Skip to content
Keel Docs

Get certified

The Get certified page (in the sidebar as Get certified, at the top of Overview) is your guided path to ISO/IEC 27001 certification. It tracks the milestones below, in order, and each one flips to done automatically when the corresponding work actually exists in your workspace, not when you tick a box. A progress bar shows how many of them you’ve met, and the next one to work is highlighted as Do this next.

The milestones

Section titled “The milestones”
  1. Define your ISMS scope: Clause 4.3 requires a documented scope: the boundaries and applicability of your ISMS.
  2. Run your risk assessment: Clause 6.1.2 requires an information security risk assessment to identify and evaluate your risks before treating them.
  3. Implement your controls: Clause 6.1.3 and Annex A: apply the controls that treat your risks, and get most of your applicable requirements covered.
  4. Generate your Statement of Applicability: Clause 6.1.3 d) requires an SoA stating which Annex A controls apply, with justification for inclusions and exclusions.
  5. Complete an internal audit: Clause 9.2 requires internal audits of the ISMS at planned intervals, ahead of your certification audit.
  6. Hold a management review: Clause 9.3 requires top management to review the ISMS for continuing suitability, adequacy, and effectiveness.

Each milestone links straight to the page where you do the work, and the Implement your controls milestone shows your live clause-coverage percentage for the framework.

When every milestone is met, Keel marks you certification-ready. You have the scope, risk assessment, controls, SoA, internal audit, and management review a certification audit expects. Keel gets you audit-ready; the certificate itself is issued by an independent certification body, not by Keel.

SOC 2

Section titled “SOC 2”

The SOC 2 tab on the same page follows the path to a SOC 2 report. A SOC 2 report is an attestation issued by an independent CPA firm, so this path ends at audit-ready rather than at a certificate. Its milestones:

  1. Define the system in scope: the description criteria (DC 200) describe one system, its boundaries and the Trust Services categories in scope. Security is always included.
  2. Run your risk assessment: CC3.2. Done when your register has at least one risk.
  3. Approve your policies: CC5.3. Done when at least one policy is approved.
  4. Implement your controls: CC5.1 and CC5.2. Done when most of the SOC 2 criteria are covered. This milestone reads SOC 2 only, so turn SOC 2 on in Frameworks first.
  5. Review your vendors: CC9.2. Done when at least one vendor has a recorded review.
  6. Complete an internal audit: CC4.1. Done when an internal audit is marked completed.

Next steps

Section titled “Next steps”