ISO 27001 + ISO 27701 + ISO 42001
Security, privacy and AI governance as one system
Three standards, one set of registers, one internal audit and one management review. Checkpoint does the shared work once and keeps each standard's records separate where an auditor expects them to be.
Done once
What the three standards share
One set of registers
One risk register and one action register, plus shared asset, supplier, incident, training and objectives registers. AI systems have their own register, which feeds ISO 42001.
One internal audit programme
A single audit programme covers the whole system. Plan it by risk, run it in Checkpoint, and raise findings into the same action register.
One management review
The review pack draws its inputs from every shared register, including incidents and AI systems, so top management meets once, not three times.
Clause evidence used once
All three standards follow the same clause 4–10 structure. One approved document or register, such as the risk method or the audit programme, counts as evidence for the same clause in each.
Controls that overlap
The security controls in ISO 27701 are mapped to their ISO 27001 counterparts, and the mapping view shows where one piece of work counts for several standards.
One tenant, one licence file
All three run in the same SharePoint site in your own Microsoft 365 tenant. Nothing is installed three times, and nothing leaves your tenant.
Kept separate
What each standard keeps for itself
Certification bodies audit each standard against its own requirements, so these stay per standard.
Clause records per standard
Clause 4.1 exists once for each standard, with its own status, owner and evidence, so an auditor can review the AI management system on its own.
A Statement of Applicability per standard
ISO 27001 Annex A, ISO 27701 privacy controls and ISO 42001 AI controls, each with its own inclusions, exclusions and justifications.
Documents per standard
Each standard shows only the policies that belong to it. The privacy policy and AI policy sit alongside the information security policy, not inside it.
Readiness per standard
Readiness and certification packs are built per standard, so you can certify all three together or one at a time.
In practice
Adding privacy and AI to an existing ISMS
- Start with ISO 27001. Import your existing risk register, actions, Statement of Applicability and policies, or build them with the guided set-up.
- Switch on ISO 27701 and ISO 42001. Shared clause evidence counts straight away, so both standards start part-way through rather than from zero.
- Add only the new work. A personal information inventory and privacy risks for ISO 27701; an AI system register and AI impact assessments for ISO 42001.
- Audit and review once a year. One internal audit and one management review cover all three standards.
- Certify the way that suits you. An integrated audit with one certification body, or each standard on its own timeline.
Pricing
Three licences, 10% off together
Annual licences, AUD ex GST. The bundle discount applies whenever 3 or more frameworks are licensed together.
| Standard | Under 50 staff | 50–250 staff |
|---|---|---|
| ISO 27001 Information security | $7,000 | $9,999 |
| ISO 27701 Privacy (PIMS) | $7,000 | $9,999 |
| ISO 42001 AI governance | $7,000 | $9,999 |
| Bundle discount (10%) | −$2,100 | −$3,000 |
| All three, per year | $18,900 | $26,997 |
Want help with the parts that need judgement? See how much consulting you're likely to need.
Questions
Running the three together
Do we need ISO 27001 before ISO 27701 or ISO 42001?
No. ISO/IEC 27701:2025 and ISO/IEC 42001 can each be certified on their own. Most organisations that already hold ISO 27001 build on it, because the management system clauses, the risk process and many records are the same.
Can we certify all three in one audit?
Many certification bodies offer an integrated audit for management systems that share a scope. Ask yours how it would sample across the three. Checkpoint keeps separate records per standard, so either approach works.
How much consulting does this need?
Usually a few days rather than weeks: a privacy workshop, AI impact workshops with your system owners, and a readiness check. Checkpoint writes the documents and builds the registers. Days are $2,000 each, ex GST, billed only as used.
What does it cost?
Each standard is an annual licence, and licensing 3 or more together takes 10% off. All three for under 50 staff is $18,900 a year; for 50–250 staff, $26,997 a year. Prices are AUD, ex GST.
See how it works before you talk to anyone
The public demo shows the registers, clauses, Statement of Applicability and management review on example data. No sign-up needed.
