Free tool · no signup · runs in your browser
ISMS Builder (ISO/IEC 27001)
Answer seven short steps, one per clause from 4 to 10, and get four starter ISMS documents in Markdown: scope, policy outline, risk treatment plan and audit checklist.
Clause 4
Context and scope
Work out what inside and outside the organisation affects your security outcomes, who has a stake and what they require, then draw a clear, documented boundary for the ISMS, including the interfaces and dependencies with things outside it.
Culture, capability, structure, technology, strategy.
Regulation, market, threat landscape, suppliers, climate where relevant.
One per line: party: requirement.
Your documents (Markdown)
# ISMS Scope Statement **Organisation:** _Organisation name_ **Version:** 0.1 (draft) **Date:** 2026-11-01 **Status:** Draft for review. Generated with PlayCISO ISMS Builder; clause references follow ISO/IEC 27001:2022. This draft paraphrases clause intent and does not reproduce the standard. ## 1. Purpose This statement sets the boundaries and applicability of the information security management system (ISMS) of the organisation (ISO/IEC 27001:2022, clause 4.3). ## 2. The organisation _To be completed._ ## 3. Issues considered (clause 4.1) **Internal** - _To be completed._ **External** - _To be completed._ ## 4. Interested parties and their requirements (clause 4.2) - _To be completed._ ## 5. In scope - _To be completed._ ## 6. Out of scope and justification - _To be completed._ ## 7. Interfaces and dependencies - _To be completed._ ## 8. Approval | Role | Name | Date | |---|---|---| | Top-management sponsor | | | | ISMS owner | | |
Next: check how ready you are with the ISO 27001 readiness checklist.
The seven clauses in plain English
- Clause 4, Context and scope. Work out what inside and outside the organisation affects your security outcomes, who has a stake and what they require, then draw a clear, documented boundary for the ISMS, including the interfaces and dependencies with things outside it.
- Clause 5, Leadership and policy. Top management must visibly own the ISMS: set a security policy that fits the organisation, gives a basis for objectives and commits to meeting requirements and improving over time, and make sure roles and authority are assigned and understood.
- Clause 6, Planning and risk treatment. Plan for risks and opportunities: define a repeatable way to identify, analyse and evaluate information security risks with named owners, choose treatments and the controls they need, check those controls against Annex A so nothing necessary is missed, record a Statement of Applicability and a treatment plan the risk owners approve, and set measurable objectives. Changes to the ISMS are planned too.
- Clause 7, Support. Provide what the ISMS needs to work: people, budget and tools; competent staff with evidence of their competence; everyone aware of the policy and their part in it; a plan for what is communicated, to whom and when; and control over the documents and records the ISMS relies on.
- Clause 8, Operation. Run what you planned: control the processes the ISMS depends on, including outsourced ones; repeat risk assessments at planned intervals and when something significant changes; carry out the treatment plan; and keep records that show it happened.
- Clause 9, Performance evaluation. Decide what to measure and how, then check the ISMS objectively: internal audits on a planned programme by people who do not audit their own work, and regular management reviews that look at results, changes and improvement opportunities and lead to decisions.
- Clause 10, Improvement. Keep making the ISMS more suitable and effective. When something does not conform, react, find the cause, fix it so it does not recur, check the fix worked and keep a record.
Annex A in 2022
Annex A lists 93 controls in 4 themes: Organizational (A.5, 37), People (A.6, 8), Physical (A.7, 14), Technological (A.8, 34). It is a reference list to check your risk treatment against, not a list you must implement in full; record each decision in your Statement of Applicability.
Descriptions are PlayCISO paraphrases, not ISO text. Starter drafts only: adapt them, and get the standard itself before you implement or certify.
Questions
What does the ISMS Builder produce?
Four Markdown starter documents for an ISO/IEC 27001:2022 information security management system: an ISMS scope statement, an information security policy outline, a risk treatment plan skeleton with your risk register, and an internal audit and management review checklist. You fill in seven short steps, one per clause from 4 to 10.
What are clauses 4 to 10 of ISO/IEC 27001?
They are the management-system requirements: 4 context of the organisation (issues, interested parties, scope), 5 leadership (commitment, policy, roles), 6 planning (risk assessment, risk treatment, objectives, planning changes), 7 support (resources, competence, awareness, communication, documented information), 8 operation (running the plan and repeating risk assessments), 9 performance evaluation (measurement, internal audit, management review) and 10 improvement (continual improvement, nonconformity and corrective action).
How many controls are in ISO 27001:2022 Annex A?
93 controls in 4 themes: organizational (A.5, 37), people (A.6, 8), physical (A.7, 14), technological (A.8, 34). UKAS describes the 2022 Annex A as 93 controls, 11 of them new, organised in 4 themes. You compare the controls your risk treatment needs with Annex A and record the result in a Statement of Applicability.
Does this tool contain the text of ISO/IEC 27001?
No. Every clause description and checklist question is PlayCISO’s own plain-English paraphrase of what the clause is for. The standard is copyrighted; buy it from ISO or your national standards body before you implement or certify.
Is my data sent anywhere?
No. Everything runs in your browser and your answers are saved only in this browser’s local storage. Use Clear to remove them.
Sources
Keep going
- ISO 27001 Readiness Checklist: score your ISMS against clauses 4–10 and the Annex A themes.
- Risk Register: build out the risks behind your treatment plan.
- CISO Risk Desk: practise accept, mitigate, transfer or avoid.
- GRC Starter Kit: example policies and procedures to adapt.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.