Before you pay the security consultant SEK 200,000 for a gap analysis — run an automated pre-audit that covers 94% of technical Annex A controls in 30 minutes.
Register interest →We are opening for purchases in 2026. Register and we will get in touch.
ISO 27001:2022 has 93 controls in Annex A, across four themes. Approximately 51 are technically testable (mainly theme 8 — technical controls). Security Guru covers 48 of these 51 automatically.
| Theme | Controls | How handled? |
|---|---|---|
| 5 — Organisational | 37 | Partially automated (5.10, 5.14, 5.16, 5.17, 5.30 etc.) + document attestation |
| 6 — People | 8 | HR process, not automatable — attestation |
| 7 — Physical | 14 | 7.4 (monitoring) + 7.10 (storage media) automated, others require site inspection |
| 8 — Technical | 34 | 32 of 34 automated (CVE matching, hardening checks, crypto assessment, segmentation, backup validation etc.) |
No — certification requires an accredited auditor (CB). We do not replace the auditor but provide the documentation the auditor would otherwise have spent 30-60% of their time producing.
Yes. Every finding has a control ID (e.g. iso27001:8.20) that can be directly pasted into the SoA template. Many auditors accept our automated tests as "evidence of operating effectiveness" for the period when the scan was run.
ISO 27001 requires "continual improvement" — in practice at least quarterly internal audit. Our Continuous subscription runs the scan monthly and shows drift since the previous run.
Fill in the form — we'll get back to you within 24 hours.