ISO/IEC 27001 Artifacts

ISO/IEC 27001 sets out what an organisation must have in place to run an Information Security Management System (ISMS): the governance covering its information security, and the ownership, scope and review that keep that governance honest. This is everything an ISMS under the names the standard gives them — including the ISO/IEC 27005 risk overlay.

When should I use this?

When your governance has to satisfy somebody outside the team that runs it: a certification audit, a customer's due-diligence questionnaire, a contractual security obligation. ISO/IEC 27001 is what those people ask for by name, and this is the vocabulary they arrive with, so the view lists each artifact under the name the standard uses rather than its catalogue title.

It is also where to start if you already run an ISMS and want to know which of these artifacts you are keeping, which you are keeping under another name, and which are missing.

Isn't Gemara enough?

For running the governance, largely yes. Gemara models the principles, guidance, controls, risks and policy you operate, in schemas a machine can read and a pipeline can act on. What it does not model is the management system around that work — who owns it, what falls inside its scope, which objectives it is measured against, how it gets reviewed, and what happens when it falls short. ISO/IEC 27001 is exactly that envelope, and unlike Gemara it is certifiable.

So the two are additive rather than alternatives. Some of the artifacts here are management-system objects the standard adds; the rest are ones it shares with Gemara under a different name.

How the artifacts connect

Context frames the scope, the resources in scope are assessed for risk, the Statement of Applicability selects the controls policy imports, and reviews and incidents raise corrective action.