See what an evidence-led engagement produces.
Illustrative working structures showing how ISOReadyHub organizes requirements, risks, controls, evidence, findings and remediation. These are sample structures only and are not client evidence.
Designed for structured delivery today and future migration into governed GRC workflows.
One chain of IDs across every template
Each record carries an ID that links it to the next step, so a requirement can be followed through risk, control, gap, action, evidence, audit and finding to a closed corrective action.
- Requirement
- Risk
- Control
- Gap
- Action
- Evidence
- Audit
- Finding
- Corrective action
- Closure
14 templates, in the order they are used
Every template is described here in full. To download one, enter your name and work email once — the rest then open too. Each file is a Microsoft Excel workbook from pack v2.0, published 22 September 2026.
Illustrative template — not client evidence
Discover
- ID prefix CTX
ISMS Scope & Context
Defines organizational context, scope boundaries, interfaces and assumptions at the start of an engagement, so later requirements trace back to an agreed scope.
- ID prefix IP
Interested Parties Register
Records interested parties and their needs during scoping, showing which expectations become requirements and how each is monitored.
- ID prefix OBL
Legal, Regulatory & Contractual Obligations Register
Lists potentially applicable obligations with an applicability decision and rationale during screening, linking each to an owner, evidence and review date.
Assess
- ID prefix GAP
Gap Assessment Register
Compares current and required state during assessment, tracing each gap to its requirement, evidence and risk through to a validated closure.
- ID prefix RISK
Information Security Risk Register & Treatment Plan
Rates risks with an illustrative model that your approved risk criteria replace, and links each treatment to controls and a residual-risk decision.
Implement
- ID prefix CTRL
Statement of Applicability Skeleton
A structure-only Statement of Applicability for recording each control’s applicability, justification, implementation status and evidence; control text comes from an authorized source.
- ID prefix OBJ
Information Security Objectives & KPI Register
Sets measurable objectives, metrics and targets with owners and review frequency during implementation, without invented maturity scores.
- ID prefix SUP
Supplier / Third-Party Security Register
Records supplier services, data and access exposure, criticality and assessments, with monitoring depth matched to supplier risk.
Prove
- ID prefix EV
Evidence Register
Connects requirements and controls to operating evidence once processes run, recording provenance, freshness, sufficiency and review status.
Assure
- ID prefix AUD
Internal Audit Programme & Audit Pack
Plans risk-based internal audits with criteria, sampling and a competence and independence check, producing findings that feed corrective action.
- ID prefix CA
Nonconformity & Corrective Action Register
Tracks findings through correction, root cause, corrective action, implementation evidence and effectiveness review to closure.
- ID prefix MR
Management Review Input & Action Pack
Prepares management-review inputs and records the decisions, resource needs and improvement actions that follow, each with an owner and evidence of closure.
- ID prefix RDY
Certification Readiness / Critical Issues Tracker
Keeps issues that could block or delay an independent audit visible before Stage 1 and Stage 2, with the action and validation needed to close each, without predicting the outcome.
- ID prefix CERT
Stage 1 / Stage 2 Finding & Evidence Closure Tracker
Tracks certification-body findings and evidence requests through action, internal validation and closure, while the certification decision stays with the certification body.
Your download is ready.
The file starts automatically. Every other template on this page is now available too.
These templates illustrate structure only.
Actual implementation should reflect the organization’s scope, risks, systems, obligations and operating model.
- The 1–5 risk model is illustrative; risk criteria must be approved for your organization.
- The Statement of Applicability does not reproduce ISO/IEC control text; populate it from an authorized source.
- Regulatory applicability is verified before a requirement is treated as binding.
- References to other frameworks are left for a validated mapping; they do not imply equivalence.
- Do not place passwords, credentials, secrets or real vulnerabilities in these files.
- You may adapt these structures for your organization’s internal use. They may not be resold as an ISOReadyHub product or presented as completed ISOReadyHub client evidence.
See how the templates are used in an ISO 27001 gap assessment and in ISO/IEC 27001 implementation.
Start with a focused discovery conversation
Tell us what you are trying to achieve, what is driving the requirement and where you are today. We use the first discussion to clarify scope and next steps, not to force a predefined package.