What is the ISO27k Toolkit and what can it help me do?

Updated

The ISO27k Toolkit is a free set of tools and resources published on iso27001security.com to help information risk and security professionals implement ISO/IEC 27001 and the other ISO27k standards. You can download it directly from the site at no cost, and it is intended to support practical work on an information security management system (ISMS) rather than to replace the standards themselves.

What the Toolkit is

iso27001security.com describes itself as offering "extensive, pragmatic guidance on the ISO/IEC 27000-series information risk and security management standards." The Toolkit sits within that offering alongside other free resources:

  • ISO27k FAQ – background and clarification on the standards
  • ISO27k Toolkit – downloadable tools and resources for implementation
  • ISO27k Forum – a user forum with over 5,000 professional members
  • ISO27k Blog – news and commentary on ISO27k developments

The site states that it maintains up-to-date information on all 100 "ISO27k" standards, and that all of this is available for free. It also notes that donations toward its costs are gratefully received, describing itself as a not-for-profit initiative that has run on a shoestring for decades.

What it can help you do

Because the Toolkit is positioned as implementation support for ISO/IEC 27001 and the wider ISO27k family, its practical value lies in the work surrounding an ISMS. Typical uses include:

  • Getting oriented in the standards – using the Toolkit together with the FAQ to understand what the ISO27k standards cover before committing to a full read.
  • Building or maintaining an ISMS – applying the tools to the management-system work that ISO/IEC 27001 requires.
  • Improving an existing programme – revisiting toolkit material when refining or extending what you already have in place.
  • Comparing notes with peers – pairing Toolkit use with the ISO27k Forum, where thousands of other professionals discuss the same implementation problems.

The site frames the whole resource set as guidance for "information risk and security professionals" who want to "understand and get the most out of the ISO27k standards," so the Toolkit is best understood as a working aid for practitioners, not an introductory overview for a general audience.

How to get it

  1. Go to iso27001security.com.
  2. Locate the ISO27k Toolkit link, listed on the site alongside the ISO27k FAQ, ISO27k Forum and ISO27k Blog.
  3. Download the Toolkit. The site describes the download as free.
  4. Optionally join the ISO27k Forum, which the site says has 5,500 professional peers and is also free.

Points to keep in mind

  • The Toolkit supports implementation of the standards; it does not substitute for the standards themselves, which remain the authoritative texts.
  • The site's own news items show that ISO27k content changes over time — for example, it reports that the fourth edition of ISO/IEC 27007 is on track for publication by mid-2027, and that a preliminary work item has produced a plan to revise the multi-part ISO/IEC 27033 network security standard. If you are working to a specific edition, check the current status rather than assuming the Toolkit reflects the latest draft.
  • The site also notes work on a proposed new ISO27k information security standard aimed at SMEs (organisations of up to about 250 people), which may be relevant if you are implementing in a smaller organisation.

If your goal is to understand what ISO27k covers, start with the FAQ and the standards overview. If your goal is to actually build or run an ISMS, the Toolkit plus the Forum is the more useful combination.