Many procurement processes accept either. ISO 27001 has broader international acceptance; SOC 2 dominates North American technology purchasing. Organisations often pursue both, and the control overlap means a single evidence base can support each audit.

What is the difference between ISO 27001 and ISO 27002?

ISO 27001 is the certifiable management-system standard. ISO 27002 is the implementation guide for the Annex A controls that ISO 27001 references.

Can Lavawall® generate the Statement of Applicability?

Yes. Lavawall® generates Statement of Applicability documents from live evidence rather than from generic templates.

Buyer's guide · ISO 27001

Best ISO 27001 software for MSPs

ISO 27001 is the international information-security management-system standard that much of enterprise procurement requires alongside or instead of SOC 2. The best fit for an MSP covers the management-system clauses and the Annex A 2022 controls, is multi-tenant, and generates the Statement of Applicability from live evidence. Our top pick on those criteria is Lavawall®.

Start your compliance wizard See the selection criteria

Clauses 4 to 10 · Annex A 2022 · SoA generation · multi-tenant

ISO/IEC 27001 is the international standard for an information-security management system (ISMS). Certification requires an accredited body to audit an organisation against both the management-system requirements (clauses 4 to 10) and the Annex A controls.

For an MSP, the standard plays a dual role. It demonstrates credibility to enterprise procurement, and it is a billable readiness service you can deliver to clients. Both roles need continuous evidence mapped to the standard, across many tenants, without a separate product instance per organisation.

See what Lavawall® does

Built and used internally by ThreeShield, an audit firm in Calgary. Built for MSPs and lean IT teams. Cross-platform patching, M365 / Entra / Azure / Google Workspace breach detection, 15+ compliance frameworks, kernel-free application control, smart helpdesk, multi-tenant remote support. One platform, native CAD billing.

Start the compliance wizard GRC & 15+ frameworks See pricing

What to look for

Six criteria matter when an MSP evaluates ISO 27001 tooling.

Management-system coverage. Clauses 4 to 10, addressing context, leadership, planning, support, operation, performance evaluation, and improvement.
Annex A 2022 control mapping. Direct mapping across the 93 controls within the Organisational, People, Physical, and Technological themes.
Multi-tenant architecture. Per-client isolation, per-client billing, and branded reporting.
Continuous evidence collection. Real-time data from endpoints and cloud infrastructure rather than a point-in-time questionnaire.
Statement of Applicability generation. SoA documents derived from live evidence.
Workflow support. Internal audit and management review capabilities built into the platform.

Options to evaluate

Four categories of tool show up in ISO 27001 buying processes for MSPs.

Lavawall®

Multi-tenant MSP platform with ISO 27001 native.

Management-system coverage across clauses 4 to 10, direct Annex A 2022 mapping, and continuous endpoint and cloud evidence collection. Multi-tenant by design with per-client isolation and branded reporting, and Statement of Applicability generation from live evidence.

Best when: MSPs deliver ISO 27001 readiness across many client tenants and pursue certification for themselves.

Vanta / Drata / Secureframe

Single-tenant SaaS solutions.

Designed for individual companies pursuing certification. Polished onboarding for one organisation, not built for MSP multi-tenant delivery.

Best when: a single company is pursuing its own ISO 27001 certificate.

Hyperproof / Tugboat Logic

Enterprise compliance platforms.

Strong program management, with evidence integrated downstream from other collection tools rather than gathered from the endpoints themselves.

Best when: an enterprise has a dedicated GRC team and existing evidence collection.

ISMS.online / IsoSafe

Specialist ISMS platforms.

Emphasis on ISMS workflow depth and documentation. Strong on the management system itself, lighter on continuous technical evidence from endpoints and tenants.

Best when: an organisation wants a documentation-first ISMS workspace.

How Lavawall® fits

Lavawall® treats ISO 27001 as a first-class framework alongside SOC 2, CMMC 2.0, NIST CSF, CIS Controls, HIPAA, PCI DSS, and the Canadian privacy bundle. The management-system clauses and the Annex A 2022 controls map to live evidence Lavawall® already collects from Windows, macOS, and Linux endpoints and from M365, Entra, Azure, and Google Workspace tenants.

Because the same evidence base supports several frameworks, an MSP that has run ISO 27001 readiness for a client is most of the way to a SOC 2 deliverable for the same tenant. The Statement of Applicability is generated from live evidence, so it reflects what is actually configured rather than a template guess.

Multi-tenant by design lets one MSP run ISO 27001 readiness across many clients from a single console, with per-client isolation, per-client billing, and branded reports. ThreeShield, the Calgary audit firm that built Lavawall®, brings the assessment experience behind the control mapping.

Start your ISO 27001 readiness →

Frequently asked

ISO 27001 or SOC 2?: Many procurement processes accept either. ISO 27001 has broader international acceptance; SOC 2 dominates North American technology purchasing. Organisations often pursue both, and the control overlap means a single evidence base can support each audit.
What is the difference between ISO 27001 and ISO 27002?: ISO 27001 is the certifiable management-system standard. ISO 27002 is the implementation guide for the Annex A controls that ISO 27001 references.
Can Lavawall® generate the Statement of Applicability?: Yes. Lavawall® generates Statement of Applicability documents from live evidence rather than from generic templates.