> ISO 27001 checklist: review scope, risk assessment, Statement of Applicability, Annex A controls and audits – free online and as a downloadable PDF. Source: [https://docxpert.io/en/checklists/iso-27001-readiness](https://docxpert.io/en/checklists/iso-27001-readiness) # ISO 27001 Checklist for Certification Readiness Save as PDF Print-ready version with tick boxes. [Get the PDF](https://docxpert.io/en/checklists/iso-27001-readiness#download) ## Structure of ISO 27001:2022 The standard consists of the management system requirements in clauses 4 to 10 and **Annex A** with 93 controls in four themes: organizational (37), people (8), physical (14) and technological (34). You derive which Annex A controls to implement from your risk assessment and justify this in the **Statement of Applicability** (SoA). Transition period has ended Certificates to the old ISO/IEC 27001:2013 edition have no longer been valid since 31 October 2025. New certifications are issued against the 2022 edition only. ## ISMS readiness checklist ### Context and scope (clause 4) - Internal and external issues and interested parties with their requirements are determined. - The ISMS scope is documented, including interfaces and dependencies on third parties. - ISMS processes and their interactions are defined. ### Leadership and roles (clause 5) - The information security policy is approved by management and communicated. - Roles such as ISMS manager or information security officer are appointed. - Management provides resources and reviews the effectiveness of the ISMS. ### Risk and planning (clause 6) - A risk assessment method with acceptance and evaluation criteria is documented. - The risk assessment has been carried out; risk owners are named. - A risk treatment plan exists and has been accepted by the risk owners. - The Statement of Applicability lists all 93 Annex A controls with justification for inclusion or exclusion. - Measurable information security objectives are set and planned. ### Support (clause 7) - Competence requirements for ISMS roles are described and evidenced. - All employees have received awareness training; attendance is documented. - Communication channels for security topics and incidents are defined. - Documented information is controlled: approved, versioned and protected. ### Operation (clause 8) - Planned controls are implemented and monitored. - The risk assessment is repeated at planned intervals and after significant changes. - Outsourced processes and cloud services are identified and controlled. ### Evaluation and improvement (clauses 9 and 10) - Information security metrics are measured and analysed. - An internal ISMS audit covering the whole scope has been carried out. - The management review is available with decisions and actions. - Nonconformities and security incidents lead to corrective actions with effectiveness checks. ### Selected Annex A controls - The inventory of information assets with owners (A.5.9) is current. - Access control and rights management are defined and reviewed regularly (A.5.15–A.5.18). - Supplier relationships including cloud services are assessed for security (A.5.19–A.5.23). - An incident management process is defined and exercised (A.5.24–A.5.28). - ICT readiness for business continuity is planned and tested (A.5.30). - Threat intelligence is collected and analysed (A.5.7). - Backup, logging and monitoring are implemented (A.8.13, A.8.15, A.8.16). - Vulnerability management and secure configuration are in place (A.8.8, A.8.9). ## The documents auditors ask for first - ISMS scope - Information security policy and objectives - Risk assessment method and results, risk treatment plan - Statement of Applicability - Evidence of competence and awareness - Audit programme, audit reports, management review, corrective actions The complete list by clause is in our guide to [ISO 27001 mandatory documents](https://docxpert.io/en/guides/iso-27001-mandatory-documents). Matching templates are available in the [template library](https://docxpert.io/en/features/template-library). ## Download the checklist as PDF Print-ready with tick boxes – ideal for your next audit or team meeting. Free; we also email you the link. ## Frequently asked questions How long does ISO 27001 certification take? For small and medium-sized companies, six to twelve months from project start to certificate is realistic. It depends on how many controls are already in practice and how quickly evidence builds up. Do I have to implement all 93 Annex A controls? No. But you must assess all 93 in the Statement of Applicability and justify why each control is included or excluded. Does ISO 27001 help with NIS2? Yes, considerably. Many NIS2 risk management measures correspond to Annex A controls. You still need to handle the NIS2 reporting obligations separately. ## Read next [ISO 27001 mandatory documentsThe documents and records ISO/IEC 27001:2022 requires, at a glance.Learn more](https://docxpert.io/en/guides/iso-27001-mandatory-documents) [ISO 27001ISMS documentation, policies, Statement of Applicability and awareness training under control.Learn more](https://docxpert.io/en/standards/iso-27001) [NIS2 checklistScope, registration, risk measures, reporting channels and management training.Learn more](https://docxpert.io/en/checklists/nis2) [Gap analysisCheck existing documents against standard requirements and work off gaps as tasks.Learn more](https://docxpert.io/en/features/gap-analysis) ## Try docxpert free for 14 days Document control, approvals, training and evidence in one platform – with English and German templates for more than ten standards. [Start free trial](https://docxpert.io/en/trial)[See pricing](https://docxpert.io/en/pricing)