ISO 27001 Workflow Automation: What You Can Automate
Oct 18, 202615 min read
ISO 27001 workflow automation means using software workflows, built in a tool such as Activepieces or elsewhere, to run the recurring tasks of an information security management system (ISMS) and to collect the evidence that they ran.
ISO/IEC 27001:2022 is the standard that defines that system, and it has 93 Annex A controls.
ISO 27001 workflow automation is the practice of configuring software to run recurring ISMS tasks, such as access reviews, control checks, and evidence collection, on a schedule with a retained record, while leaving risk decisions and other judgment calls to people.
Each one needs an entry in your Statement of Applicability, so you must record whether it applies and why, and the auditor will test those reasons.
Read the list below as the limits of this article's claims. Take from it that everything later is about reducing evidence work, not about buying compliance.
ISO 27001 workflow automation and what it covers
- A tool doesn't certify you.
- Only an accredited certification body audits and certifies.
- The 2022 edition has 93 Annex A controls, and that's the edition discussed here.
- Vendor facts were checked on 18 October 2026, so confirm plans and terms before you buy.
Those limits shape how to read the two subsections that follow.
Software is not what the standard asks for. It requires a managed system: defined scope, risk assessment, chosen controls, internal audit, management review, and proof that these happen repeatedly. It doesn't require any particular software.
An auditor samples your records and asks whether the process ran as you described, so a missing record counts against you even if the work was done.
What automation can and cannot do
When a task repeats and produces evidence, automation fits: access review reminders, ticket-backed approvals, onboarding and offboarding checklists, and scheduled exports.
It can't decide your risk appetite, judge whether a control is adequate, or accept a risk on management's behalf. Those decisions need a named person, and automating them leaves the auditor with a record nobody actually owns.
This takes minutes, not a project: automate it in Activepieces free.
Where automation fails ISO 27001 audits
When a record has no named owner and can't be traced to a defined process, automation fails the audit, and those are exactly the records an auditor samples.
40% of the more than 1,700 certified companies in DNV's analysis had severe findings at their initial audit, against 60% that passed cleanly, meaning that obtaining security certification does not eliminate the risk of critical security flaws.
Two in five teams therefore reach certification with something structurally wrong. The four patterns below are how a workflow adds to that share.
Run an access review nobody documented through a workflow and you repeat an undefined step faster. The auditor asks for the procedure first, and the automation isn't the procedure.
Evidence nobody reviews
Under clause 7.5.2, documented information must be identified and described, for example with a title, date and author. An export with no owner or timestamp fails on its face.
Alerts routed to a channel nobody triages are worse: the log proves the signal arrived and that nobody acted on it.
Pull the ticket, the configuration export or the log entry from the source system. A screenshot can't be re-queried, so the auditor has no way to confirm it's complete.
Alerts routed to a channel nobody triages are worse: the log proves the signal arrived and that nobody acted on it.
Green means only that the checks you configured passed. It says nothing about whether the risk assessment is current, the internal audit (clause 9.2) happened, or management review (clause 9.3) took place.
Certification is a certification body's decision after it audits those things, so a dashboard can support your evidence but can't replace it.
Someone has to defend risk acceptance, exception approval and scope changes to an auditor. A workflow that auto-approves an exception leaves a timestamped record with no one behind it.
ISO 27001 tasks ranked by audit value
Automate what an auditor samples on a schedule, because a workflow can produce that record every cycle without anyone remembering to.
The table ranks seven of them by what the auditor pulls, where a person must still sign, and how much work the build takes. The record is the product, so a workflow with no named human at the approval step isn't finished.
| Task | Annex A theme or clause | Evidence sampled | Human approval | Effort |
|---|---|---|---|---|
| Access reviews | A.5.18 access rights | Reviewer decision per account, with date | Reviewer confirms or revokes each account | Medium |
| Offboarding | A.5.18, A.6.5 | Ticket tying leaver date to removal | Manager confirms exceptions | Medium |
| Evidence collection | Clause 9.1 monitoring | Scheduled exports with timestamps | Control owner spot-checks | Low |
| Vendor reviews | A.5.19 to A.5.22 supplier security | Questionnaire, reviewer notes, renewal date | Reviewer judges the risk | Medium |
| Risk reminders | Clause 6.1, 8.2 | Risk owner's response to each prompt | Owner accepts or treats the risk | Low |
| Incident routing | A.5.24 to A.5.26 | Ticket from report to assignment | Responder classifies severity | High |
| Policy sign-off | A.5.1, Clause 7.5 | Acknowledgement per person per version | Policy owner approves the text | Low |
Read the Human approval column first. Every row keeps a person on the decision, and automation only moves the request to them and files what they did.
Automating ISO 27001 access reviews and offboarding
Start here. The auditor picks a sample of accounts and asks who reviewed each one and when. A workflow that pulls the account list from each system, assigns a reviewer, and stores the reviewer's answer produces exactly that.
Offboarding works the same way: the leaver date from HR triggers removal tasks, and the ticket closes only when someone confirms each one. Whether a contractor keeps access is still a human call.
Cheap to build, scheduled exports of configuration, backup status and training records replace the screenshot hunt before audit week. Policy sign-off is similar: the workflow tracks who acknowledged which version. It can't decide what the policy says, so keep the owner's approval upstream of distribution.
Once you reach routing, effort rises, because severity and vendor risk need judgment. Automate the handoff, the reminder and the escalation timer. Leave classification, vendor acceptance and risk treatment with named owners, so every record has someone behind it.
Compliance tools compared for ISO 27001
Pick the tool that collects the evidence your named owners sign off, once owners are named for the judgment calls. A dedicated compliance platform gives ready-made ISO 27001 structure, and a general workflow tool gives control over flow and data. GRC suites sit between them.
To see which trade-off you're accepting, compare the three approaches in the table on templates, integrations, flexibility and data ownership.
| Approach | ISO 27001 templates | Integrations | Flexibility | Data ownership |
|---|---|---|---|---|
| Compliance platforms (Vanta, Drata) | Prebuilt control mappings and policies | Focused on security and identity tooling | Fixed to their model of the audit | Vendor-hosted |
| GRC suites | Frameworks included, often configurable | Varies by suite | Moderate, with heavier setup | Usually vendor-hosted |
| General workflow tools | None; you build them | Broad, across business apps | High | Depends on the tool and where you run it |
I didn't confirm any starting prices on 18 October 2026, so the table quotes none. Get them from each vendor's pricing page, and assume nothing about what a quote includes.
Dedicated compliance platforms for ISO 27001 automation
Vanta and Drata are compliance-automation platforms: they connect to your cloud, identity and ticketing systems and collect evidence continuously. The gain is a mapped control set on day one.
The cost is that your process bends to their model, and your evidence lives in their hosted environment, so the platform needs the same security review as any vendor holding audit data.
Activepieces ships an MIT-licensed core, so a reviewer can clone the repository, inspect the code, and run it self-hosted or air-gapped, and that evidence closes a review faster than a vendor's word.
More configuration and more setup effort is what GRC suites charge for covering the same ground.
Nothing about ISO 27001 ships with a general workflow tool. You build the access-review reminder, the evidence pull and the approval routing yourself.
That's more work up front, but you decide what is stored and where it runs. Admin visibility then depends on the tool's audit logs and role controls, which is what the next section checks.
You can follow the rest of this with the builder open. Start free, no card.
What ISO 27001 automation costs and requires
Before any tool's audit logs matter, you need a scoped ISMS to feed, and you pay for it three ways: certification audit fees, internal hours, and a platform subscription.
Prerequisites for ISO 27001 workflow automation
Automation needs something to point at. Without these five, a workflow has nothing to collect evidence against:
- A scoped ISMS, with written boundaries for what the certificate covers
- An asset list inside that scope
- A completed risk assessment
- A statement of applicability stating which Annex A controls you apply and why
- A named owner for each control
Of the five, the owners matter most. A reminder with no named assignee goes nowhere, and an auditor will find that out in the sample.
Three years is the certification cycle, with annual surveillance audits in between. Your evidence collection therefore has to repeat every year, which is the case for automating it.
Typical ISO 27001 automation cost lines
For small companies, published initial-certification audit fees vary widely by source.
Currencies differ and scope assumptions aren't shared, so treat these as a rough band and get quotes against your own scope.
One line shrinks with automation, internal time, and the subscription is the line you add to do it.
One caveat comes with the economic case, which rests on breach cost: the figure covers security automation broadly, not ISO workflows specifically.
UnderDefense, citing IBM's Cost of a Data Breach report, puts a breach at $5.52m with no automation and $3.62m with extensive automation. That is $1.88m saved per breach, so a subscription is cheap against the downside.
It doesn't show that evidence-collection workflows alone produce that saving.
Whichever platform you choose will hold evidence and credentials, so it has to clear your own security review before it earns a place in the ISMS.
How Activepieces handles ISO 27001 workflow automation
There is no ISO 27001 certificate behind Activepieces, and no HIPAA claim.
As of 18 October 2026, it lists SOC 2 Type II, SSO, SCIM, custom RBAC, audit logs, EU or US cloud hosting and self-hosting. Your review therefore rests on SOC 2 and your own controls.
The table covers each item a security review will ask about. The core is MIT-licensed, so the self-host and air-gap rows can be checked in the repository, while the enterprise directories sit under a separate commercial licence.
SSO, SCIM, custom RBAC and audit logs are Enterprise Edition features; SOC 2, regions and self-hosting apply to either deployment, and cloud tiers are credit-based with a public pricing page.
| Requirement | What Activepieces offers | Plan | Cost |
|---|---|---|---|
| SOC 2 Type II | Attestation available | Either deployment | Not gated by sales |
| SSO | Supported | Enterprise Edition | Enterprise Edition pricing |
| SCIM | Supported, for automated user provisioning | Enterprise Edition | Enterprise Edition pricing |
| Custom RBAC | Roles you define yourself | Enterprise Edition | Enterprise Edition pricing |
| Audit logs | Record of activity on the platform | Enterprise Edition | Enterprise Edition pricing |
| EU or US cloud | Managed cloud in either region | Either deployment | Credit-based cloud tiers, listed on the public pricing page |
| Self-host or air-gap | Run it in your own network | Either deployment | Free Community edition available |
MoneyGram, Moneypenny, Alan and FundingSocieties run Activepieces in production; cloud tiers are listed on the pricing page, and Enterprise Edition details and security documents come from activepieces.com/sales.
Workflows it suits
These are the recurring jobs an auditor samples. Examples include pulling access lists from your identity provider on a schedule and filing them as evidence, opening review tickets for each system owner, and chasing overdue sign-offs.
SCIM keeps the platform's own user list in step with joiners and leavers, so the tool doesn't become an orphaned-account finding.
When someone changes a workflow, audit logs tell you who. They don't tell you the control worked, so keep a human approval step where someone must attest.
What ISO 27001 automation should not handle
Do not automate risk acceptance, scope decisions or the judgment on whether an exception is justified. A workflow can route those to a person, but it can't make them.
If you need an ISO 27001 certificate from the vendor, Activepieces doesn't supply one. A regulated team that needs data kept in its own environment can self-host.
Ask in review where credentials are stored, who can read run logs, and whether the audit log export meets your retention rule.
What vendor questions matter in ISO 27001?
Six questions cover the vendor side of the review: certifications, data location, subprocessors, audit log retention, access controls, and export. The previous section's questions on credentials and run logs sit inside that list.
Ask these in order on Monday, and get each answer in writing, because a verbal answer isn't evidence an auditor can sample.
- Ask which certifications the vendor holds, and request the certificate and its scope statement. A certificate covering the vendor's office but not the hosted product tells you nothing about where your workflows run.
- Ask where data is stored and processed, and get the region for workflow definitions, run payloads and logs separately. If run logs leave the region you chose, your residency commitment has a hole.
- Ask who the subprocessors are, and request the current list and the notification process for changes. Without a notification promise, a new subprocessor can touch your data before you know it exists.
- Ask how long audit logs are kept and whether you can export them, then compare the retention setting to your own rule. If the vendor keeps less than you promise an auditor, you need an export job, not trust.
- Ask what access controls exist, and look for SSO, role-based permissions and provisioning. Admin visibility shows you who has access. It doesn't remove access when someone leaves.
- Ask how you get your data out, and request a documented export of workflows and logs. If you can't leave cleanly, the exit clause in your supplier risk record is fiction.
For security documents and enterprise pricing, go through the sales page.
Build the access review and offboarding flows before anything else. Both are recurring, both generate dated records, and an auditor samples both.
Automate the reminder, the export of current user lists, the approval trail and the removal check. Leave the decision on who should keep access with a named human.
Frequently asked questions
Certification and SOC 2
Can software make me ISO 27001 certified?
No. An accredited certification body issues the certificate after auditing your management system, and software only supplies evidence.
The auditor still checks that people made the scope, risk and access decisions. An export of access reviews proves the review ran, not that anyone accepted the risk.
Is ISO 27001 the same as SOC 2?
No. SOC 2 is an attestation report from a CPA firm against trust criteria. ISO 27001 is a certificate against a management-system standard, built around your risk assessment and Statement of Applicability.
The controls overlap, so evidence gathered for one often serves the other, but neither report substitutes for the other.
Evidence collection and timing
Does ISO 27001 require automated evidence collection?
No. The standard requires you to monitor your controls and retain evidence that they operate. It doesn't say how.
Dated screenshots may be accepted, but a screenshot can't be re-queried. Automation earns its place because manual collection fails quietly between audits, when someone skips a quarter and the gap surfaces in the sample.
How long does certification take?
Months, not weeks, and the range depends on scope size and how much documentation already exists. The certificate isn't the end.
Surveillance audits recur annually, with a full recertification at the end of each cycle. Scheduled evidence jobs have to keep running the whole time.
Self-hosting
Can I self-host an automation tool inside my ISMS scope?
Yes, provided you scope it as an asset. A self-hosted instance falls under your own controls, so you own patching, access control, logging, backups and the review of those logs.
Admin visibility only counts if someone reads it. A hosted platform moves that burden to the vendor, and the vendor then has to pass your supplier review.
Related reading
Build it
Set this up in minutes.
No code required. Connect your accounts, and Activepieces runs it from there.
Start free Talk to sales
