Development Begins on a SaaS That Supports ISO 27001 (ISMS) Certification and Operation End to End
We have begun developing a SaaS that lets companies obtain and maintain ISO 27001 (ISMS) certification on their own, without relying on consultants. As a co-creation project with a company that provides ISO certification consulting, we are turning expertise built up in the field into a product, built as a multi-tenant SaaS with AI at its core.
The Project's Challenge
Building and running an ISMS involves a huge number of interconnected elements: identifying information assets, risk assessment, addressing the 93 controls set out in Annex A of ISO 27001, preparing the Statement of Applicability (SoA) and policy documents, employee training, internal audits, and management reviews.
The platform links the entire chain, from information assets to risks, controls, the Statement of Applicability, documents, and evidence, as connected data. We are taking on the challenge of an "end-to-end" design in which risk assessment results become candidate entries in the Statement of Applicability, and day-to-day operational records are automatically compiled for management reviews and audit preparation. The platform also includes full-text search, so that evidence requested during an audit can be presented on the spot.
In addition, we are building in a mechanism in which AI answers questions about the standard's requirements and the company's own operations, with the aim of using software and AI to support decisions that until now required relying on experts.
Building the Business as a SaaS
The system is being built as a multi-tenant SaaS, with data fully separated for each company seeking certification. By building the approaches refined in consulting practice into the product as policy templates, checklists, and recurring tasks, we aim for a world where even companies that find it hard to get expert support can obtain and run their ISMS on their own.
As a co-creation partner, we provide end-to-end support from requirements definition through operations.
- Considering turning your business know-how into a SaaS or product → System Development
- Considering AI-powered business support or turning specialist knowledge into a system → AI Implementation Support
- Considering DX for security and compliance work → DX Promotion Support
Please feel free to reach out for an initial consultation.