93
Annex A controls and 55 clauses
All 93 controls of Annex A sit beside the 55 requirements of clauses 4 to 10, each already linked to the controls that satisfy it.
Frameworks
Purplecop GRC · ISO/IEC 27001
ISO 27001 that keeps running between audits
Most ISO 27001 programmes spend months building spreadsheets, policies and evidence folders, then rebuild them before every audit. Purplecop GRC keeps controls, policies and proof in one place, so the work is done once and stays done.
The difference
From a spreadsheet project to a running system
Four jobs that used to be manual, and what happens to them on Purplecop.
Why Purplecop
What only Purplecop brings to ISO 27001
ISO 27001 sits on the same library as 74 other frameworks, so it is never a standalone project.
One control, many frameworks
A control shared across frameworks is created once in the library, not rebuilt for each one. The work you do for ISO 27001 counts toward everything else you hold.
Map once, satisfy many
AI Policy Builder
Start from a ready-made policy, not a blank page. Each one is tagged to the frameworks it supports and goes through review in the same place.
AI Policy Builder
Auditors read-only, can still flag a gap
External auditors get read-only access enforced on the server, across four roles from Lead Auditor to Observer — with one exception: they can raise a correction request when a requirement is not met.
Audit management
A control score anyone can explain
Control effectiveness is six weighted factors, from the audit conclusion to assurance, so anyone can see why a control scored what it did.
Audit management
What you get
Built on one platform, with people who use it
Platform
Purplecop GRC
The whole GRC estate in one product: frameworks, controls, policies, evidence, risk and audit on one control library.
FrameworksControlsPoliciesEvidenceAudit managementCorrective actions
Services
Practitioners beside the platform
The team that runs your engagement works inside the same system, so the work they do stays with you.
Also on the platform
TPRM
Onboard, assess, score and continuously monitor every vendor in one workflow.
Third-party risk
Asset Intelligence
Asset discovery, network monitoring and the audit log in one module, so every asset’s data lives in one place.
Asset Intelligence
Phishing Simulation
Live phishing campaigns with per-user risk scores, run entirely in-house.
Human layer
LMS
Role-based security awareness training for every employee, tracked to completion.
Human layer
People
A directory of the people in scope for training, policy sign-off and access reviews.
People
RBAC
Role-based access control with granular permissions, on a least-privilege model.
Access control
Questions
What teams ask us about ISO 27001
Are Annex A controls included?
Yes, all 93 of them, beside the 55 requirements of clauses 4 to 10. Your Statement of Applicability records which controls apply and why, and our practitioners set it up with you during onboarding on the platform.
Does Purplecop certify us?
No. Certification comes from an accredited certification body. Purplecop GRC holds the work they review, and we have access to many credible certifying bodies we can align you with.
Can we reuse the work for SOC 2?
Yes, wherever a control overlaps. A shared control is created once and counts toward every framework it serves.
How much faster is it?
It scales with how much you integrate: the more connectors you turn on, the more evidence is collected automatically, saving up to 70% of the time you used to spend preparing for each audit.
See it against your own scope
We will walk the product against your scope and show you what runs on day one and what needs configuring.