ISO 27001:2022
ISO 27001 checklist: are you ready for certification?
This checklist walks through ISO 27001:2022 clause by clause, from scope to improvement. Each point names the evidence a company usually has or still has to produce. Work through it first and you know where the gaps are before you start an assessment.
01: Method
How to use this ISO 27001 checklist
The list follows clauses 4 to 10, the mandatory core of the standard, and then the Annex A controls. A point counts as done when you can show something: a document, a record, a system setting. A shared understanding in the team is not evidence.
Mark every point as yes, partly or no. Treat partly as no. A risk register that was started two years ago and never reviewed does not satisfy the standard, and a customer who asks for it will see that at once.
02: Clauses 4, 5
Context and leadership: clauses 4 and 5
These clauses decide what the ISMS covers and who is accountable for it. Most gaps here come from missing paperwork, not from missing security.
Define the scope of the ISMS
State which locations, systems, services and teams are inside, and which are outside and why. Evidence: a scope statement of one or two pages.
List interested parties and their requirements
Customers, authorities, insurers, partners, employees. Evidence: a register that points to contract clauses and data protection obligations.
Describe internal and external issues
Think of cloud dependencies, staff turnover, regulatory pressure, attacks on your sector. Evidence: a short context analysis or workshop notes.
Show management commitment
Management approves the information security policy and provides budget and time. Evidence: the signed policy and minutes of a management meeting.
Assign roles and responsibilities
Someone owns information security, and everybody knows who. Evidence: role descriptions and an organisation chart.
03: Clauses 6, 7
Planning and support: clauses 6 and 7
Clause 6 is where the risk assessment sits. Its result decides which Annex A controls you apply, so every other item depends on it.
Fix a risk assessment method (6.1.2)
Define scales for likelihood and impact and the level at which a risk is acceptable. Evidence: a method document that someone else could apply.
Keep a risk register
Assets, threats, vulnerabilities, rating, owner. Evidence: a spreadsheet or tool with dates and named owners.
Plan risk treatment and write the Statement of Applicability (6.1.3)
Every Annex A control is marked applicable or not, with a reason. Evidence: the SoA and a treatment plan with deadlines.
Set measurable security objectives (6.2)
For example a target for patch times or for completed training. Evidence: a list of objectives with owner, target and status.
Provide resources and prove competence (7.1, 7.2)
People who run security tasks have the skills for them. Evidence: training records, certificates, job profiles.
Raise awareness (7.3)
All staff know the policy and their own duties. Evidence: attendance lists, onboarding checklist, results of a phishing exercise.
Control documented information (7.5)
Documents are approved, versioned and reachable only by those who need them. Evidence: version history and access rights on the document repository.
04: Clauses 8 to 10
Operation, evaluation and improvement: clauses 8 to 10
From here the standard asks for records that show the ISMS is running. Auditors and customers look for dates, names and closed actions.
Run the risk assessment and treatment (clause 8)
Repeat it at planned intervals and after significant changes. Evidence: dated assessment reports and change tickets.
Monitor and measure (9.1)
Track what you set as objectives. Evidence: figures such as patch status, incident counts and the result of a backup restore test.
Carry out an internal audit (9.2)
The auditor must not check their own work. Evidence: audit plan, report and a list of findings.
Hold a management review (9.3)
Management looks at results, risks and audit findings and decides what changes. Evidence: minutes with decisions.
Handle incidents and corrective actions (clause 10)
Every incident is logged, its cause is analysed, the fix is tracked to closure. Evidence: incident log and closed action items.
05: Annex A
Annex A controls and the evidence behind them
The 2022 edition groups 93 controls into four themes. You do not have to implement all of them, but you have to justify every exclusion in the Statement of Applicability.
| Theme | Controls | Typical evidence |
|---|---|---|
| Organisational | 37 | Policies, asset inventory, access control rules, supplier agreements, incident procedure, continuity plan |
| People | 8 | Confidentiality terms in contracts, screening records, training records, remote working rules |
| Physical | 14 | Access logs for office and server room, clean desk rules, equipment disposal records |
| Technological | 34 | MFA settings, endpoint protection, backup logs, logging and monitoring, encryption configuration, patch reports |
A company that runs everything in the cloud can mark the controls for its own server room as not applicable. The reason has to be written down in the SoA.
06: Zertify
Where Zertify fits in
Once the checklist shows few gaps, the next step is the self-assessment on Zertify. It has 48 yes/no questions. Thirteen of them are mandatory requirements of the standard and must all be answered yes. Of the other 35 questions, at least 24 need a yes to pass.
There is no on-site audit. SICE reviews every assessment, and G6 Agency AG issues the certificate under licence from SICE within 4 hours after you pass and pay. It costs CHF 849 (€849) in the first year, then CHF 569 (€569) per year including the yearly online re-audit. The certificate is valid for 3 years.
Every certificate has a number and a QR code on the PDF. Your customer's purchasing department can check it on the public verification page, without asking you for anything.
07: FAQ
Questions about the ISO 27001 checklist
08: Guide
Related pages
Test your readiness for ISO 27001
Answer 48 yes/no questions online and see whether you pass.
Free and without registration.