_1762866128417-DS2_OO1j.png)
Structure of ISO 27001:2022
The standard consists of the management system requirements in clauses 4 to 10 and Annex A with 93 controls in four themes: organizational (37), people (8), physical (14) and technological (34). You derive which Annex A controls to implement from your risk assessment and justify this in the Statement of Applicability (SoA).
ISMS readiness checklist
Context and scope (clause 4)
Leadership and roles (clause 5)
Risk and planning (clause 6)
Support (clause 7)
Operation (clause 8)
Evaluation and improvement (clauses 9 and 10)
Selected Annex A controls
The documents auditors ask for first
- ISMS scope
- Information security policy and objectives
- Risk assessment method and results, risk treatment plan
- Statement of Applicability
- Evidence of competence and awareness
- Audit programme, audit reports, management review, corrective actions
The complete list by clause is in our guide to ISO 27001 mandatory documents. Matching templates are available in the template library.
Download the checklist as PDF
Print-ready with tick boxes – ideal for your next audit or team meeting. Free; we also email you the link.
Frequently asked questions
How long does ISO 27001 certification take?
For small and medium-sized companies, six to twelve months from project start to certificate is realistic. It depends on how many controls are already in practice and how quickly evidence builds up.
Do I have to implement all 93 Annex A controls?
No. But you must assess all 93 in the Statement of Applicability and justify why each control is included or excluded.
Does ISO 27001 help with NIS2?
Yes, considerably. Many NIS2 risk management measures correspond to Annex A controls. You still need to handle the NIS2 reporting obligations separately.