ISO 27001 Toolkit

Yes. The Lite edition is India-defaulted out of the box — DPDP 2023 references, IT Act SPDI alignment, and CERT-In 6-hour incident reporting are wired into the relevant policies. For international buyers you also get the SOC 2 and GDPR crosswalks on the Pro edition, so the same documents work in both audit contexts without parallel paperwork.

Lite (79 docs) is the minimum mandatory set — 27 ISMS core policies + 38 Annex A composite policies + 14 implementation guides. Pro (108 docs) adds 29 depth documents: per-control CIS hardening baselines for Linux/Windows/AWS/Azure, OWASP secure-coding standards, Cert-In forensics, ISO 2013→2022 transition map, and ISO×SOC 2 / ISO×DPDP crosswalks. Extended (316 docs) layers 208 evidence supplements on top — 52 Priority-1 documents each get an Implementation Checklist, Action Items Tracker, Evidence Register, and Gap Analysis workbook.

AI accelerates the first draft. Every clause-mapped policy is then reviewed by a human auditor with experience implementing ISO 27001 across SaaS, BFSI, and healthcare engagements before it ships. The standard's intent doesn't translate well to pure-LLM output — you'd fail at Stage 1.

Lean teams using Lite typically reach Stage 1 readiness in 8 weeks — there's a dedicated 8-Week Quickstart Playbook bundled with every edition that breaks it into weekly milestones. Pro buyers with the audit-prep workbooks usually run 6 weeks because the evidence collection is pre-templated. Extended buyers with the supplements average 4 weeks because Gap Analysis and Action Items Tracker remove most of the project-management overhead.

For Lite + Pro, no — the documents are written assuming an internal lead (typically your CISO, CTO, or compliance manager) running the engagement. Extended is designed to be consultant-friendly: the supplements give a consultant a turnkey package to deliver. Either way, you can find ISO 27001 consultants on the Audita marketplace when it goes live.

Yes. All documents ship as native .docx and .xlsx — open and edit in either suite without conversion. Redline marks and comment threads preserve correctly. The hardening baselines (Pro edition) specifically cover Microsoft 365 and Google Workspace configuration alongside the underlying OS and cloud platforms.

The documents reflect the current ISO/IEC 27001:2022 standard, every policy is clause-mapped, and the Statement of Applicability + Risk Register are pre-loaded with 40 typical risks for a mid-sized SaaS. Whether your specific audit passes depends on your implementation, not just paperwork — but many buyers achieve first-time certification using these as the framework, customised to their context. Extended adds Evidence Register and Audit Checklist supplements that walk the auditor's path for you.

The Pro and Extended editions include an explicit 2013→2022 transition map showing which old controls merged, which were retired, and which are new. If you already certified against 2013, you can use this to plan a transition audit by your current October 2025 deadline.

Each licence binds to a single legal entity, named at checkout and embedded in every file's watermark. For multiple entities — subsidiaries, consulting clients, separate brands — buy one licence per entity. The Audita Consultant Pack (when launched) is designed for consultancies running engagements across many clients.

Refunds before first download are available within 7 days of purchase — write to hello@audita.in with your order ID. Once the first document is downloaded the licence is considered used (the watermarking is irreversible). The free sample chapter exists to validate fit before purchase; we'd rather you read it than refund.

When ISO/IEC 27001 revises, Audita issues a corresponding new toolkit version. Buyers with an active update subscription get the new version automatically. Buyers without keep their purchased version forever but would need to upgrade separately. The 2013→2022 transition map shipped with Pro+ is an example of how we handle major edition changes.