Courses that teach these documents
Three official PECB certifications against ISO/IEC 27001:2022. What separates them is what you will do with an ISMS — understand it, build it, or audit it. The published packages include the examination voucher and a conditional free first retake. PECB’s partner-course policy sets a 12-month examination and included-retake cycle from purchase for Self-Study and eLearning, or from course completion for instructor-led training. A failed attempt does not restart that cycle. The first retake requires at least 15 days after the unsuccessful examination; booking rules and the recorded myPECB deadline also apply.
Understand the documents
ISO 27001 Foundation
$399 + GST
Describe the standard, the four Annex A themes, and how an ISMS runs day to day. The right starting point if you have been handed a Statement of Applicability and need to know what you are reading.
Official PECB exam voucher included
2 exam attempts — initial sit plus one free resit
Exam: 1 hour, closed-book
Write the documents
ISO 27001 Lead Implementer
$578 + GST
Scope an ISMS, run the risk assessment, and write the Statement of Applicability and risk treatment plan from a blank sheet. This is the method every template on this page came out of.
Official PECB exam voucher included
2 exam attempts — initial sit plus one free resit
Exam: 3 hours, open-book, scenario-based
Test the documents
ISO 27001 Lead Auditor
$578 + GST
Plan and lead internal, supplier and certification audits against ISO 19011 — including how a Statement of Applicability and a risk register get sampled, and what makes an exclusion defensible.
Official PECB exam voucher included
2 exam attempts — initial sit plus one free resit
Exam: 3 hours, open-book, scenario-based
Foundation is recommended but is not a prerequisite. Delivery formats vary by course. ISO 27001 Lead Implementer private one-to-one online training is available by enquiry; no public classroom venue or date is currently published. Aegentra Academy is an official PECB authorised training partner. See the full course catalogue.
The templates
Every file below is the real artefact, complete. Nothing is truncated to make you ask for the rest, and nothing is behind a form. Open the CSV in Excel, Google Sheets or Numbers and start editing.
They are written against ISO/IEC 27001:2022 including Amendment 1:2024 — the current 93-control Annex A across four themes, not the superseded 114-control 2013 edition.
93 controls
Statement of Applicability
All 93 Annex A controls, each with an applicability decision and a written justification, worked through for a fictional 100-staff Australian B2B SaaS. Includes one exclusion with scope-based reasoning to evaluate against the applicable audit criteria.
18 risks
Risk register
18 worked risks with inherent and residual scoring, treatment decisions, named owners, and the Annex A controls that treat each one.
17 elements
Internal-audit plan
Define the audit objective, criteria, scope, methods, responsibilities, schedule, interviewees, independence position and sampling rationale before fieldwork begins.
25 clauses
Clauses 4–10 audit checklist
Worked lines of enquiry to help plan clause-based checks and evidence requests.
2 worked findings
Nonconformity and corrective-action record
Record the criterion, objective evidence, observed gap, correction, cause, corrective action, owner, due date and effectiveness verification.
14 sections
Audit-report structure
An illustrative structure to adapt to the agreed audit scope, methods, evidence, findings and reporting requirements.
17 obligations
APRA CPS 234 and DISP mapping
Selected APRA CPS 234 and Defence Industry Security Program obligations mapped to potentially relevant ISO 27001 clauses or Annex A controls and evidence examples.
Statement of Applicability template
The Statement of Applicability records the necessary controls, the reasons for including them, whether they are implemented, and the justification for excluding Annex A controls. Use it to connect your control decisions with your scope, risk treatment and applicable requirements.
This template carries all 93, each with an applicability decision, a written justification, and the implementation status. It is worked through for a fictional 100-staff Australian B2B SaaS business, and it includes one worked exclusion — A.8.30 outsourced development — argued from scope rather than from convenience, which is the distinction an assessor is testing.
For the control catalogue on its own, see the full list of all 93 Annex A controls.
Risk register template
This worked register records inherent and residual risk assessments before and after treatment. The scores reflect the assessment method; they do not by themselves demonstrate that a control operated effectively. Retain supporting evidence and record the relevant risk-owner approval and acceptance decisions.
Each row carries a named owner, a treatment decision — modify, retain, avoid or share — and the Annex A controls that treat it, so the register and the Statement of Applicability reconcile against each other. Auditors cross-check exactly that: a control marked applicable with no risk driving it, or a risk with no control treating it, is where the questions start.
APRA CPS 234 and DISP mapping template
This worked mapping links selected APRA CPS 234 and Defence Industry Security Program obligations to potentially relevant ISO 27001 clauses or Annex A controls and evidence examples. Check the obligations that apply to your organisation and assess the evidence against each requirement. An ISO mapping or certificate does not by itself establish compliance with those obligations.
This is the Australian-specific piece that generic templates omit. If you are an APRA-regulated entity or in a Defence supply chain, the question is never "are we ISO 27001 certified" — it is "which control answers this obligation, and what do we show the assessor". That is what the mapping is for.
Audit artefacts — the other side of the standard
The three documents above are what you produce to build an ISMS. These four are what you produce to verify one — the working papers a Clause 9.2 internal audit generates, and what a certification body reads as evidence that the audit happened properly.
All seven describe the same worked organisation, so you can follow one company end to end: Statement of Applicability → risk register → audit plan → checklist → nonconformity → report.
Open the free ISO 27001 Clause 9.2 working pack for all four audit files and practical guidance on scope, objectivity, sampling, findings and corrective-action close-out.
The audit checklist covers Clauses 4 to 10 only, and that is deliberate. Those clauses are mandatory for everyone. Annex A is sampled risk-based against your Statement of Applicability, so a fixed Annex A checklist cannot be correct for two different organisations — anyone selling one is selling a shape, not an audit.
Governing AI as well? The ISO 42001 course pages publish the same way for AI management systems — an AI system inventory, a Clause 8.4 impact assessment, and Australia’s 10 Voluntary AI Safety Standard guardrails mapped to ISO 42001 clauses.
If you would rather have the audit run for you, we deliver independent Clause 9.2 internal audits. To run them yourself, the ISO 27001 Lead Auditor course teaches the method these papers came out of.
How to use them without failing Stage 2
Use the structure. Write your own content. The columns, the justification wording and the way exclusions are argued are transferable; the asset list, the scope and the risk scores are not.
- Define your ISMS scope first. The Statement of Applicability is downstream of scope — filling it in before you have written a scope statement produces a document that argues for controls you may not need.
- Run your own risk assessment before touching the register. The register is the output of the method, not a substitute for it. Clause 6.1.2 requires the method to be documented and repeatable.
- Rewrite every justification in your own words. Copied wording does not establish that the decisions fit the organisation or are owned and implemented.
- Keep the revision dates current. Auditors check them. A register written once and never reviewed fails clause 8.2 regardless of how good the rows are.
- Reconcile the two documents against each other before Stage 1. Every applicable control should trace to a risk or applicable requirement; every unacceptable risk should have an owned treatment decision.
For the wider sequence these documents sit inside, see the ISO 27001 implementation checklist and the ISO 27001 certification guide for Australia.
What a template cannot do for you
Templates do not secure an audit appointment, complete an internal audit or management review, or demonstrate that controls operate. Confirm the certification body's availability and readiness requirements early, allow time to address findings, and retain operating evidence as the work is performed.
The other constraint is ownership. Programmes succeed when one named person owns the ISMS and has the authority to get evidence out of other teams. Only 34 of the 93 controls are technical — HR owns screening and offboarding, legal owns supplier clauses, management owns the review.
If the internal audit is the gap, we run independent Clause 9.2 audits. If you want to own it yourself, the PECB ISO 27001 Lead Implementer course teaches the method these documents came out of.
FAQs
Are these ISO 27001 templates really free?
Yes. There is no email gate, no form, and no account. The files are published directly at aegentra.com.au/downloads and you can open them right now. We publish them ungated because a template behind a form is indistinguishable from one that does not exist — and because an AI assistant answering a question about the Statement of Applicability cannot fill in a lead-capture form.
What format are the templates in?
Each one ships as a CSV and as a PDF. The CSV is the working file — open it in Excel, Google Sheets or Numbers and edit it directly. The PDF is the same content laid out for reading and circulation. The CSV is the source of truth: the PDF is generated from it, so the two can never drift apart.
Can I use these for my own certification audit?
You can use them as the structure, and that is genuinely most of the work — the columns an auditor expects, the justification wording, and the way exclusions are argued. What you cannot do is submit them as-is. Your Statement of Applicability has to reflect your scope and your risk assessment, and an auditor who sees somebody else’s asset list will treat the whole ISMS as unowned. Use the shape; write your own content.
Does the Statement of Applicability really need all 93 controls?
Use all 93 Annex A reference controls as a completeness check, not as a requirement to implement every control. Your Statement of Applicability records the controls your organisation needs, why they are included, whether they are implemented, and the justification for excluding any Annex A controls. Necessary controls can also come from other sources. The controls and decisions must reflect your ISMS scope and risk treatment; the standard does not prescribe a particular table layout.
How many risks should a risk register have?
There is no required number, and auditors do not count them. What they check is whether the register is consistent with your risk assessment method, whether every unacceptable risk has a treatment decision and a named owner, and whether the revision dates show it has been reviewed rather than written once. An 18-risk register that is current beats a 200-risk register that was last touched a year ago.
What is the difference between inherent and residual risk?
Inherent risk describes exposure before the controls considered in your assessment; residual risk is the risk remaining after treatment. Define these terms consistently in your risk assessment method and record the basis for your evaluations, treatment decisions and risk-owner acceptance. A lower residual score is an assessment, not proof that a control works. Use relevant operating records, testing and review to evaluate control effectiveness.
Do these templates cover ISO 27001:2022 or the 2013 version?
ISO/IEC 27001:2022, including Amendment 1:2024. The Statement of Applicability carries all 93 controls in the current four-theme structure — organisational, people, physical and technological. If you are still running a 2013-era ISMS with the 114-control Annex A, the SoA doubles as a transition mapping.