Skip to content
IT-Checklist

ISO 27001: checklist and advice

Last updated: · IT-Checklist editorial team

ISO 27001 is the international standard for an information security management system, or ISMS. You record what you protect, which risks there are and which measures you take. Then you check and improve it every year.

This checklist follows the 2022 version: clauses 4 to 10 and the 93 controls in Annex A. Use it to see how far along you are, even if you don't want to certify (yet).

Check where your business stands on iso 27001

The free IT check asks you these questions. Then you see your score per topic and advice for every gap. You don't need an account.

Start the IT check →

Why it matters

Certificates against the old 2013 version have not been valid since 31 October 2025. A customer who asks for a certificate will only accept the 2022 version.

Without a fixed method for the risk assessment you choose measures on gut feeling. An auditor will ask exactly why you do or don't do something.

An ISMS that only exists on paper fails at the first audit. Internal audits and a management review belong in every year.

The 12 questions in this topic, with advice

Each question describes the situation you want to have. The label shows how much the measure weighs in your score. 'Do first' counts the most.

  1. We have documented which part of the organisation our information security management system (ISMS) covers.

    Do first

    Define the scope (ISO 27001 clause 4.3): which locations, departments, processes and systems are included. Better to start small and clear than large and vague. An auditor checks everything against this scope.

  2. We have an information security policy that management has approved and that employees know about.

    Important

    Write a short policy with your objectives and commitments (clause 5.2) and have management sign it. Share it with everyone and review it at least once a year.

  3. We carry out an information security risk assessment using a fixed method and repeat it regularly.

    Do first

    ISO 27001 is built around risk (clauses 6.1.2 and 8.2). Document how you assess likelihood and impact, which risks you accept and who owns them. Repeat the assessment at planned intervals and after major changes.

  4. We have an up-to-date Statement of Applicability covering all 93 controls in Annex A.

    Do first

    For every Annex A control, state whether you apply it, why or why not, and what its status is. This document is mandatory (clause 6.1.3) and the first thing an auditor asks for.

  5. We have an inventory of our information and other assets (systems, devices, data), with an owner for each item.

    Important

    You can only protect what you know about (Annex A 5.9). Start with a simple list of laptops, phones, cloud applications and important data, and note who is responsible for each item.

  6. We grant access based on what people need for their work and review access rights periodically.

    Important

    Document your access control rules (Annex A 5.15 and 5.18). Check every quarter, for example, who can access what and remove rights from people who changed roles or left.

  7. We have information security agreements with suppliers and cloud services and check that they keep them.

    Important

    Annex A 5.19 to 5.23 covers suppliers and cloud services. List the suppliers that can access your data, put requirements in the contract and ask for evidence, such as a certificate or audit report.

  8. We have a fixed procedure for reporting, handling and evaluating security incidents.

    Important

    Document who does what during an incident (Annex A 5.24 to 5.28): reporting, assessing, resolving and preserving evidence. Afterwards, discuss what you learned and adjust your controls.

  9. We make backups, test restoring them and have documented how we keep working when key systems fail.

    Important

    A backup you never restored is a gamble (Annex A 8.13). Test restores at fixed intervals. Also describe how you get your ICT running again after an outage or attack (Annex A 5.30).

  10. We track vulnerabilities in our software and systems and install security updates within a set timeframe.

    Important

    Agree how quickly updates must be installed, for example critical vulnerabilities within 14 days, and who checks this (Annex A 8.8). Automatic updates and an overview of all your systems make this much easier.

  11. Employees regularly receive information security awareness or training that fits their work.

    Important

    Annex A 6.3 requires awareness and training. Think of a short session when someone joins, a yearly refresher and a phishing test. Keep track of who completed what, because an auditor will ask.

    Applies to: SMEs, larger companies

  12. We carry out internal audits, management reviews the ISMS periodically and we demonstrably resolve nonconformities.

    Do first

    This is the standard's improvement cycle (clauses 9.2, 9.3 and 10.2). Plan at least one internal audit a year, discuss the results with management and keep a list of improvements with an owner and deadline.

Where to start

  • Define the scope: which locations, teams and systems it covers. A smaller scope makes it easier to start.
  • Have the board approve a short one-page security policy and share it with everyone.
  • List your information and systems, with an owner for each item.
  • Start the Statement of Applicability: for each Annex A control, note whether it applies and why.

Common mistakes

  • Implementing all 93 controls, even when they cover no risk for your business. The standard asks for a reasoned choice.
  • Letting the IT partner write the ISMS without the board owning it.
  • Not recording incidents and nonconformities. Those are exactly what show the system works.

Official sources

Read next

All topics in the checklist