Free tool · ISO/IEC 27001:2022

ISO 27001 Self-Assessment

How close is your business to ISO 27001 certification? Answer 30 questions covering clauses 4–10 and the four Annex A control themes. You get a readiness score, a score for each area, a prioritised gap list and a PDF report.

Takes about 8 minutes. Your answers stay in your browser; nothing is sent to us.

93 controlsin 4 themes: organisational, people, physical, technological

Clauses 4–10the mandatory ISMS requirements auditors check first

31 Oct 2025end of the transition from the 2013 version

How to answer: choose “Yes” only if it is in place and you could show an auditor a record of it. “Partly” means started, informal or not yet evidenced. This is a self-assessment, not a certification audit.

ISO 27001:2022 Readiness Report

ISO 27001 readiness: common questions

How long does ISO 27001 certification take for a small business?

Most Indian SMBs take 3 to 9 months, depending on where they start. The ISMS needs to run for a few months so you have records, an internal audit and a management review before the Stage 1 and Stage 2 audits.

What documents are mandatory?

Key ones include the ISMS scope, information security policy, risk assessment and treatment method, risk register and treatment plan, Statement of Applicability, security objectives, evidence of competence, monitoring results, internal audit programme and results, management review minutes, and corrective action records.

Do we need all 93 Annex A controls?

No. You must consider all 93, then justify in the Statement of Applicability which apply based on your risks. For example, a company that does not develop software may exclude some secure development controls.

What changed in ISO 27001:2022?

Annex A dropped from 114 controls to 93, grouped into four themes, with 11 new controls such as threat intelligence, cloud security, configuration management and data leakage prevention. Read our Annex A controls guide for the full mapping.