ISO 27001 Readiness Checklist
Gauge how close your organisation is to ISO/IEC 27001:2022. Work through the mandatory ISMS management clauses (4–10) and the four Annex A control themes — Organizational, People, Physical and Technological — marking each area met, partial, not met or N/A. Score it for an overall coverage figure, a per-theme breakdown, a prioritized gap list and an exportable report. Everything runs in your browser; nothing is uploaded.
ISMS management system
Clauses 4–10Context (Clause 4): the ISMS scope is defined, and internal/external issues and interested parties are identified.
Leadership (Clause 5): top management is committed, an information security policy exists, and security roles are assigned.
Planning (Clause 6): a documented risk assessment and treatment process, a Statement of Applicability, and measurable security objectives.
Support (Clause 7): resources, competence, awareness, communication and control of documented information are in place.
Operation (Clause 8): risk treatment plans are actually carried out and operational controls are running.
Performance evaluation (Clause 9): monitoring and measurement, internal audits and management reviews are performed and recorded.
Improvement (Clause 10): nonconformities are handled with corrective action and the ISMS is continually improved.
Organizational controls
Annex A — A.5Information security policies are defined, approved by management and communicated to staff.
Security roles, responsibilities and segregation of conflicting duties are established.
Supplier and cloud-service security requirements are agreed and monitored in contracts.
Information is classified and handled according to its sensitivity.
An incident management process with clear responsibilities and reporting is in place.
Threat intelligence is used and information security continuity is planned.
Legal, regulatory, contractual and privacy obligations are identified and met.
People controls
Annex A — A.6Background screening is performed before employment where lawful and proportionate.
Employment terms and conditions include information security responsibilities.
Security awareness, education and training are delivered regularly.
A disciplinary process exists for information security violations.
Responsibilities on termination or change of role are defined and enforced.
Remote working, confidentiality and non-disclosure agreements are covered.
Physical controls
Annex A — A.7Physical security perimeters and entry controls protect facilities and secure areas.
Offices, rooms, equipment and cabling are protected.
A clear desk and clear screen policy is in force.
Equipment and storage media are securely disposed of or sanitised before reuse.
Protection against physical and environmental threats (power, fire, water) is in place.
Technological controls
Annex A — A.8Access control, identity management and privileged access management are enforced.
Protection against malware and secure configuration of systems are maintained.
Logging, monitoring and clock synchronisation are implemented.
Information and systems are backed up and tested, with appropriate redundancy.
Cryptography and key management protect data at rest and in transit.
Network security, segregation and filtering are applied.
Secure development, change management and vulnerability management are in place.
Data masking, data leakage prevention and endpoint protection are deployed where needed.
Your answers and the score are computed entirely in your browser — nothing is uploaded to PlayCISO or anyone else. Clearing the page clears your checklist.
What this tool is
- A free, interactive readiness checklist built on the structure of ISO/IEC 27001:2022 — the current edition of the information security management system (ISMS) standard.
- Covers both halves of the standard: the mandatory management-system requirements in Clauses 4–10, and the four Annex A control themes — Organizational (A.5), People (A.6), Physical (A.7) and Technological (A.8).
- Mark each area met, partial, not met or N/A; the tool computes an overall coverage score, a per-theme breakdown and a prioritized list of gaps to close first. Items marked N/A are excluded from the maths.
- Export the result as a plain-text report you can share with your team or hand to an auditor as a starting point.
- Runs entirely in your browser — your answers never leave the page and nothing is uploaded. It is a self-assessment, not a certification audit.
What ISO 27001 actually is
ISO/IEC 27001 is the international standard for an information security management system (ISMS) — a documented, risk-driven way of protecting the confidentiality, integrity and availability of information. It is the standard organisations get certified against to show, independently, that they manage security to a recognised baseline. The current edition is ISO/IEC 27001:2022. Crucially, the standard is not just a list of security measures: it is a management system that is planned, run, measured and improved on a repeating cycle.
The two halves of the standard
ISO 27001 has two parts, and you need both. The management-system requirements in Clauses 4 to 10 are mandatory for certification — they define the ISMS itself. The second part, Annex A, is a reference catalogue of controls you select from based on your risk assessment. You record which controls apply, and why, in a document called the Statement of Applicability (SoA). You cannot certify on the Annex A controls alone; the auditor assesses whether the management system around them genuinely works.
The ISMS management clauses (4–10)
- Context (Clause 4). Define the scope of the ISMS, and the internal and external issues and interested parties it must satisfy.
- Leadership (Clause 5). Top-management commitment, an information security policy, and clearly assigned roles and responsibilities.
- Planning (Clause 6). A risk assessment and risk treatment process, a Statement of Applicability, and measurable security objectives.
- Support (Clause 7). Resources, competence, awareness, communication and the control of documented information.
- Operation (Clause 8). Actually carrying out the risk treatment plan and running the operational controls.
- Performance evaluation (Clause 9). Monitoring and measurement, internal audits and management reviews.
- Improvement (Clause 10). Handling nonconformities with corrective action and continually improving the ISMS.
The Annex A 2022 restructure
The 2022 revision reorganised Annex A into 93 controls under four themes, replacing the 14 domains and 114 controls of the 2013 edition. The four themes are:
- Organizational (A.5). Policies, roles, supplier and cloud security, classification, incident management and compliance.
- People (A.6). Screening, employment terms, awareness and training, and responsibilities on joining, moving or leaving.
- Physical (A.7). Secure areas, equipment protection, clear desk and screen, and secure disposal of media.
- Technological (A.8). Access control, malware and configuration, logging and monitoring, backups, cryptography, network and secure development.
The restructure also introduced 11 new controls, covering areas such as threat intelligence, information security for the use of cloud services, ICT readiness for business continuity, and data masking and leakage prevention. This checklist is organised around those four themes rather than reproducing the full control catalogue.
The path to certification
Certification is granted by an accredited certification body. In practice you build and run the ISMS for long enough to generate real records, then the body performs a Stage 1 audit (a readiness and documentation review) and a Stage 2 audit (assessing whether the ISMS is implemented and effective). A certificate is typically valid for about three years, with annual surveillance audits and a full recertification at the end of the cycle. This tool is built to help you prepare for Stage 1 — it points at the gaps before an auditor does.
Scope note: This checklist is based on the ISO/IEC 27001:2022 structure. It is an indicative self-assessment — not a certification audit or legal advice. For a real assessment, and for certification, engage an accredited certification body. Nothing you enter here is transmitted; the scoring runs entirely in your browser.
Frequently asked questions
What is ISO 27001?
ISO/IEC 27001 is the international standard for an information security management system (ISMS) — a documented, risk-driven way of managing the confidentiality, integrity and availability of information. The current edition is ISO/IEC 27001:2022. It is the standard organisations certify against to demonstrate, independently, that they manage information security to a recognised baseline. The standard has two parts: the management-system requirements in Clauses 4 to 10, which are mandatory for certification, and Annex A, a reference set of controls you select from based on your risk assessment.
What is an ISMS and what do Clauses 4–10 require?
An ISMS (information security management system) is the set of policies, processes, roles and records through which an organisation manages information security as an ongoing cycle rather than a one-off project. The mandatory requirements live in Clauses 4 to 10: Context (Clause 4) defines the scope and interested parties; Leadership (Clause 5) sets top-management commitment, the security policy and roles; Planning (Clause 6) covers risk assessment, risk treatment and objectives; Support (Clause 7) covers resources, competence, awareness and documented information; Operation (Clause 8) is carrying the plans out; Performance evaluation (Clause 9) covers monitoring, internal audit and management review; and Improvement (Clause 10) covers nonconformities and continual improvement. You cannot certify on Annex A controls alone — the management system itself is assessed.
How is Annex A structured in ISO 27001:2022?
The 2022 revision reorganised Annex A into 93 controls grouped under four themes instead of the 14 domains used in the 2013 edition (which listed 114 controls). The four themes are Organizational controls (A.5), People controls (A.6), Physical controls (A.7) and Technological controls (A.8). The restructure merged and consolidated earlier controls and introduced 11 new ones covering areas such as threat intelligence, information security for cloud services, ICT readiness for business continuity, and data masking and leakage prevention. Annex A is a reference list: your Statement of Applicability records which controls apply to you and why, driven by your risk assessment.
How is the readiness score calculated?
Each checklist item is marked met, partial, not met or N/A. Items marked N/A are excluded from the calculation entirely — they do not count for or against you. Of the remaining (scored) items, a "met" counts as full credit, a "partial" as half credit and a "not met" as zero. The overall coverage percentage is the total credit divided by the number of scored items; the same calculation runs per theme so you can see where you are strong and where you are weak. The gap list then surfaces every item that is not fully met, ranked so the not-met items come before the partials. It is an indicative self-assessment, not a formal maturity score.
What does the path to ISO 27001 certification look like?
Certification is awarded by an accredited certification body, not by any tool. Typically you first build and run the ISMS for long enough to generate records (a risk assessment, a Statement of Applicability, internal audits and a management review). The certification body then performs a Stage 1 audit (a readiness and documentation review) followed by a Stage 2 audit (assessing whether the ISMS is implemented and effective). If successful, the certificate is usually valid for about three years, with annual surveillance audits in between and a full recertification at the end of the cycle. This checklist helps you prepare for Stage 1; it is not a substitute for the audit itself or for legal advice.