Modular ISO 27001 compliance software with AI-assisted evidence linking, guided audit walkthroughs, and Bring-Your-Own LLM keys. Map every Annex A control, ship audit-ready reports, and only pay for the bricks you actually need.
From scoping the ISMS to passing the surveillance audit, every phase has the bricks it needs and none it doesn't.
All 93 Annex A controls from ISO 27001:2022 across the four themes — Organizational, People, Physical, Technological — plus the ISMS clauses 4–10. Statement of Applicability auto-generated from your context.
Upload a policy, drop in a screenshot from your IDP, paste a meeting note — the AI Coach maps each artifact to the controls it actually evidences and flags where you're thin. Cuts the 60% of a certification project that traditionally goes into manual evidence wrangling.
Connect your OpenAI, Anthropic, or Gemini key and your ISO 27001 evidence runs against your provider relationship, your data isolation rules, your billing. Per-tenant isolation, no cross-customer model training.
One-click export of the Statement of Applicability, risk treatment plan, internal audit findings, and management review records — formatted for the stage 1 and stage 2 audit submission. Auditors get what they need, you skip the late-night formatting.
Choose Guided mode if it's your first ISMS — the AI walks you through scoping, risk assessment, control implementation, and the internal audit step by step. Switch to Expert mode for direct edit access, bulk operations, and full visibility once your team is fluent.
Surveillance audits land every year. BrickGRC tracks your control maturity continuously, schedules evidence refresh cycles, and flags drift before the auditor does. The 3-year recertification stays a low-stress checkpoint, not a fire drill.
ISO/IEC 27001 is the international standard for information security management systems (ISMS). The current revision — ISO/IEC 27001:2022 — defines a risk-based framework for protecting the confidentiality, integrity, and availability of the information your organisation handles. Certification is awarded by an accredited certification body after a two-stage audit and is valid for three years, subject to annual surveillance audits.
The standard is structured around two parts. The main clauses (4 through 10) describe the management-system requirements: how you scope the ISMS, run risk assessments, define policy, drive continual improvement, and demonstrate leadership. Annex A lists the 93 controls grouped under four themes — Organizational, People, Physical, and Technological — that you select from based on your risk treatment plan and document in the Statement of Applicability.
Companies pursue ISO 27001 for one of three reasons:
BrickGRC was built for the third group first — security engineers and CTOs who want a workable ISMS without the all-in-one platform price tag — and ended up serving the first two well too. Pick the bricks you need (ISO 27001 is one), bring your own AI key, ship the SoA, get certified.
Yes. The full Annex A control set across all four themes — Organizational (37 controls), People (8), Physical (14), and Technological (34) — plus the ISMS clauses 4–10. Each control has guided implementation tasks, evidence templates, and AI-assisted maturity scoring on the Initial → Managed → Defined → Quantitatively Managed → Optimised rubric.
Most teams reach audit-ready in 8–16 weeks depending on existing security controls. The AI Compliance Coach prioritises gaps so you work on what matters first, and the evidence auto-linking cuts the manual collection time that traditionally consumes 60% of a certification project.
Yes. On Professional and Enterprise plans, you can connect your own OpenAI, Anthropic, or Gemini API key. Your evidence is processed under your provider relationship, your data isolation rules, and your billing — never shared between tenants.
Yes. Reports include the Statement of Applicability (SoA), risk treatment plan, control implementation evidence with citations, internal audit results, and management review records — formatted for stage 1 and stage 2 audit submission.
Yes. You can import existing policies (PDF, Word, Markdown), evidence files, and risk registers via bulk upload. The AI Coach maps them to Annex A controls automatically and flags overlaps and gaps.
Yes. The free Compliance Assessment scores your organisation against ISO 27001 controls in about 15 minutes — no credit card or signup required. You get a maturity score per control plus a prioritised gap list.
Pick the ISO 27001 brick, scope your ISMS, and let the AI Coach handle the evidence wrangling. Audit-ready in weeks, not months.