Risk assessment
Scales, assets, risk register with automatic scoring, matrix and scenario library.
Tools
Put ISO 27001 and ISO 27005 into practice, step by step
Free, guided tools to measure your maturity, write your security policy, assess your suppliers, and run your risk assessment and Statement of Applicability, online or in Excel and Word. No sign-up.
Online tools
Nothing to install: your entries stay in your browser and are never sent anywhere.
WEB
ISO 27001 self-assessment
37 questions scored from 0 to 5 on the management system and Annex A controls. You get your maturity level by theme, your certification readiness and the 5 actions to start with.
ISO/IEC 27001 · clauses 4 to 10 · Annex A Open the tool → WEBSecurity policy generator
A security policy tailored to your country, sector and size: applicable texts, incident notification deadlines and written rules, ready to download as Word. Free preview.
France · Luxembourg · Switzerland · Türkiye · EU Open the tool → WEBSupplier security questionnaire
Assess a provider according to what you entrust to it: questions tailored to the type of service, your country and your sector, weighted score, blocking points and contract clauses. Excel export to have it filled in.
ISO/IEC 27001 · NIS2 Art. 21 · DORA Open the tool → WEBGuided risk assessment
Six steps, a library of 20 scenarios and suggested controls for each risk. The matrix, treatment plan and residual risk build up as you answer.
ISO/IEC 27005 · ISO/IEC 27001 6.1.2 Open the tool → WEBStatement of Applicability
All 93 Annex A controls explained in plain words, with justification, progress and expected evidence. Picks up the controls chosen in the risk assessment automatically.
ISO/IEC 27001 6.1.3 · Annex A Open the tool →Downloads
The same tools for offline work or assignments, in French, English and Turkish.
Statement of Applicability
All 93 controls with drop-down lists, justification, status and a progress dashboard.
ISO 27001 self-assessment
The 37 questions with drop-down lists, theme averages, maturity radar and recommended actions.
Risk assessment report
A structured report template with writing guidance, ready to fill in and have approved by management.
These tools follow the approach of ISO/IEC 27001:2022 and 27005:2022 without reproducing their text, which is protected by copyright: only control numbers are cited, and all names and explanations are reworded. The official text is available from ISO or your national standards body. Free to use; please keep the MG CYBER credit.