ISO 27001 readiness checklist

The mandatory clauses of ISO 27001:2022, in the order an auditor works through them. Use it to find out what is missing before a certification body does.

Read this first. Clauses 4 to 10 are mandatory and are what an auditor tests. The 93 Annex A controls are selected by your risk treatment plan, so no honest checklist can tell you which of them apply to you.

0 of 22

Clause 4: Context of the organisation

Internal and external issues identifiedA documented view of what affects your ability to achieve the outcomes of the ISMS.Clause 4.1Interested parties and their requirementsWho has a stake in your information security, and what each of them requires of you.Clause 4.2ISMS scope documentedThe boundaries of the management system, written down. Scope decisions drive cost more than any other choice you make.Clause 4.3

Clause 5: Leadership

Top management demonstrably involvedEvidence that leadership directs the ISMS rather than delegating it entirely.Clause 5.1Information security policy publishedA policy appropriate to your purpose, communicated internally and available to interested parties.Clause 5.2Roles and responsibilities assignedNamed accountability for the ISMS, not a job title that nobody holds.Clause 5.3

Clause 6: Planning

Risk assessment process defined and runA repeatable method that produces consistent, comparable results, not a one-off spreadsheet.Clause 6.1.2Risk treatment plan producedFor every risk, a decision and an owner. This is what selects your Annex A controls.Clause 6.1.3Statement of Applicability completeAll 93 Annex A controls listed, each included or excluded with a justification. Auditors read this first.Clause 6.1.3 dMeasurable security objectives setObjectives that can actually be measured, with a plan to achieve them.Clause 6.2

Clause 7: Support

Resources allocatedPeople and budget committed to running the ISMS.Clause 7.1Competence evidencedProof that the people doing security work are competent to do it.Clause 7.2Awareness across the organisationStaff know the policy, their contribution, and what non-conformity means.Clause 7.3Documented information controlledVersion control, approval and retention for ISMS documents.Clause 7.5

Clause 8: Operation

Operational planning and control in placeThe processes that deliver your controls, running and controlled.Clause 8.1Risk assessments performed at planned intervalsAnd whenever significant change occurs, not only annually.Clause 8.2Risk treatment plan implementedEvidence that what you planned has actually been done.Clause 8.3

Clause 9: Performance evaluation

Monitoring and measurement definedWhat you measure, how, when, and who evaluates the results.Clause 9.1Internal audit programme completedThe whole ISMS audited at planned intervals by someone objective. This is the single most common gap at stage two.Clause 9.2Management review held and minutedLeadership reviewing the ISMS against a defined agenda, with decisions recorded.Clause 9.3

Clause 10: Improvement

Non-conformities logged and correctedA record of what went wrong, the root cause, and what changed as a result.Clause 10.2Continual improvement demonstrableEvidence the ISMS is getting better, not simply being maintained.Clause 10.1

Your ticks stay in this browser tab and are not saved or sent anywhere. Refreshing clears them.

Keep reading

FrameworkISO 27001: what it is and who assesses it

InsightISO 27001 certification: a practical guide

ToolWork out which frameworks apply to you

Ticked most of it and stuck on the rest?

ISO 27001 is assessed by ukas-accredited certification body. We run the programme up to that point and manage the assessment itself.

Book a free consultation