The Annex A working list for cloud-only small teams: what a certification auditor asks for, how to collect each artifact, and where the safe N/A rationale goes — 44 control groups across all four themes.
Why we made this
Most ISO 27001 guidance is written for companies with dedicated compliance staff. A five-person SaaS team has the same Annex A scope with none of the headcount — so we wrote down the version such a team actually needs.
This is self-assessment material, not certification advice. Your certification body decides what's sufficient.
Want the full ISMS starter set?
The ISO 27001 DIY Edition adds the full 93-control Annex A mapping, ten editable ISMS policies, a gap-analysis walkthrough, and the audit evidence checklist.
See the DIY Edition