← All checklists
ISO 27001:2022 readiness checklist
Every ISO/IEC 27001:2022 management system clause and Annex A control an organization has to act on, mapped to its clause or control number, with the evidence a certification auditor will ask for. Preview 17 of the 110 items below; the full checklist comes as a branded, fillable PDF.
Checklist v1.0Covers ISO/IEC 27001 2022Reviewed 30 Oct 2026110 items · 10 sections
Clauses 4 to 6. Context, leadership and planning
9 items
- 4.1Identify the internal and external issues that affect what your ISMS needs to achieve.Evidence: Context analysis document, such as a SWOT or PESTLE review.
Clauses 7 to 10. Support, operation, evaluation and improvement
8 items
- 7.2Define the competence each ISMS role needs and keep records that people have it.Evidence: Competence matrix, certificates and training records.
Annex A 5. Organizational controls: governance and assets
12 items
- A.5.1Write topic-specific security policies, get them approved, share them, and review them on schedule.Evidence: Policy set with approval and review dates.
- A.5.2Define and assign security roles and responsibilities across the organization.Evidence: Role descriptions and assignment records.
Annex A 5. Organizational controls: access, suppliers and incidents
12 items
- A.5.13Label information according to its classification.Evidence: Labelling procedure and examples of labelled documents.
- A.5.14Set rules and agreements for transferring information inside and outside the organization.Evidence: Information transfer policy and agreements.
Annex A 5. Organizational controls: incidents, continuity and compliance
13 items
- A.5.25Assess security events and decide whether to treat them as incidents.Evidence: Triage records with classification decisions.
- A.5.26Respond to incidents following the documented procedures.Evidence: Incident tickets with response timeline.
Annex A 6. People controls
8 items
- A.6.1Screen candidates before they join, in proportion to the role and as the law allows.Evidence: Background check records.
Annex A 7. Physical controls
14 items
- A.7.1Define physical security perimeters around areas holding information and assets.Evidence: Site plan showing secure perimeters.
- A.7.2Control entry to secure areas so only authorized people get in.Evidence: Badge system logs and visitor log.
Annex A 8. Technological controls: endpoints and access
11 items
- A.8.1Protect information on laptops, phones and other endpoint devices.Evidence: MDM compliance report showing encryption and lock settings.
- A.8.2Restrict and manage privileged access rights.Evidence: Privileged account list and approval records.
Annex A 8. Technological controls: data, logging and networks
11 items
- A.8.12Apply data leakage prevention to systems, networks and devices that handle sensitive information.Evidence: DLP policies and alert samples.
- A.8.13Back up information, software and systems and test restores regularly.Evidence: Backup policy, job logs and restore test results.
Annex A 8. Technological controls: cryptography and development
12 items
- A.8.23Filter access to external websites to reduce exposure to malicious content.Evidence: Web filtering configuration.
- A.8.24Set rules for using cryptography and managing keys.Evidence: Cryptography policy and key management configuration.
Changelog
- v1.030 Oct 2026First release. Covers the actionable requirements of ISO/IEC 27001:2022 clauses 4 to 10 and all 93 Annex A controls.
Take it to your team
Fillable PDF with owner and target date fields, your name on every page.