ISO/IEC 27001:2022 · complete and available today
The Canadian half of the standard, already written
Every ISO 27001 toolkit on the market is written for a British or American buyer. They run from about sixty dollars to fifteen hundred, and every one of them leaves the Canadian work to you — PIPEDA, Quebec’s Law 25, OSFI where it applies, and the two different retention clocks nobody outside Canada has heard of. This is that work, finished.
Not sure yet? Five of these documents are published in full on this site and cost nothing. Read the Canadian control crosswalk, the AI acceptable use policy, the privacy breach response policy and the vendor review policy. The first four are in the pack. The fifth, the SOC 2 crosswalk, is not in any pack — it is free because an American customer asking for a SOC 2 is one of the commonest reasons a Canadian firm ends up here, and we would rather you had the map. If they are not the standard of work you want, do not buy it.
Full ISMS pack — 49 documents
Buy this if you are building a management system, from scratch or nearly. Everything ISO/IEC 27001:2022 needs, written for a Canadian organisation from the start rather than translated afterwards.
- All fourteen documents the standard mandates under clauses 4 to 10 — scope, policy, both risk methodologies, objectives, audit programme, management review.
- Sixteen topic policies across the Annex A themes, from access control to secure development.
- Registers that do the arithmetic — risk scored and banded automatically, a supplier register that flags expired assurance, a breach register calculating both retention clocks.
- Audit checklists by clause and by all 93 controls, an evidence index and a readiness self-check.
- The complete Canadian overlay, listed opposite.
- A Stage 1 and Stage 2 preparation guide on why first attempts actually fail.
CAD $1,450
Buy the full pack — $1,45049 documents in 30 files · Word and Excel · emailed within one working day
Canadian overlay only — 8 documents
Buy this if you already own a toolkit, or already hold the certificate. It adds only the Canadian layer the international vendors leave out, and drops on top of whatever you have.
- Statement of Applicability with the Canadian obligation column — 54 of the 93 controls carry one.
- Legal and regulatory register, arriving populated with fifteen Canadian instruments from PIPEDA and Law 25 to OSFI B-10 and the defence-supply CPCSC. Competitors ship this empty.
- Breach register built for both clocks, calculating the 24-month federal and 5-year Quebec retention dates from one entry.
- PIPEDA principles map and a Law 25 obligations register with owners, evidence and status.
- Automated decision inventory for section 12.1, which attaches whether or not anyone calls the system AI.
- Transfer outside Quebec assessment and a privacy impact assessment.
CAD $450
Buy the overlay pack — $4508 documents in 6 files · Word and Excel · emailed within one working day
EU overlay — 8 documents
For a Canadian organisation selling into the European Union. Drops on top of the core pack, or works on its own alongside a toolkit you already own.
- Statement of Applicability with a European obligation column — 59 of the 93 controls carry one. The other 34 say so plainly rather than pretending.
- Legal register arriving populated with fifteen instruments, including three most Canadian sellers have never heard of: the revised Product Liability Directive, which makes software a product from December; the European Accessibility Act, which has applied to e-commerce since June 2025; and DORA, which reaches you as a supplier to a financial entity even though you are not one.
- Article 30 records of processing, controller and processor versions, with worked examples.
- Breach register that calculates the 72-hour clock from the moment you became aware, and turns red when it passes.
- AI Act obligations register carrying the real dates after the Digital Omnibus — Article 50 transparency live since 2 August 2026, synthetic-content marking due 2 December, high-risk deferred to December 2027.
- Article 27 representative appointment and mandate, Chapter V transfer assessment, and a DPIA aligned to Article 35.
CAD $450
Buy the EU overlay pack — $450Secure checkout by Stripe · files emailed within one working day
UK overlay — 8 documents
The United Kingdom is no longer the EU with a different flag. The Data (Use and Access) Act 2025 came fully into force this year and moved the law in twelve places.
- The DUAA divergence register — every point where UK law has left the EU GDPR, with the date each took effect. Nothing in a generic toolkit covers this, because most of it did not exist eighteen months ago.
- Statement of Applicability with a UK obligation column, and ten controls that carry a different answer here than in the EU pack.
- Legal register with twelve UK instruments — UK GDPR, the DPA 2018, the DUAA, PECR with its new £17.5m ceiling, PSTI, and the Computer Misuse Act, which is why you get written authorisation before a penetration test.
- Records of processing and a breach register on the ICO route, with the 72-hour clock calculated.
- UK Article 27 representative — a separate appointment from the EU one, because since Brexit each is a third country to the other.
- Transfer assessment built on the DUAA data protection test, which asks a different question from the EU standard, with the IDTA and the UK Addendum.
CAD $450
Buy the UK overlay pack — $450Secure checkout by Stripe · files emailed within one working day
Buying more than one
Both overlays — $795
The EU and UK packs together, saving $105. Sold separately rather than merged because the two regimes are now separate laws that agree on most things and differ on twelve that matter — a combined pack would have to pretend otherwise, which is the error that costs people money.
Buy both overlays — $795 · files emailed within one working day.
The full pack and both overlays — $2,100
The core ISMS pack, which already contains the Canadian overlay, plus the EU and UK packs. Bought together, $2,100 — $250 less than separately. If you are certifying and selling into both markets, this is the whole documented position.
Tell us on the enquiry form and we will send one invoice.
The questions people ask before buying
What format is it, and can I edit it?
Word and Excel. Nothing is locked, watermarked or protected. Rebrand it, cut what does not apply, extend what does — it is yours to change. The spreadsheets have shaded cells for you to complete and a small number of blue cells that calculate themselves.
How does it arrive, and how quickly?
By email, as a zip, within one working day of payment. There is no account to create, no portal to log into, and no subscription. We will not add you to a mailing list.
Do I still need to buy the standard?
Yes. ISO/IEC 27001:2022 is copyrighted and must be obtained from ISO or the Standards Council of Canada. Nothing in the pack reproduces its text — every description is written in our own words, which is also why we can sell it.
Why is this more expensive than a $59 toolkit?
Because those toolkits are written for British and American buyers and stop where Canada starts. Fifty-four of the ninety-three controls in our Statement of Applicability carry a specific Canadian obligation, and the legal register arrives populated rather than blank. If you do not need that, buy the cheaper one — we would rather say so.
Will it make us certified?
No. Certification is issued only by an accredited certification body, which we are not and do not intend to become. Documents save you the drafting; operating the system is what earns the certificate. The pack includes a guide on what auditors actually test.
I am a consultant. Can I use these with clients?
Not on a single-organisation licence, but ask us and we will licence it properly. We would rather sell you the right licence than find out later. The full licence terms are published here, so you can read them before you pay.
What if something is missing or wrong?
Tell us and we will fix it or refund you. Where we materially revise a document you have bought, you get the revision free for twelve months. We would rather refund a dissatisfied buyer than argue with one.
Can I add help from you?
Yes — ninety minutes on the three things people get wrong before an audit: the scope statement, the Statement of Applicability, and controls excluded without a defensible justification. Recorded if you want it, with one follow-up round by email.
Add $750
Overlay with session $1,200 · Full pack with session $2,200. Tell us when you order and we will invoice the difference.
Are they available in French?
The packs are supplied in English. Our runbooks are published in English and French Canadian, and the free first-hour checklist is on this site in both — so the writing exists in French and the translation is a known quantity rather than a hope.
If you need a pack in French Canadian, ask before you buy and we will tell you honestly what is possible and when. Sixteen documents of registers and forms is a larger job than a runbook, and we would want a Québécois professional read before handing it to you.
What this is not
Documents are not a certificate, and we will never be your certification body.
Certification against ISO/IEC 27001:2022 is issued only by an accredited certification body. We are not one and do not intend to become one. Buying documents does not make you compliant — it saves you the drafting so your time goes on operating the thing, which is the part that actually matters. You will also need the standard itself, which is copyrighted and must be bought from ISO or the Standards Council of Canada. Nothing in these packs reproduces its text; every description is written in our own words.
And a rule we hold ourselves to, in writing: we will not carry out an independent assessment of a management system built on documents we sold you. If you want both, we will tell you plainly which one to buy elsewhere. Independence is the only thing that makes our findings worth anything, and we are not trading it for a document sale.
Still deciding?
Read the four free documents first — they are complete, not extracts, and they are in the pack. If you would rather be invoiced than pay by card, or you want the working session added, tell us and we will send an invoice instead. Nobody will chase you.