Free ISO 27001 and ISO 42001 tools
Eleven tools, all free, all answering on screen. Each one exists because a specific question kept arriving with no honest answer attached to it.
ISO certification is priced and scheduled differently from an attestation. Most of the confusion Canadian companies arrive with comes from reading American SOC 2 material and assuming it transfers. These eleven answer the ISO-specific questions, in Canadian dollars where money is involved, and none of them holds the answer back for an email address.
| Tool | What it answers | Questions |
|---|---|---|
| ISO 27001 cost calculator | What certification costs us across the full three-year cycle, in CAD, split between the certification body and everything else | 5 |
| Gap assessment | How far we are from being able to certify, scored across the four Annex A themes and the clause requirements, with what is blocking stage 2 | 6 |
| ISMS scope builder | Where the clause 4.3 boundary should sit, drafted as a scope statement, with the interfaces and dependencies we have to document | 6 |
| Which Annex A controls apply | How many of the 93 controls stay applicable, counted by theme, and which exclusions we would have to defend at stage 2 | 7 |
| Annex A control selector | Which Annex A controls our scope makes arguable to exclude, and the justification wording that argument needs | 6 |
| Risk treatment planner | One risk taken through analysis, evaluation and treatment under clauses 6.1.2 and 6.1.3, with what accepting the residual requires | 7 |
| Internal audit program builder | A clause 9.2 schedule, the auditor days it takes, and a straight answer on who can audit independently in a small company | 6 |
| Stage 1 readiness check | Whether the documentation review will go well, which required documents and records are missing, and what delays stage 2 | 7 |
| SOC 2 reuse estimator | We already have SOC 2. How much of it carries over, what is still missing, and what the second framework saves in CAD | 6 |
| ISO 42001 readiness | Whether an AI management system is in scope for us at all, and what a certification body will ask at scoping | 6 |
| ISO 27001 or SOC 2 | Which one our buyer actually meant, which to get first, and whether we will end up needing both | 5 |
Why these eleven
Each one answers a common question with a number or a decision nobody publishes, and prose is a poor way to deliver an answer that depends on six facts about you.
The four clause requirements that decide a first certification. Scope under 4.3, risk treatment under 6.1.2 and 6.1.3, internal audit under 9.2, and the stage 1 documentation review that reads all three. The scope builder drafts the boundary and lists the interfaces most first drafts omit. The risk treatment planner takes one risk the whole way through, including what accepting a residual risk actually requires. The internal audit program builder produces a schedule and then says plainly who can audit independently when the company has fifteen people in it. The stage 1 readiness check tells you which required documents are missing before an auditor does.
Two tools about Annex A, because they answer different questions. Which Annex A controls apply counts how many stay applicable in each of the four themes, which is the number a project plan is built from. The control selector writes the justification wording for the exclusions themselves.
Cost, over three years rather than one. ISO certification runs on a three-year cycle with surveillance audits in years two and three and a recertification at the end. A first-year figure is the deposit, not the cost, and budgeting from year one means the surprise arrives twice. The calculator gives the cycle total, the itemised breakdown takes the invoice apart, and surveillance audits covers years two and three.
The gap, including the half that gets skipped. ISO 27001 is 93 Annex A controls plus 25 clause requirements, and the clauses are where first projects fail. You can have every technical control running and still fail stage 1 because there is no management review, no internal audit and no Statement of Applicability.
Which controls are even in play. Most projects lose two days arguing about whether a remote company can exclude the physical controls. The control selector settles that from your scope and hands you the wording, and the Statement of Applicability page covers what to do with it.
What an existing SOC 2 is worth. Every comparison page says the two overlap and none of them says by how much. The reuse estimator splits it into the Annex A half, which carries over well, and the clause half, which barely does.
AI, where almost nothing is written. The ISO 42001 tool asks what a certification body asks at scoping: what the AI system decides, who is accountable, what data trained it, and whether anyone is watching it after deployment. It will tell you if you are not in scope, which is the answer more often than vendors suggest. The standard itself is on the ISO 42001 guide.
Which framework at all. ISO 27001 and SOC 2 answer different buyers rather than compete. European and UK procurement asks for ISO by name and often will not take a SOC 2 report; North American buyers do the reverse. The longer comparison is the reading version.
Nothing here is gated
Every result renders on the page as soon as the questions are done. The email field underneath each tool buys one thing: the written version, with the reasoning set out, in a form you can forward to a board or a finance team. Skipping it costs you nothing. A tool that shows a score and then asks for an address to reveal it is not a tool, it is a form with a progress bar.
Common questions
Do I have to give you an email address to see the results?
No. Every result renders on the page as soon as you finish the questions. The field underneath sends the written version with its reasoning set out, which is useful for forwarding to a board or a finance team. Skipping it costs you nothing.
Which tool should I start with?
If you are not certain which framework your buyer asked for, start with ISO 27001 or SOC 2, because everything else assumes the answer. If you know it is ISO 27001 and you are budgeting, start with the cost calculator. If you are already mid-project, the gap assessment tells you what is blocking stage 2.
Why does the cost calculator ask about surveillance audits?
Because ISO certification is a three-year cycle rather than a one-off. The certificate is valid for three years, with a surveillance audit in each of years two and three and a full recertification at the end. Budgeting only for the initial audit understates what certification costs by roughly a third.
Are the numbers in these tools real?
They are ranges built from Canadian certification body and consultant pricing, expressed in Canadian dollars, and they are ranges rather than single figures because a fair quote depends on scope and on how much already exists. Where a tool cannot narrow something honestly it says so rather than inventing precision.
Can a consultant certify us?
No, and this is the distinction that catches people. In Canada the Standards Council of Canada accredits certification bodies, the certification body issues the certificate, and a consultant can do neither. A consultant who implies they can certify you is either being loose with language or should be avoided.
Get quotes from Canadian firms
Tell us your scope and we will put it in front of firms doing ISO work in Canada.
Get matched