The complete ISO 27001 and ISO 27701 toolkits together, with a purpose-written guide to the pairing where integration pays best: shared controls mapped once, one incident process with the 72-hour clock, one supplier register, and the two risk assessments kept properly separate.
If you hold or are building ISO 27001 and your customers process personal data through you, ISO 27701 is the natural next certificate, and this is the pairing where integration saves the most work: the privacy standard draws its shared security controls from the same catalogue your ISMS is already built on.
The full £465 product: 132 pages, nine files and the sixteen-sheet workbook with the 93-row Statement of Applicability. Nothing removed.
The full £545 product: 150 pages, ten files, the nineteen-sheet workbook and the 2019 transition annex. Nothing removed.
The mapping that makes this bundle pay: which privacy controls your existing ISMS evidence already satisfies, and how to reference it once from both Statements of Applicability. One record extended into a record of processing rather than a parallel register. One incident process with the privacy assessment step and the 72-hour clock. What must stay separate, above all the two risk assessments, because security risk is harm to you and privacy risk is harm to the individual. Plus the combined management review agenda and the twelve-step build order.
Not a summary. The actual questions an assessor puts about that document, and what to put in front of them. You will not find this in a template bundle, because template bundles are not written by people who have sat in the assessor’s chair.
Certification does not make you legally compliant, and the two are routinely confused. The statutory duties are mapped next to the clauses so neither is being satisfied by accident.
Every document carries a phase number in its header, from appoint through to learn. If you are lost, look at the header of whatever is in front of you and you know where you are.
Where a document must be produced by a competent specialist, such as a fire risk assessment, asbestos survey, legionella or health surveillance, the toolkit says so, explains how to commission one, and tells you how to judge whether what you were handed is any good. Selling you a template for those would be worse than selling you nothing.
Software companies and service providers whose customers ask for security and privacy evidence in the same questionnaire, organisations holding ISO 27001 whose contracts now mention 27701, and anyone building both from scratch who would rather build the shared machinery once.
Drafted for the United Kingdom with notes for Scotland and Northern Ireland, and structured so that the management system requirements carry across unchanged to any jurisdiction. Outside the UK you would replace the legal register entries with your own obligations; everything else holds.
Fully editable Microsoft Word and Excel in one zip. Every placeholder is in [SQUARE BRACKETS] so you can see at a glance what needs your input. Every guidance box is shaded so you know what to delete before you issue the document.
You may use, edit, adapt and rebrand everything within your own organisation, on as many sites and for as many people as you employ, and give completed copies to your certification body, assessor, clients, insurer or regulator.
You may not resell, share or distribute the blank toolkit outside your organisation, or repackage it as your own product.