ISO 27001 with Power IMS – which modules cover which controls

What this is about

ISO 27001 requires a documented information security management system (ISMS) – with clearly defined processes, roles, risks, controls and evidence. A large share of these requirements is organisational, not technical. This is exactly where Power IMS plays its role.

This article maps the modules of the Power IMS suite to specific requirements from clauses 4–10 and Annex A (ISO 27001:2022, 93 controls across four themes) – and clearly delimits what is covered by Microsoft Entra, Defender, Purview & co. rather than Power IMS.

Power QMS – the ISMS foundation (very high coverage)

An ISMS is at its core a documented management system. Power QMS provides the central platform:

• Documented information (clause 7.5): ISMS policy, scope, Statement of Applicability, procedures – versioned, with mandatory comments and parallel approval workflows
• Information security policies (Annex A.5.1): control of the policy suite with read confirmation and re-review
• Roles and responsibilities (clauses 5.3 / A.5.2 / A.5.3): mapped through controlled role descriptions and process owners per process
• Context and interested parties (clauses 4.1 / 4.2): versioned as controlled documents
• Awareness (clause 7.3 / A.6.3): read confirmations as awareness evidence per employee and version
• Audit trail (clauses 7.5.3 / 9.2): exportable for certification audits

The documentation-mandatory part of the ISMS can therefore be fully mapped to Power QMS.

Power Audit – ISMS audits and supplier reviews (high coverage)

Audit requirements of ISO 27001 are explicitly anchored in the standard:

• Internal audit (clause 9.2): audit programme, planning, checklists, findings, action tracking with a full audit trail
• Supplier reviews (Annex A.5.19–A.5.22 supplier relationships): scoreable audit cycles per supplier including security requirements in the supply chain
• Management review inputs (clause 9.3): structured audit results
• Evidence as a report export for the certification body

Power CI – incident follow-up, corrective action and improvement (in development)

ISO 27001 requires a closed improvement and incident process. Power CI provides exactly that workflow:

• Nonconformity and corrective action (clause 10.1): structured intake, root cause analysis, action definition, effectiveness verification
• Learning from information security incidents (Annex A.5.27): lessons-learned workflow linked to policy changes in Power QMS
• Response to information security incidents (Annex A.5.26): organisational follow-up of the incident response – technical detection stays in Microsoft Defender / Sentinel
• Continual improvement (clause 10.2)

Important: Power CI is currently in development. Until it is generally available, we recommend a supplementary Power App or third-party tool that can be migrated later.

Power Risk – information security risks (in development)

Risk management is at the heart of ISO 27001:

• Information security risk assessment (clause 6.1.2): structured identification, analysis, evaluation
• Risk treatment (clause 6.1.3): selection of controls, linkage to the Statement of Applicability
• Configurable risk matrix, action tracking, periodic re-evaluation
• Linkage to processes from Power QMS and findings from Power Audit / Power CI

Power Risk is coming soon. Until release, a supplementary solution is required – typically a controlled risk register in Power QMS or a lean Power App.

Power Knowledge – awareness and competence (in development)

Awareness training is an explicit control:

• Information security awareness, education and training (Annex A.6.3): competence matrix, training paths, effectiveness assessment
• Competence (clause 7.2): evidence per employee and role
• Onboarding paths for security-critical roles (e.g. ISO, admin roles)

Power Contract – supplier and contract management (in development)

Supplier relationships have been significantly strengthened in the 2022 edition:

• Information security in supplier relationships (A.5.19): central supplier register with security requirements
• Addressing information security within supplier agreements (A.5.20): NDAs, processing agreements, security clauses
• Managing information security in the ICT supply chain (A.5.21)
• Monitoring, review and change management of supplier services (A.5.22): deadline and renewal management, linked to supplier audits from Power Audit

Power Safety & Power Maintenance – physical security and equipment

Direct contribution to the physical controls (Annex A.7):

• Power Safety – physical incident reporting, walkthroughs: contribution to A.7.1 physical security perimeters, A.7.2 physical entry and A.7.4 physical security monitoring
• Power Maintenance – maintenance of security-relevant equipment: contribution to A.7.13 equipment maintenance and A.7.11 supporting utilities

What Power IMS deliberately does not cover

ISO 27001 has a large technical share (Annex A.8 technological controls, 34 controls). These are not covered by Power IMS but by the Microsoft 365 platform itself:

• Identities, access management, MFA (A.5.15–A.5.18, A.8.2–A.8.5): Microsoft Entra ID / Conditional Access
• Endpoint security, anti-malware, EDR (A.8.7): Microsoft Defender for Endpoint
• Logging, monitoring, SIEM (A.8.15–A.8.16): Microsoft Sentinel / Defender XDR
• DLP, classification, encryption (A.8.10–A.8.12, A.8.24): Microsoft Purview
• Vulnerability and patch management (A.8.8, A.8.9): Intune / Defender Vulnerability Management
• Secure development (A.8.25–A.8.29): DevSecOps toolchain (Azure DevOps, GitHub Advanced Security)

Power IMS controls the related policies, processes, responsibilities and evidence – the technical implementation stays in the Microsoft cloud platform.

Recommended stack for ISO 27001

Clear division of labour between organisational and technical layer:

• Power QMS as ISMS core (policy, SoA, procedures, awareness evidence)
• Power Audit for internal audits and supplier reviews
• Power CI (once available) for corrective action and lessons learned
• Power Risk (once available) for risk assessment and treatment
• Power Contract (once available) for supplier contracts and security clauses
• Power Knowledge (once available) for awareness and competence
• Power CI for continuous improvement of ISMS processes
• Power Safety & Power Maintenance for physical controls
• Microsoft Entra, Defender, Purview, Sentinel, Intune for the technical controls from Annex A.8

Conclusion

For ISO 27001, Power IMS is the organisational ISMS platform – with high coverage of clauses 4–10 and the Annex A themes 5 (organisational), 6 (people) and 7 (physical). The technical controls (Annex A.8) belong in the Microsoft 365 platform, not in Power IMS – this clean split avoids duplicate work and makes audits easier.

For organisations with an existing Microsoft 365 landscape this results in a coherent stack: one tenant, one permission model, one audit trail – instead of a parallel GRC tool that has to capture everything again.

If you want to know how your ISO 27001 stack with Power IMS and Microsoft 365 could look in concrete terms, book a meeting or first explore the modules in detail.