ISO 27001:2022 Readiness Checklist

Use this checklist to judge how ready your organisation is for ISO/IEC 27001:2022 certification. It follows the structure of the standard: the management-system clauses (4–10) that every certified organisation must meet, then the 93 Annex A controls grouped into the four 2022 themes. Tick an item only when you have evidence (a document, record or screenshot) an auditor could see.

Want an expert view? Our ISO 27001 Readiness Assessment turns this checklist into a scored gap analysis with a remediation roadmap. The full ISO 27001:2022 Starter Kit includes the risk register, Statement of Applicability and policy templates.

How to score yourself

In place: documented, implemented and evidence exists (2 points)
Partial: done informally or inconsistently, or no evidence (1 point)
Missing: not done (0 points)
Below 50%: start with Clauses 4–6 and the ★ controls. 50–80%: typical of organisations 3–6 months from Stage 1. Above 80%: book your certification audit.

Clause 4 – Context of the organisation

Internal and external issues affecting information security are identified and reviewed
Interested parties (customers, regulators, staff, suppliers) and their requirements are listed
ISMS scope is documented: locations, business units, systems, exclusions and justification ★

Clause 5 – Leadership

An Information Security Policy is approved by top management, communicated and available ★
Roles and responsibilities for information security are assigned (e.g. ISMS owner, risk owners, asset owners)
Management can show involvement: steering meetings, resource allocation, sign-offs

Clause 6 – Planning

A risk assessment methodology is defined: criteria, likelihood/impact scales, acceptance levels ★
A risk register exists with identified risks, owners, scores and treatment decisions ★
A Statement of Applicability (SoA) lists all 93 Annex A controls, whether applicable, justification and implementation status ★
A risk treatment plan with actions, owners and deadlines is approved by risk owners
Measurable information security objectives are set and tracked
Changes to the ISMS are planned and controlled (new 2022 requirement 6.3)

Clause 7 – Support

Resources (people, budget, tools) for the ISMS are provided
Competence is defined and records of training/qualifications are kept
Staff are aware of the policy, their role and consequences of non-compliance (awareness training records)
Internal and external communication about security is planned (who, what, when, how)
Documented information is controlled: versioning, approval, access, retention

Clause 8 – Operation

Processes to meet security requirements are planned and controlled, including outsourced processes
Risk assessments are performed at planned intervals and on significant change
The risk treatment plan is implemented and results recorded

Clause 9 – Performance evaluation

Security metrics are defined and measured (e.g. patch SLA, incident counts, training completion)
Internal audit programme exists; at least one full internal audit completed with report and findings ★
Management review held with required inputs (audit results, incidents, risks, objectives) and minuted outputs ★

Clause 10 – Improvement

Non-conformities are logged with root cause and corrective action
Evidence of continual improvement (closed actions, updated controls)

Annex A.5 – Organisational controls (37)

Topic-specific policies: access control, acceptable use, classification, backup, supplier security, secure development
Asset inventory with owners; acceptable use and return of assets
Information classification and labelling scheme in use
Access control policy; identity lifecycle (joiners/movers/leavers); privileged access reviewed quarterly ★
Supplier security: contracts with security clauses, supplier risk assessment, cloud service agreements (A.5.23)
Incident management: reporting channel, response procedure, lessons learned, evidence collection ★
Business continuity / ICT readiness: BIA, recovery plans, tested at least annually
Legal and regulatory register (IT Act, DPDP Act 2023, contractual obligations); privacy and PII protection (A.5.34)
Threat intelligence is collected and acted on (A.5.7, new)
Independent review of information security (A.5.35)

Annex A.6 – People controls (8)

Background verification before hiring, proportionate to the role
Employment contracts include security responsibilities and confidentiality/NDA
Security awareness training at induction and annually, with records ★
Disciplinary process is documented
Termination/role-change checklist: access removed within 24 hours, assets returned
Remote working policy covering devices, networks and physical environment
Event reporting: staff know how and what to report

Annex A.7 – Physical controls (14)

Physical security perimeter and entry controls for offices/server rooms (badge logs, visitor register)
Clear desk and clear screen policy
Equipment siting, protection, maintenance and secure disposal/re-use (data wiping records)
Protection against environmental threats and supporting utilities (UPS, fire detection)
Secure cabling; off-premises equipment and storage media handled under policy

Annex A.8 – Technological controls (34)

Endpoint protection: EDR/antivirus, disk encryption, screen lock on all user devices ★
Privileged access management; MFA for admin, remote and cloud consoles ★
Secure authentication; password policy enforced technically
Capacity management and malware protection in place
Vulnerability management: scanning, patch SLAs (critical ≤ 14 days), tracked evidence ★
Configuration management / hardening baselines (CIS) for servers and network devices (A.8.9, new)
Information deletion and data masking procedures (A.8.10, A.8.11, new)
Data leakage prevention measures proportionate to classification (A.8.12, new)
Backups taken, protected and restore-tested with records ★
Redundancy of processing facilities where availability requirements demand it
Logging and monitoring: central logs, clock sync, review, alerting; monitoring activities (A.8.16, new) ★
Installation of software restricted; approved software list
Network segregation, firewall rules reviewed; web filtering (A.8.23, new)
Cryptography policy and key management
Secure development lifecycle: requirements, secure coding, security testing, separation of environments, change management
Test data protected; outsourced development controlled
Web application security tested (ties in with VAPT)

Mandatory documents checklist

ISMS scope (4.3)
Information security policy (5.2)
Risk assessment and treatment methodology (6.1.2, 6.1.3)
Statement of Applicability (6.1.3 d)
Risk treatment plan (6.1.3 e, 6.2)
Information security objectives (6.2)
Evidence of competence (7.2)
Operational planning and control records (8.1)
Risk assessment results and risk treatment results (8.2, 8.3)
Monitoring and measurement results (9.1)
Internal audit programme and results (9.2)
Management review results (9.3)
Non-conformities and corrective actions (10.2)

Reference: ISO/IEC 27001:2022 and ISO/IEC 27002:2022. This checklist is a free summary for self-assessment and is not a substitute for the standard, which must be purchased from ISO or BIS. Last updated October 2026.