Kaamos
ISO 27001

ISO 27001 compliance automation.

For a 25-person SaaS company, Kaamos≥ automates connected-system evidence collection, control tracking and audit-package preparation. Founders retain the ISMS scope and risk-acceptance decisions. People review evidence, perform internal audits and management reviews; the certification body audits and decides certification.

Book a meeting What ISO 27001 requires

What a tool can genuinely automate

All of it is collection, correlation and keeping a record current — work a machine does better than a person with a spreadsheet and a calendar reminder.

Collecting evidence from the systems you already run
Access reviews, logging, backup and vulnerability status exist as facts in your cloud, identity provider and code host. Reading them directly is strictly better than asking someone to screenshot them quarterly, because the screenshot is stale the moment it is taken and nobody re-takes it until the next audit.
Keeping the documented information current7.5 Documented information
Versions, approvals, owners and review dates are bookkeeping. A tool that tracks which policy is current, who approved it and when it is next due removes an entire category of audit finding that has nothing to do with your actual security.
Maintaining the risk register and treatment plan6.1 Actions to address risks and opportunities
The register itself — risks, owners, treatment decisions, linked controls and the evidence behind each one — is a data structure. Keeping it connected so a treatment decision still points at live evidence a year later is exactly the kind of upkeep that decays by hand.
Tracking control status and what is still missing
Which controls are in place, which are partially in place, who owns the rest and what order to do them in. This is the part most teams try to run in a spreadsheet, and the spreadsheet is why the work stalls.
Assembling the audit package
An auditor asks for the evidence behind a control and the trail that connects it. Producing that on request, rather than reconstructing it over three weeks, is a packaging problem and a solved one.

What stays yours

Each of these is either a judgement the standard requires your management to make, or an activity that has to actually happen. Software can hold the record. It cannot be the decision.

Deciding the scope4.3 Determining the scope of the information security management system
Which parts of the business, which systems, which locations. Get this wrong and everything downstream is wrong, and no tool can make the call for you because it depends on what you sell and to whom. It is the first thing a Stage 1 audit examines.
Setting risk criteria and accepting risk6.1 Actions to address risks and opportunities
What counts as acceptable risk is a management decision with consequences, and the standard requires it to be a management decision. A tool can present the risk and record who accepted it. Somebody still has to accept it.
The internal audit
It has to be performed, by someone objective about the area under review. Software can schedule it, hold the findings and track the corrective actions. It cannot be the auditor.
The management review
Leadership has to look at the ISMS and decide things about it, on a record. A generated report is an input to that meeting, not a substitute for it.
The certificate
ISO/IEC 27001 certification is issued by an accredited certification body after a two-stage audit, and it is bought separately from any software. Any platform describing itself as getting you certified is describing the preparation, not the certificate.

From a connected source to audit preparation.

Illustrative workflow for a small SaaS team, using the product’s current connection, control, review and export features. This is a preparation example, not a customer result or an assurance outcome.

  1. 1. Connect a source

    In this example, grant a scoped, read-only connection to Google Workspace. Check its collection status and last successful sync. The connection reads your systems; it cannot change access permissions.

  2. 2. Review the evidence and control link

    Use the collected user-directory and access-log records as inputs to an access-control review. Inspect the source and the proposed evidence link to the relevant Annex A control; your team reviews the mapping.

  3. 3. Resolve stale or missing evidence

    Check the artifact count, time since evidence was last linked and open findings. The stale marker reflects link recency, not the artifact’s collection date. Check that date and the review period; investigate old links, missing evidence or failed collection before relying on the record. A linked artifact is not proof that a control works.

  4. 4. Make the human decision

    The control owner reviews the evidence and accepts or dismisses the suggestion. Founders retain the ISMS scope and risk-acceptance decisions; people perform the internal audit and management review. Roadmap gates need your approval.

  5. 5. Prepare the audit export

    Assemble the audit package and exports from the reviewed work. Agree the requested evidence with your auditor. Preparation in software does not issue a certificate: the certification body audits and decides.

Product basis: the connected-source, controls and roadmap surfaces, human-review limits and published plan features. Workflow copy reviewed . Confirm the connection and export scope for your systems with the team.

See the product workflowInspect read-only source connectionsReview controls and linked evidenceFollow the evidence lifecycleCompare plans and framework scopeDiscuss your audit preparation scope

How Kaamos handles the automatable half.

Connect your cloud, identity provider and code host, and Kaamos reads the state of those systems into an inventory and attaches it to the controls it evidences. The risk register, the treatment decisions and the roadmap sit on top of the same data, so a decision you made in March still points at evidence that is true in September rather than at a screenshot of March.

The other half stays yours, and we would rather say so here than in a footnote after you have bought it. Kaamos will hold your scope statement, record who accepted which risk, schedule the internal audit and keep its findings — but the scope is your decision, the acceptance is your management's, and the audit needs a person. The certificate comes from an accredited certification body and is paid for separately.

ISO 27001 requirements in detailThe same question for SOC 2How this compares to SOC 2Plans and framework allowancesOther tools in this category

Sources

The standard itself is paywalled, so clause titles here were read from ISO’s own Online Browsing Platform preview and nothing is quoted from the body of the text. Last reviewed .