ISO 27001 Risk Assessment Tools: Best Software Compared

The best ISO 27001 risk assessment tool for a company certifying for the first time is one that produces the Statement of Applicability from the register instead of asking you to write it separately, because that is the document where spreadsheet-run programs fail their first surveillance audit. For a small company certifying against ISO 27001 alone, Conformio publishes the lowest entry price ($169 a month). For a US team of 5 to 200 that also runs SOC 2, Complies keeps the register, the controls and the evidence in one record at $199 a month. Vanta, Drata, Secureframe, Sprinto, ISMS.online and CyberComply all sell a risk module, and none of them publishes a price.

Search for ISO 27001 risk assessment tools and you get two kinds of page: six-step method guides that never name a product, and vendor listicles that rank the author first. Neither answers the buyer's actual question, which is what the auditor will read from and which tool records it. This roundup does both. Every price below was read off the vendor's own pricing page in September 2026, and where a vendor publishes nothing, the table says so rather than repeating a directory estimate.

ISO 27001 risk assessment tools compared

The column that matters most is the third one. Clause 6.1.3 d) of ISO/IEC 27001:2022 requires a Statement of Applicability that lists every necessary control, whether it is implemented, and a justification for each inclusion and exclusion. When the SoA is a separate document, it stops matching the register the first time a risk changes, and the auditor finds a control marked applicable that no risk requires. A tool earns its place on this list by making that drift impossible. Our page on the ISO 27001 Statement of Applicability walks through what the auditor reads in it.

What an ISO 27001 risk assessment tool has to record

The standard is shorter than the templates built around it. Clause 6.1.2 asks for five things: written risk acceptance criteria and assessment criteria, a method that gives consistent and comparable results, risks identified within the ISMS scope with a named owner each, an analysis of consequence and likelihood producing a level, and an evaluation of that level against the criteria to set treatment priority. Clause 6.1.3 then asks for treatment options, the controls those options need, a comparison against the 93 controls in Annex A, the SoA, a treatment plan, and the risk owners' approval of that plan and acceptance of residual risk. Clause 8.2 requires the whole thing to be repeated at planned intervals and on significant change.

A tool that stores those fields is adequate. A tool that enforces them, by refusing a risk without an owner, applying one scoring scale to every row, and putting the next review on a calendar, is what separates a register that passes stage 2 from one that also passes the surveillance visit a year later. The ISO 27001 risk management software page lays out each clause against what Complies records for it, and the ISO 27001 controls list covers the 93 Annex A controls the treatment step is checked against.

Dedicated risk tools, compliance platforms, or a spreadsheet

There are three shapes of product here and they suit different companies.

Dedicated ISO 27001 risk tools such as Conformio and CyberComply are built around the 27001 and 27005 method. They walk you through criteria, assets or scenarios, scoring, treatment and the SoA, and they produce the mandatory documents in the format an auditor expects. They are the right buy for a company certifying against ISO 27001 only, with no SOC 2 or HIPAA on the roadmap, and Conformio is the only one of them that publishes a price.

Compliance platforms such as Complies, Vanta, Drata, Secureframe and Sprinto treat the risk register as one module inside a control library shared across several frameworks. The advantage is that a risk scored once serves ISO 27001 and SOC 2, and the controls treating it collect evidence from your cloud and identity providers on a schedule. The disadvantage, for the big four, is that you cannot see a price before a sales call. Our best ISO 27001 software roundup compares those platforms on the whole certification, and the ISO 27001 software pricing page gives the contract medians for the ones that will not quote.

A spreadsheet is legitimately compliant and thousands of certified companies use one. It fails in a predictable place, which the next section covers.

Can I use a spreadsheet for the ISO 27001 risk assessment?

Yes. A spreadsheet meets ISO 27001 if it applies documented criteria, records an owner, consequence, likelihood and level for every risk, links each treatment to controls, and is kept as dated versions so that this year's assessment can be compared with last year's. Certification bodies accept spreadsheet-based assessments every week. Where it breaks is clause 8.2: nothing in a spreadsheet makes the review happen at the planned interval, nothing flags a revisit when a new vendor or system enters scope, and the Statement of Applicability has to be reconciled by hand each time. Companies leave the spreadsheet after the first surveillance audit asks how the register changed in twelve months and the honest answer is that it did not.

Does ISO 27001 require an asset-based risk assessment?

No. The requirement to identify assets, threats and vulnerabilities was removed in the 2013 revision and is not in the 2022 edition. An asset-based method is still the most common way to run the assessment and ISO/IEC 27005:2022 describes it, but a scenario-based or event-based method that satisfies clause 6.1.2 is equally acceptable to an auditor. What gets checked is that the method is written down, applied the same way each time, and produces results you can compare across assessments. Pick the method your team will actually repeat, and choose a tool that supports it rather than one that forces a template on you.

If you do go asset-based, the scoping step is where most registers miss things. Production is easy; the systems that get forgotten are backups, logs, analytics pipelines, support tooling and the long tail of SaaS subscriptions nobody in security signed off on. A quick way to surface that last group is to pull the list of software vendors your finance team is actually paying from your expense management software, then reconcile it against the register; the gap between the two lists is usually the most useful finding of the whole exercise.

How often should an ISO 27001 risk assessment be done?

The standard does not name a number. Clause 8.2 says at planned intervals or when significant changes are proposed or occur, and the interval is yours to set in the methodology. Annual is the working norm, usually timed with the internal audit and ahead of the surveillance visit. The trigger that matters more is change: a new product line, a new cloud region, a vendor that now holds customer data, an acquisition or a serious incident should each prompt an update rather than waiting for the anniversary. A good tool makes both kinds of review visible, the scheduled one on a calendar and the triggered one as a flag when scope changes.

How much do ISO 27001 risk assessment tools cost?

Between nothing and a five-figure annual contract, depending on the shape you buy. A spreadsheet is free. Conformio publishes $169 to $349 a month, or $1,399 to $2,699 a year, with the entry tier capped at 100 risks and three users. Complies publishes $79, $199 and $499 a month billed yearly, with the risk register, cross-mapping and evidence collection starting in Growth at $199. Hicomply publishes $6,995 and $13,995 a year per primary framework. Vanta, Drata, Secureframe, Sprinto, ISMS.online, RiskWatch and CyberComply do not publish figures, and brokered contract data for the big four puts a typical first-year platform contract in the low to mid five figures. For the certification itself, the auditor's fee is a separate line that no software covers; our ISO 27001 certification cost breakdown sets those numbers side by side.

How to choose an ISO 27001 risk assessment tool

• Frameworks on the roadmap. ISO 27001 only: a dedicated tool is cheaper and produces the documents in auditor-ready form. ISO 27001 plus SOC 2 or HIPAA: a platform with one shared register saves you scoring the same risks twice.
• Where the SoA lives. Ask the vendor to change a treatment decision in the demo and show you the SoA afterward. If it does not update, you will be reconciling it by hand before every audit.
• Owner enforcement. Clause 6.1.3 f) requires risk owners to approve the treatment plan and accept residual risk. A tool that allows a risk with no owner is storing a spreadsheet with extra steps.
• The review calendar. Clause 8.2 is where spreadsheets die. Look for a scheduled review with a recorded outcome and a trigger on scope change, not just a "last reviewed" date field.
• Evidence for the controls that treat each risk. A register that links to controls which in turn pull evidence from AWS, Okta or GitHub turns treatment from a claim into an observation. That is a platform feature, and it is the main reason to pay platform prices.
• A price you can read. Two vendors on this page publish one. For a team of 5 to 200 that cannot spend a month on procurement, that alone can settle the decision.

For the underlying method, whichever tool you choose, our guide to the compliance risk assessment covers criteria, scoring and treatment in the order the auditor will ask about them, and the ISO 27001 checklist puts the risk clauses in the context of the full certification.

Which ISO 27001 risk assessment tool is right for you?

If you are certifying against ISO 27001 alone and want the mandatory documents drafted for you, Conformio is the published-price option and its Starter tier will carry a small company through a first certification. If you are a UK or EU organization that wants a pure risk tool with 27005 reporting, ask CyberComply for a quote. If you already run a mature multi-standard ISMS, ISMS.online is built for that. If you are a US SaaS or fintech company of 5 to 200 that needs ISO 27001 for an enterprise deal and SOC 2 for everyone else, and you want the register, the controls, the SoA and the evidence in one record with the price on the page, that is what ISO 27001 risk management software from Complies is for. Start with the seeded register, set your criteria, assign owners, and let the calendar own clause 8.2.