Insights · Checklist
ISO/IEC 27001 readiness checklist
Certification tests whether a management system operates, not whether documents exist. This checklist follows the standard’s structure from scope and risk assessment through controls, internal audit and management review, so that the certification audit confirms rather than discovers.
How to use it
Before the first step.
- A management sponsor and an internal system owner are prerequisites.
- Documents are written to actual practice; practice is changed where it must be.
Steps
Each one owned and evidenced.
| # | Step | Owner | Evidence |
|---|---|---|---|
| 01 | Define the scope: locations, systems, services and people covered, with the reasoning for exclusions. | System owner with sponsor | Scope statement |
| 02 | Document context: interested parties, their requirements and the internal and external issues that affect security. | System owner | Context analysis |
| 03 | Approve the information security policy and objectives; assign roles and responsibilities. | Sponsor | Signed policy, role matrix |
| 04 | Perform the risk assessment with a documented method: assets, threats, vulnerabilities, likelihood, impact, owners. | System owner | Risk register |
| 05 | Decide risk treatment and select controls; produce the Statement of Applicability with justification per control. | System owner | Risk treatment plan, Statement of Applicability |
| 06 | Implement selected controls and the procedures that operate them. | Control owners | Procedures and operating evidence |
| 07 | Establish competence and awareness: training records and acknowledgments. | HR with system owner | Training records |
| 08 | Establish document control: versions, approvals, distribution. | System owner | Document register |
| 09 | Operate the system for a period sufficient to produce evidence; monitor and measure against objectives. | System owner | Monitoring records |
| 10 | Handle incidents and nonconformities with records and corrective actions. | System owner | Incident and nonconformity log |
| 11 | Manage suppliers: inventory, agreements, assessments. | Procurement with system owner | Supplier register |
| 12 | Conduct the internal audit against every clause and applicable control; record findings and actions. | Internal auditor | Internal audit report |
| 13 | Hold the management review with the inputs the standard requires; record decisions. | Sponsor | Management review minutes |
| 14 | Select the certification body, schedule stage one and stage two audits, and prepare the evidence pack. | System owner | Audit schedule and evidence index |
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days