Your road to certification

The Roadmap page shows the way from your first steps to the certification audit. Peilaro works out what is done from what you record, so you never tick anything off by hand.

Start questions

An owner or admin answers a few questions first: the standards you work towards, your sector, the number of people and locations, what your organisation does and, if you know it, the target date for the certification audit. You can change the answers at any time with Change the answers.

When you describe what your organisation does and clause 4.3 (the scope) is still empty, Peilaro writes a first scope from your answers. It is a draft: open clause 4.3, check it and add what you leave out of the scope and why.

The eight phases

1. Context and scope: the clauses of chapter 4.
2. Risks: clause 6.1 (and for ISO 27001 the risk assessment and treatment in 8.2 and 8.3), plus at least one risk in the risk register.
3. Policies and objectives: chapter 5 and the rest of chapter 6, plus at least one objective.
4. Implementation: chapters 7 and 8, and the Annex A controls of ISO 27001.
5. Proof: proof for every clause that applies: a proof text, a file or evidence.
6. Internal audit: clauses 9.1 and 9.2, plus evidence of an internal audit on clause 9.2 in the last twelve months.
7. Management review: clause 9.3 and chapter 10, plus evidence of a management review on clause 9.3 in the last twelve months.
8. Certification audit: the earlier phases done, no open nonconformities and a target date.

A clause counts as done once you have written down how you meet it, or once you have excluded it. A clause that several of your standards share counts once. Each phase shows how many steps are done and the first open steps, each linked to where you do it.

Planning

With a target date, Peilaro shares out the time from the day you answered the start questions to that date over the phases. Each phase then shows a planned end, and Behind plan when that date has passed and the phase is not done yet. The planning is a guide; it does not change any deadline.

Next step

Your dashboard and start page show one next step: the single most useful thing to do now. That is the start questions when they are not answered yet, then a finding or recurring check past its deadline, then the first open step of the current phase.