that keeps your ISMS audit-ready every day
Run information security on the same portal as quality: controlled ISMS documents, a risk register with treatment plans, Annex A controls with owners, evidence approved by department heads and automatic checks from the systems you already use.
Why ISMS work drifts between surveillance audits
ISO 27001 asks for living proof: risks reviewed, controls working, staff aware of policies, suppliers assessed, incidents handled. Most teams keep this in spreadsheets and shared folders, and rebuild it in the weeks before the audit.
When the ISMS sits apart from the QMS, the same policy, audit and management review is maintained twice, and nobody can say which control is weak today.
The Zefron QMS Portal keeps ISMS documents in document control, risks in one register, Annex A controls in a shared control library and evidence on a monthly calendar. Every change is reviewed and approved by the department head, and the health score shows where each department stands.
ISO 27001 features
ISMS documents
- Policies and procedures as controlled QMS documents with revisions and approval
- Policy reading tracked page by page, with due dates and reminders
- Documents mapped to the Annex A controls they cover
- Periodic review reminders
Risk and controls
- Risk register with likelihood, impact, owner and treatment
- Annex A controls in a shared library: assess once, counts for every framework
- Department-head approval on every assessment
- Health score per department
Evidence and audits
- Monthly, quarterly and yearly evidence plan per department
- External auditor login limited to audit days, office hours and the audit scope
- Internal audits and management review in the same portal
- Board report every month
Automatic checks
- Microsoft 365: MFA, admins, Secure Score, guests
- FortiGate, Endpoint Central, Intune, Veeam and more
- Failed checks open a ticket and lower the health score
- Any other system can send results by URL
Spreadsheets vs enterprise QMS vs Zefron
How the three common approaches compare.
| Excel and shared folders | Enterprise QMS suites | Zefron QMS Portal | |
|---|---|---|---|
| Set-up time | Ready today, but rebuilt for every audit | Months of project work and consultants | Configured for you; most go live in two to four weeks |
| Approvals | E-mail threads, signatures on paper | Fixed workflows, changes need IT | Review and department-head approval on every action |
| Version control | Old copies stay in use | Yes | Only the current version is visible; full history kept |
| Audit trail | None | Yes | Every action with name, date and time |
| Reminders and overdue tracking | Manual | Yes | Automatic e-mail reminders and dashboards |
| Data entered once | Copied between files | Often separate modules | Linked across documents, 8D, audits, PPAP and quality tools |
| Cost | Low licence cost, high staff time | High licence and implementation cost | Priced for small and mid-size companies |
Free downloads: 8D, CAPA, PPAP and audit checklist templates →
How the portal maps to ISO/IEC 27001:2022
Checklist text is written in our own words with clause references. The portal supports your ISMS; certification is granted only by an accredited certification body.
| Requirement | How the portal supports it |
|---|---|
| Clauses 4 to 10 | Context, policies, objectives, risk assessment and treatment, internal audit and management review in document control, the risk register and audit management. |
| Annex A organisational controls (A.5) | Policies, roles, supplier security (vendor risk), incident and privacy handling. |
| Annex A people controls (A.6) | Policy awareness tracking and joiner / leaver handling through HR sync. |
| Annex A technological controls (A.8) | Access, malware, backup, logging and network checks collected automatically by connectors. |
Live in three steps
Configure
We load the ISO 27001 controls, map your existing ISMS documents and agree owners per department.
Migrate
Risks, controls and the evidence plan are set up; connectors to Microsoft 365, your firewall and endpoint tools are switched on.
Train & go live
Departments keep evidence current with approvals and reminders; auditors get scoped, time-limited read-only access.
Frequently asked questions
Is ISO 27001 a separate product?
No. It runs on the core QMS (documents, records, audits) plus the Compliance module, so the ISMS and the QMS share one set of policies, audits and approvals.
Which Annex A version is used?
ISO/IEC 27001:2022 with its 93 Annex A controls, grouped as organisational, people, physical and technological.
Can our certification auditor log in?
Yes. The QMS team creates a read-only auditor login from the audit plan. It works only on audit days, in office hours, after access is opened for the day, and shows only evidence of the audited standards.
Can evidence be collected automatically?
Yes, for systems with an API: Microsoft 365, Intune, Azure, AWS, FortiGate, Endpoint Central, Okta, GitHub and Veeam. Any other tool can post results to the portal.
Does the software make us certified?
No software can. It organises the ISMS so you can show it works; certification is decided by your certification body.
Related
Compliance management software
GDPR, DPDP, HIPAA, SOC 2, PCI DSS, GST and Customs: controls, owners and periodic evidence in one place.
Read more →Risk register software
One company risk register for quality, security, privacy and vendors, with treatment, review dates and PFMEA.
Read more →Integrations & automatic evidence
Microsoft 365, Intune, Azure, AWS, FortiGate, Endpoint Central, Okta, GitHub, Veeam, Jira, osTicket and HR systems.
Read more →