ISO/IEC 27001:2022 · complete and available today
The UK half of the standard, already written
Every ISO 27001 toolkit on the market is written for an American or generic international buyer. They run from about £45 to £1,200, and every one of them leaves the UK work to you — UK GDPR, the Data Protection Act 2018, the 72-hour clock to the ICO, and the internal breach record under Article 33(5) that almost nobody keeps. This is that work, finished.
Not sure yet? Five of these documents are published in full on this site and cost nothing. Read the control set, the AI acceptable use policy, the privacy breach response policy and the vendor review policy. The first four are in the pack. The fifth, the SOC 2 crosswalk, is not in any pack — it is free because an American customer asking for a SOC 2 is one of the commonest reasons a UK firm ends up here, and we would rather you had the map. If they are not the standard of work you want, do not buy it.
Full ISMS pack — 49 documents
Buy this if you are building a management system, from scratch or nearly. Everything ISO/IEC 27001:2022 needs, written for a UK organisation from the start rather than translated afterwards.
- All fourteen documents the standard mandates under clauses 4 to 10 — scope, policy, both risk methodologies, objectives, audit programme, management review.
- Sixteen topic policies across the Annex A themes, from access control to secure development.
- Registers that do the arithmetic — risk scored and banded automatically, a supplier register that flags expired assurance, a breach register calculating both retention clocks.
- Audit checklists by clause and by all 93 controls, an evidence index and a readiness self-check.
- The complete UK overlay, listed opposite.
- A Stage 1 and Stage 2 preparation guide on why first attempts actually fail.
£795 + VAT
Buy the full pack — £795 + VAT49 documents in 30 files · Word and Excel · emailed within one working day
UK overlay — 8 documents
The United Kingdom is no longer the EU with a different flag. The Data (Use and Access) Act 2025 came fully into force this year and moved the law in twelve places.
- The DUAA divergence register — every point where UK law has left the EU GDPR, with the date each took effect. Nothing in a generic toolkit covers this, because most of it did not exist eighteen months ago.
- Statement of Applicability with a UK obligation column, and ten controls that carry a different answer here than in the EU pack.
- Legal register with twelve UK instruments — UK GDPR, the DPA 2018, the DUAA, PECR with its new £17.5m ceiling, PSTI, and the Computer Misuse Act, which is why you get written authorisation before a penetration test.
- Records of processing and a breach register on the ICO route, with the 72-hour clock calculated.
- UK Article 27 representative — a separate appointment from the EU one, because since Brexit each is a third country to the other.
- Transfer assessment built on the DUAA data protection test, which asks a different question from the EU standard, with the IDTA and the UK Addendum.
£245 + VAT
Buy the UK overlay pack — £245 + VATSecure checkout by Stripe · files emailed within one working day
EU overlay — 8 documents
For a UK organisation selling into the European Union. Drops on top of the core pack, or works on its own alongside a toolkit you already own.
- Statement of Applicability with a European obligation column — 59 of the 93 controls carry one. The other 34 say so plainly rather than pretending.
- Legal register arriving populated with fifteen instruments, including three most UK sellers have never heard of: the revised Product Liability Directive, which makes software a product from December; the European Accessibility Act, which has applied to e-commerce since June 2025; and DORA, which reaches you as a supplier to a financial entity even though you are not one.
- Article 30 records of processing, controller and processor versions, with worked examples.
- Breach register that calculates the 72-hour clock from the moment you became aware, and turns red when it passes.
- AI Act obligations register carrying the real dates after the Digital Omnibus — Article 50 transparency live since 2 August 2026, synthetic-content marking due 2 December, high-risk deferred to December 2027.
- Article 27 representative appointment and mandate, Chapter V transfer assessment, and a DPIA aligned to Article 35.
£245 + VAT
Buy the EU overlay pack — £245 + VATSecure checkout by Stripe · files emailed within one working day
Buying more than one
Both overlays — £425 + VAT
The EU and UK packs together, saving £65. Sold separately rather than merged because the two regimes are now separate laws that agree on most things and differ on twelve that matter — a combined pack would have to pretend otherwise, which is the error that costs people money.
Buy both overlays — £425 + VAT · files emailed within one working day.
The full pack and the EU overlay — £975 + VAT
The core ISMS pack already contains the UK overlay, so the only thing left to add for the European market is the EU pack. Bought together, £975 + VAT — £65 less than separately. We will not sell you the UK overlay twice, and if you only need the UK, the core pack on its own is the whole answer.
Tell us on the enquiry form and we will send one invoice.
The questions people ask before buying
What format is it, and can I edit it?
Word and Excel. Nothing is locked, watermarked or protected. Rebrand it, cut what does not apply, extend what does — it is yours to change. The spreadsheets have shaded cells for you to complete and a small number of blue cells that calculate themselves.
How does it arrive, and how quickly?
By email, as a zip, within one working day of payment. There is no account to create, no portal to log into, and no subscription. We will not add you to a mailing list.
Do I still need to buy the standard?
Yes. ISO/IEC 27001:2022 is copyrighted and must be obtained from ISO or BSI. Nothing in the pack reproduces its text — every description is written in our own words, which is also why we can sell it.
Why is this more expensive than a £45 toolkit?
Because those toolkits are written for American buyers and stop short of what a UK organisation actually has to evidence. Fifty-four of the ninety-three controls in our Statement of Applicability carry a specific UK obligation, and the legal register arrives populated rather than blank. If you do not need that, buy the cheaper one — we would rather say so.
Will it make us certified?
No. Certification is issued only by an accredited certification body, which we are not and do not intend to become. Documents save you the drafting; operating the system is what earns the certificate. The pack includes a guide on what auditors actually test.
I am a consultant. Can I use these with clients?
Not on a single-organisation licence, but ask us and we will licence it properly. We would rather sell you the right licence than find out later. The full licence terms are published here, so you can read them before you pay.
What if something is missing or wrong?
Tell us and we will fix it or refund you. Where we materially revise a document you have bought, you get the revision free for twelve months. We would rather refund a dissatisfied buyer than argue with one.
Can I add help from you?
Yes — ninety minutes on the three things people get wrong before an audit: the scope statement, the Statement of Applicability, and controls excluded without a defensible justification. Recorded if you want it, with one follow-up round by email.
Add £400 + VAT
Overlay with session £625 + VAT · Full pack with session £1,175 + VAT. Tell us when you order and we will invoice the difference.
What this is not
Documents are not a certificate, and we will never be your certification body.
Certification against ISO/IEC 27001:2022 is issued only by an accredited certification body. We are not one and do not intend to become one. Buying documents does not make you compliant — it saves you the drafting so your time goes on operating the thing, which is the part that actually matters. You will also need the standard itself, which is copyrighted and must be bought from ISO or BSI. Nothing in these packs reproduces its text; every description is written in our own words.
And a rule we hold ourselves to, in writing: we will not carry out an independent assessment of a management system built on documents we sold you. If you want both, we will tell you plainly which one to buy elsewhere. Independence is the only thing that makes our findings worth anything, and we are not trading it for a document sale.
Still deciding?
Read the four free documents first — they are complete, not extracts, and they are in the pack. If you would rather be invoiced than pay by card, or you want the working session added, tell us and we will send an invoice instead. Nobody will chase you.