ISO 27001 readiness

Two questions to tailor the review. They are not scored.

1. Are you planning to get certified by an accredited certification body within the next 12 months?
2. Do you develop or significantly customise software as part of the services in scope?

Clauses 6 and 8: a repeatable way to assess and treat information security risks, measurable objectives, and planned change.

1. Do you have a documented risk assessment method with criteria for likelihood, impact and acceptable risk, that gives consistent results when repeated? Knock-out Evidence needed Security lead
2. When did you last complete an information security risk assessment across the ISMS scope? Security lead
3. Upload your Statement of Applicability — the list of Annex A controls showing which apply, whether they're implemented, and why any are excluded. Evidence needed Security lead
4. Do you have a risk treatment plan with actions, owners and dates, and have risk owners approved the plan and accepted the remaining risk? Security lead
5. Have you set measurable information security objectives, and do you plan changes to the ISMS in a controlled way? Security lead

From the help text

The standard requires a defined, repeatable risk process. 'Yes' means a written method and risk acceptance criteria approved by management.

Annex A of the 2022 edition groups 93 controls into four themes. The organisational theme is the largest; the people theme covers screening, terms, awareness and leaving.

1. How complete are your organisational controls — policies, asset and information classification, supplier security, incident management, continuity and legal compliance? Security lead
2. The 2022 edition introduced several new controls. Which of these can you evidence today? Select all that apply. Security lead
3. Do you screen staff proportionately, include security and confidentiality in terms of employment, run awareness training, have a disciplinary process, and manage responsibilities when people leave? HR / Security lead

From the help text

These are the backbone of most ISMSs. 'Compliant' means policies and procedures exist, are approved and are followed in practice.

The physical theme protects premises and equipment; the technological theme covers access, protection, monitoring and resilience of systems.

1. Are your offices, equipment and any server or network rooms protected — entry controls, clear desk and screen, secure disposal, and equipment protection off-site? Office manager / Facilities
2. Do you control privileged access, use secure authentication (including MFA), and review user access rights regularly? IT lead
3. Which of these technological controls are in place and evidenced? Select all that apply. IT lead

From the help text

Physical controls apply even to largely remote organisations (home working, laptops, storage media). 'Yes' means controls fit your premises and are checked.

If you build software, Annex A expects security throughout the development lifecycle.

Asked only if you answer “Yes” to: Do you develop or significantly customise software as part of the services in scope?

1. Do you have secure development rules covering requirements, secure coding, security testing, separation of environments and change control? Engineering lead
2. Do you control outsourced development and protect test data (for example by not using live personal data in test without safeguards)? Engineering lead

From the help text

Auditors will look for defined practices and evidence they're used on real changes. 'Yes' means a written standard and records from recent releases.

Certification usually involves a two-stage audit by an accredited certification body: a documentation review, then an assessment of how the ISMS operates in practice.

Asked only if you answer “Yes” to: Are you planning to get certified by an accredited certification body within the next 12 months?

1. For how many months has your ISMS been operating with records (risk reviews, access reviews, incidents, meetings)? Security lead
2. Where are you with choosing a certification body? Security lead

From the help text

Certification bodies want to see the ISMS working, not just written. Around three months of operating records is a common minimum before the second-stage audit.

Clauses 7, 9 and 10: competence, awareness and documented information; monitoring, internal audit and management review; and fixing what goes wrong.

1. Can you show that people in ISMS roles are competent, and that all staff are aware of the policy and their responsibilities? HR / Security lead
2. Are ISMS documents and records controlled — versioned, approved, available to the right people and protected? Security lead
3. When did you last complete an internal audit of the ISMS? Security lead / Internal auditor
4. When did top management last hold a formal management review of the ISMS? Managing director / Security lead
5. When something goes wrong — an audit finding, incident or missed control — do you log it, find the root cause and track the fix to completion? Security lead
6. I confirm these answers are accurate, and our ISMS owner and top management have reviewed them. Managing director

From the help text

Auditors look for records, not just intentions. 'Yes' means training records for staff and competence evidence for key roles.