Overview
Welcome to the comprehensive ISO 27001 prompt library—your complete collection of ready-to-use prompts for implementing, documenting, and maintaining ISO 27001:2022 compliance using ISMS Copilot. This library accelerates every phase of your ISMS journey from initial risk assessment through certification and ongoing management.
Who this library is for
This prompt library is designed for:
Organizations implementing ISO 27001 for the first time
Security and compliance teams preparing for certification audits
Consultants supporting multiple client implementations
Certified organizations maintaining and improving their ISMS
Teams transitioning from ISO 27001:2013 to 2022
What's included in this library
The ISO 27001 prompt library contains five comprehensive collections covering the complete ISMS lifecycle:
1. Risk assessment prompts
ISO 27001 risk assessment prompts help you conduct comprehensive risk assessments that form the foundation of your control selection.
What's covered:
Asset identification and classification
Threat and vulnerability analysis
Risk calculation and scoring
Risk treatment planning
Control mapping to Annex A
Risk documentation and reporting
Stakeholder validation
Ongoing risk management
Key use cases: Building asset inventories, generating threat scenarios, calculating risk scores, developing treatment plans, creating Statement of Applicability foundation
Start here if: You're beginning ISO 27001 implementation or need to update your risk assessment for audit readiness.
2. Policy and procedure prompts
ISO 27001 policy and procedure prompts help you create audit-ready documentation that demonstrates control implementation.
What's covered:
Information security policy creation
Access control policies
Asset management policies
Cryptography and data protection
Operations and infrastructure policies
Human resources security
Incident management policies
Third-party and supplier management
Physical security policies
Business continuity policies
Compliance and audit policies
Procedure writing and SoA development
Key use cases: Drafting comprehensive security policies, creating operational procedures, building Statement of Applicability, customizing documentation for your industry
Start here if: You've completed risk assessment and need to document how you'll implement controls through policies and procedures.
3. Control implementation prompts
ISO 27001 control implementation prompts provide practical guidance for implementing all 93 Annex A controls in your environment.
What's covered:
Organizational controls (A.5) - governance, roles, asset management
People controls (A.6) - screening, training, termination
Physical controls (A.7) - facility security, equipment protection
Technological controls (A.8) - access control, encryption, logging, backups, vulnerability management, secure development
Incident management implementation
Business continuity implementation
Supplier management implementation
Privacy and compliance implementation
Testing and verification approaches
Integration and automation strategies
Key use cases: Configuring technical security controls, designing operational workflows, implementing authentication and access controls, setting up monitoring and logging, automating control execution
Start here if: You have policies documented and need practical implementation guidance for your specific technology stack.
4. Audit preparation prompts
ISO 27001 audit preparation prompts help you prepare comprehensive evidence and documentation for certification and surveillance audits.
What's covered:
Gap analysis and readiness assessment
Evidence collection by control area
Internal audit planning and execution
Audit response preparation
Technical evidence compilation
Management system evidence
Supplier and third-party evidence
Specialized audit scenarios (cloud, remote work, multi-site)
Post-audit corrective actions
Audit readiness self-assessment
Key use cases: Conducting pre-audit gap analysis, collecting evidence packages by Annex A control, preparing for common auditor questions, conducting mock audits, creating corrective action plans
Start here if: Your certification audit is scheduled within 8-12 weeks, or you're preparing for surveillance/recertification.
5. Documentation and reporting prompts
ISO 27001 documentation and reporting prompts help you create mandatory ISMS documentation and communicate security program effectiveness.
What's covered:
Mandatory ISMS documentation (scope, context, roles, methodology, SoA, objectives)
Management system documentation
Operational documentation and runbooks
Risk management documentation
Performance metrics and KPI dashboards
Internal audit documentation
Management review materials
Incident and problem documentation
Change and release documentation
Compliance and legal documentation
Supplier documentation
Training and awareness records
Executive reporting and communication
Continuous improvement documentation
Key use cases: Creating mandatory ISMS documents, building KPI dashboards, preparing management review packs, documenting incidents, generating executive reports
Start here if: You need to create required ISMS documentation or develop reporting for management and stakeholders.
How to use this prompt library
For first-time implementations
Follow this sequence for comprehensive ISO 27001 implementation:
Risk assessment (Week 1-4): Use risk assessment prompts to identify assets, analyze threats, calculate risks, and develop treatment plans
Documentation (Week 5-8): Use documentation prompts to create mandatory ISMS documents (scope, context, methodology) and policy prompts to draft security policies
Implementation (Week 9-20): Use control implementation prompts to configure and deploy security controls based on your risk treatment plan
Pre-audit preparation (Week 21-24): Use audit preparation prompts to conduct gap analysis, collect evidence, and prepare for certification audit
Certification audit (Week 25-26): Use audit response and closing meeting prompts from the audit preparation collection
For audit preparation
If your audit is approaching:
12 weeks before: Run gap analysis prompts to identify missing documentation or evidence
8-10 weeks before: Use evidence collection prompts to gather proof of control implementation
6-8 weeks before: Conduct internal audits using internal audit prompts
4 weeks before: Prepare team using interview preparation and auditor question prompts
2 weeks before: Final readiness check using readiness assessment prompts
During audit: Reference audit response and documentation prompts as needed
After audit: Use corrective action prompts to address findings
For ongoing management
After certification, maintain compliance using:
Quarterly: Risk review, performance metrics, and management review prompts
Monthly: Executive reporting and KPI dashboard prompts
Ongoing: Incident documentation, change management, and continuous improvement prompts
Annually: Internal audit, risk assessment update, and policy review prompts
Best practices for prompt usage
Use a dedicated workspace: Create an ISO 27001 workspace in ISMS Copilot to maintain context across conversations. This allows the AI to build on previous outputs and understand your specific environment.
Customize with specifics: Replace bracketed placeholders [like this] with your actual details—company size, industry, technology stack, cloud provider. Specific inputs produce specific, actionable outputs.
Upload existing documentation: Before using prompts, upload your current policies, risk assessments, or technical documentation. AI can analyze what exists and suggest improvements or identify gaps.
Iterate and refine: Start with a basic prompt to get structure, then follow up with "expand section 3 with more detail" or "add examples for healthcare industry." Building iteratively produces better results than one-shot prompts.
Request reasoning: Add "show your reasoning" or "explain your recommendations" to prompts. This creates documentation of decision rationale that auditors appreciate.
Validate AI outputs: Always review AI-generated content with internal experts. AI accelerates creation but requires human validation for accuracy, completeness, and alignment to your actual implementation.
Don't over-rely on templates: Prompts provide frameworks and starting points. Customize outputs to reflect your actual environment, risks, and controls rather than using generic AI-generated content verbatim.
Understanding prompt structure
Prompts in this library follow a consistent structure designed for optimal results:
Task definition: Clear statement of what to create ("Write a...", "Generate a...", "Design a...")
Compliance reference: ISO 27001:2022 clause or Annex A control reference for traceability
Customization points: Bracketed placeholders [like this] for your specific details
Scope and inclusions: Specific elements to include in the output
Format guidance: Target audience, length, tone, or structure preferences
Example anatomy:
"[Task] Write an Access Control Policy [Compliance] for ISO 27001:2022 controls A.5.15-A.5.18. [Scope] Include: user provisioning, MFA requirements, privileged access management, and access reviews. [Customization] For a [industry] company using [identity system]. [Format] Target audience: all employees. Tone: clear and authoritative."
Common use patterns
Creating from scratch
When you need to create new documentation or controls:
Select the appropriate prompt from the library
Replace all [bracketed] customization points with your specifics
Add any additional context about your environment in a brief sentence
Review the output and ask follow-up questions to refine
Improving existing content
When you have existing documentation that needs enhancement:
Upload your existing document to the workspace
Use prompts like "Review this [policy/procedure] against ISO 27001:2022 requirements and identify gaps"
Follow up with specific improvement requests based on identified gaps
Iterate until the document meets audit requirements
Gap analysis workflow
When preparing for an audit or assessing current state:
Upload all existing ISMS documentation
Use gap analysis prompts to identify missing or weak areas
Prioritize gaps by audit impact and implementation effort
Use appropriate library prompts to address high-priority gaps
Re-run gap analysis to verify improvements
Integration with implementation guides
This prompt library complements our comprehensive implementation guides:
How to conduct ISO 27001 risk assessment using AI - Step-by-step methodology with examples of using risk assessment prompts
How to prepare for ISO 27001 internal audits using AI - Internal audit execution with prompt examples
How to prepare for ISO 27001 certification audit using AI - Certification preparation with audit readiness prompts
Recommended approach: Read the implementation guides to understand the methodology and requirements, then use the prompt library to accelerate actual deliverable creation.
Industry-specific adaptations
While prompts are designed to be industry-agnostic, you can adapt them for specific sectors:
Healthcare/HIPAA: Add "addressing HIPAA privacy and security rules" to policy and control prompts
Financial services/PCI DSS: Add "including PCI DSS requirements for [relevant SAQ level]" to relevant prompts
Public sector/FedRAMP: Add "aligned with FedRAMP [Low/Moderate/High] baseline controls" to control implementation prompts
SaaS/Cloud: Specify cloud provider and architecture in all technical implementation prompts
Manufacturing/OT: Add "including operational technology and SCADA systems" to scope and asset prompts
Multi-client consulting workflows
For consultants managing multiple client implementations:
Create client-specific workspaces: Separate workspace per client maintains context isolation
Establish client baseline: Document client specifics (industry, size, tech stack, regulations) at the start of each workspace
Reuse refined prompts: Save prompts you've customized and refined for one client to accelerate future clients
Build template library: Generate comprehensive templates in one workspace, then adapt for each client
Scale expertise: Use prompts to maintain consistent quality across all clients regardless of team size
Learn more: How to manage multi-client compliance projects using workspaces
Staying current with ISO 27001:2022
This prompt library is designed for ISO 27001:2022 including:
All 93 Annex A controls (updated from 114 in 2013 version)
New control themes (Organizational, People, Physical, Technological)
Updated clause requirements (simplified documented information)
Cloud and remote work considerations
Privacy and data protection alignment with GDPR
Threat intelligence and security monitoring focus
If transitioning from ISO 27001:2013, use gap analysis prompts to identify changes needed in existing documentation and controls to meet 2022 requirements.
Getting help and support
Additional resources to support your ISO 27001 journey:
ISMS Copilot workspace: Create your ISO 27001 workspace
Responsible AI use: How to Use ISMS Copilot Responsibly
Prevent hallucinations: Understanding and Preventing AI Hallucinations
Workspace optimization: Managing multi-client compliance projects
Compare AI tools: ISMS Copilot vs Claude for compliance work
Related compliance frameworks
Expand beyond ISO 27001 with our other prompt libraries:
SOC 2 prompt library - Complete prompts for SOC 2 Type I and Type II compliance
GRC engineering prompt library - Advanced prompts for governance, risk, and compliance automation
Contributing and feedback
This prompt library continuously evolves based on user feedback and ISO 27001 implementation experience. If you:
Discover particularly effective prompt variations
Identify gaps in coverage
Have suggestions for new prompt categories
Find prompts that need clarification or improvement
Your feedback helps improve this resource for the entire compliance community.
Ready to accelerate your ISO 27001 implementation? Choose the prompt library section that matches your current phase, create your ISO 27001 workspace, and start building your ISMS with AI assistance today.
Quick start checklist
Follow these steps to maximize value from this prompt library:
☐ Create dedicated ISO 27001 workspace in ISMS Copilot
☐ Define your starting point: new implementation, audit preparation, or ongoing management
☐ Select the appropriate prompt library section for your phase
☐ Gather context: company details, tech stack, industry, existing documentation
☐ Upload any existing ISMS documentation to workspace
☐ Start with foundation prompts (scope, context, risk methodology)
☐ Customize prompts with your specific details
☐ Review and validate AI outputs with internal experts
☐ Iterate and refine based on your actual implementation
☐ Document what works to build your own prompt best practices
Your journey to ISO 27001 compliance just became significantly faster and more efficient. Let's get started.