ISO 27001 Toolkit Terms of Use

Who we are

ISO 27001 Toolkit is operated by Zenith Consulting Services Pty Ltd (ABN 29 918 988 901), in Australia. Contact: support@zenithconsultingservices.com.au.

Definitions

In these terms, "Zenith Consulting Services", "we" and "us" mean Zenith Consulting Services Pty Ltd (ABN 29 918 988 901); "End User" and "you" mean the person or organisation using the Software; "Software" means ISO 27001 Toolkit, including its website, app and any service it relies on; "Documentation" means the guides, help text, reports and other material we supply with the Software; "Party" means any person or organisation; "Intellectual Property" means all copyright, trade marks, designs, know-how and other intellectual property rights, registered or not.

What ISO 27001 Toolkit is

ISO 27001 Toolkit is a set of tools for organisations working towards or maintaining ISO/IEC 27001:2022: a Statement of Applicability builder, an Annex A gap and maturity self-assessment, a risk register, and a security questionnaire answer bank. You sign in with an account, your work is saved to a workspace, and you can invite colleagues into that workspace.

Self-assessment, not an audit

The toolkit helps you organise your own evidence and judgement. It is not an audit, a certification, a gap analysis by a qualified auditor, or legal advice, and using it does not mean your organisation conforms to ISO/IEC 27001. Certification outcomes depend entirely on your implementation and your certification body.

Annex A wording

The toolkit lists Annex A controls by identifier (A.5.1 to A.8.34) with short titles written by us as plain-language reminders. They are not the text of the standard. Buy the standard from ISO or your national standards body for the authoritative control wording and guidance.

Your account

You need an account to use the toolkit. You can sign up with an email address and a password, or sign in with Google, Microsoft or LinkedIn. Where you sign in with one of those providers, that provider authenticates you and any multi-factor authentication is theirs, not ours: we rely on the provider's checks, never see your password for it, and cannot tell whether you have multi-factor authentication turned on with them. Accounts with an email address and a password must set up a time-based one-time password (TOTP) authenticator app as a second factor before they can use the toolkit. There is more detail on our Security page.

Keep your sign-in details to yourself, use your own account rather than a shared one, and tell us promptly if you think someone else has access. You are responsible for what is done under your account.

Workspaces and who can see your data

Your work lives in a workspace. Every member of a workspace can see and change everything in it, and workspace admins can invite members, change their role and remove them. Invite people you are content to show the whole workspace to. Workspaces are separated from each other in the database, so another customer's account cannot read yours.

A small number of Zenith people are platform operators and can read workspace content to support you. That access is read only, and the database records every such read in your workspace's audit log before allowing it, so your admins can see who looked and when. Staff who run the production systems can also reach data directly, to operate the service, investigate a fault or meet a legal obligation. The database keeps an audit log of changes to your data. How we handle your information is set out in our Privacy Policy.

Where your data is held

Your account and your workspace content are stored in a PostgreSQL database run by Amazon Web Services in the Sydney region (ap-southeast-2), encrypted at rest, with automated backups retained for 14 days. Your work is saved to that database as you go, not to your browser, so clearing site data does not lose it and signing in on another device shows the same workspaces.

Your content stays yours

You keep ownership of everything you put into the toolkit. You give us permission to store and process it for the purpose of providing the service to you, and for nothing else. We do not sell it, and we do not use it to train machine learning models.

You can export your workspace at any time from the app, as a .isms.json file and as spreadsheet and PDF reports. A workspace admin can archive a workspace and schedule its permanent deletion from the app, 30 days out. To have your account and its data erased, or a workspace deleted sooner, email the address above and we will do it.

Acceptable use

Do not put in content you have no right to share, use the toolkit to break the law, attempt to reach another organisation's workspace, or probe or attack the service. We may suspend or close an account that does any of these.

Licence grant

We grant you a non-exclusive, non-transferable, revocable licence to use the Software and Documentation for your own business, professional or educational purposes, free of charge, in accordance with these terms. We and our licensors own all Intellectual Property in the Software and Documentation. You keep ownership of your content, as set out above.

Specific prohibitions on use of the Software

The End User agrees that it must not:

• infringe Zenith Consulting Services' or any third Party's Intellectual Property in the Software or the Documentation;
• use the Software or Documentation in any way that could damage the reputation of Zenith Consulting Services or the goodwill or other rights enjoyed by Zenith Consulting Services;
• permit any third Party to obtain access to the Software, or Documentation;
• communicate offensive, defamatory or otherwise objectionable material using the Software;
• reproduce, make error corrections to or otherwise modify or adapt the Intellectual Property in the Software, Documentation or create any derivative works based on the Software and Documentation;
• de-compile, disassemble, decrypt, or otherwise reverse engineer the Software or permit any third Party to do so;
• transfer, sublicense, rent, lease, lend, license or otherwise transfer or assign the Software; and
• modify or remove any copyright or proprietary notices associated with the Software.

Inviting members into your workspace, and giving your certification body or auditor access to exports, is permitted and is not access by a third Party for the purposes of this clause.

Availability and changes

The toolkit is offered as it is at the time you use it, without a service level commitment. Features may be added, changed or removed, and maintenance may interrupt access. We will give notice of a change that materially reduces what the service does where we reasonably can. Pricing is not part of these terms; if a paid plan is introduced, existing accounts will be told before anything changes for them.

We may update these terms. The version and date are shown at the top of this document, and a material change asks you to accept the new version the next time you sign in. Your acceptance is recorded against your account, with the version accepted and the time.

No warranty

Outputs are generated from what you enter and are provided without warranty of any kind. Verify every export against your own policies, your risk methodology and your certification body's expectations before relying on it. Nothing in these terms excludes any right you have under the Australian Consumer Law that cannot lawfully be excluded.

Liability

To the extent the law allows, we are not liable for indirect or consequential loss, lost profits, or loss arising from your reliance on an output of the toolkit. Where liability cannot be excluded, it is limited to resupplying the service.

Attribution

Exported files and printed reports include a small "Powered by Zenith Consulting Services" note. By using ISO 27001 Toolkit you agree to keep this attribution on outputs you include in reports and other documents.

Ending your use

You can stop using the toolkit at any time and ask us to close your account. We may close an account that breaches these terms. Export anything you want to keep first, because closing an account removes access to its workspaces.

Governing law

These terms are governed by the laws of Queensland, Australia, and you and we submit to the courts of that state.

Zenith Consulting Services

ISO 27001 Toolkit is built by Zenith Consulting Services, which designs and builds web, desktop and mobile apps for businesses. If you want a tool like this tailored to your operation, visit zenithconsultingservices.com.au or email support@zenithconsultingservices.com.au.