Community Library

ISO 27001 Preparation Checklist

Every step, and the proof an auditor will ask for.

Join to save this for later.

A checked box is not evidence. Most ISO 27001 checklists tell you what to do. This one also tells you what proof you will need to show for it, and where in the standard that requirement lives.

How to use this checklist

Work the phases in order. They follow a 12-week implementation, with a pre-kickoff stage before and certification and sustain stages after.
For each task, the Proof line is what an auditor will ask to see. If you cannot produce it, the task is not done.
References point to ISO/IEC 27001:2022 clauses (e.g. 6.1.2) or Annex A controls (e.g. A.5.9).

37Organizational
8People
14Physical
34Technological

93 Annex A controls across 4 themes, plus the requirements in Clauses 4–10.

0 of 47 complete

Before kickoff · Week 0

Sponsorship and scope

Projects that go live survive on dedicated sponsorship. Secure it before any work starts.

0 of 5

Name an executive sponsor who owns the ISMS outcome and can commit budget and people.
Proof: Signed charter or sponsor memo naming the sponsor and their authority.
5.1, 7.1
Document the internal and external issues that affect information security.
Proof: Context of the organization record.
4.1
List interested parties (clients, regulators, insurers, suppliers) and what each requires of you.
Proof: Interested parties register with requirements.
4.2
Define the ISMS scope: locations, business units, systems, and the interfaces with what sits outside it.
Proof: Approved scope statement, including boundaries and exclusions.
4.3
Communicate the scope to the people and suppliers inside it.
Proof: Dated communication record or meeting minutes.
7.4

Phase 1 · Weeks 1–2

Kickoff, data assessment and risk review

Know what you are protecting and where the truth about each control lives.

0 of 7

Build an inventory of information and associated assets: data, people, devices, cloud services, locations, and intangibles.
Proof: Asset register with an owner on every row.
A.5.9
Classify each asset and define how each classification is handled.
Proof: Classification scheme and labeled asset register.
A.5.12, A.5.13
Identify the source system for each control area: identity, mail, endpoints, backup, and logging.
Proof: Data source map showing which system enforces and reports each control.
A.5.15, A.8.7, A.8.13, A.8.15
Assess data quality in those systems: stale accounts, unmanaged devices, missing owners.
Proof: Data assessment findings with counts and dates.
A.5.18, A.8.1
Document a risk assessment method: criteria for likelihood, impact, and acceptance.
Proof: Risk methodology document approved by management.
6.1.2
Review or build the risk register: each risk scenario with its owner, likelihood, impact, and rating.
Proof: Risk register with dated assessment.
6.1.2, 8.2
Draft the Statement of Applicability against all 93 Annex A controls.
Proof: Draft SoA listing every control as included or excluded.
6.1.3 d

Phase 2 · Weeks 3–4

Gap analysis and project plan

Score each control from system data, not self-rating, then plan the work to close the gaps.

0 of 6

Score each applicable control from the data in the system that enforces it.
Proof: Gap analysis showing each score, how it was calculated, and when the data was pulled.
9.1
Record constraints and exclusions with a justification for each.
Proof: Final SoA with justification for every inclusion and exclusion.
6.1.3 d
Choose a treatment for each risk: modify, avoid, share, or accept.
Proof: Risk treatment plan with owner and target date per action.
6.1.3, 8.3
Get risk owners to formally accept residual risk.
Proof: Signed or recorded residual risk acceptance.
6.1.3 f
Set measurable information security objectives.
Proof: Objectives with metric, owner, target, and review date.
6.2
Build the project plan with milestones through the first release.
Proof: Project plan or work breakdown with owners and dates.
6.2, 8.1

Phase 3 · Weeks 5–6

Policy development and roles review

Write policies people can follow, and give every control a named owner.

0 of 7

Publish an information security policy approved by top management.
Proof: Approved policy with version, date, and approver.
5.2
Write topic-specific policies for access, acceptable use, suppliers, incidents, and continuity.
Proof: Approved policy set, each mapped to its Annex A controls.
A.5.1
Assign roles, responsibilities, and authorities for the ISMS and every applicable control.
Proof: RACI or roles matrix; every control has one named owner.
5.3, A.5.2
Set up document control: versioning, approval, review cycle, and retention.
Proof: Document control procedure and a master document list.
7.5
Define supplier security requirements and review key suppliers and cloud services.
Proof: Supplier register with assessments and contract security clauses.
A.5.19, A.5.20, A.5.23
Document incident management and business continuity procedures.
Proof: Incident response procedure and continuity plan with test schedule.
A.5.24, A.5.29, A.5.30
Identify the legal, regulatory, and contractual requirements that apply.
Proof: Legal and regulatory register with owners.
A.5.31

Phase 4 · Weeks 7–9

Training and awareness

Make sure people know the policies, the threats, and their part in the ISMS.

0 of 7

Define the competence each ISMS role needs and close the gaps.
Proof: Competence matrix and training or certification records.
7.2
Run security awareness training for all personnel in scope.
Proof: Completion records by person and date.
7.3, A.6.3
Train people on the threats you actually face, such as phishing and business email compromise.
Proof: Simulation or assessment results over time.
A.6.3
Collect policy acknowledgments from every person in scope.
Proof: Signed acknowledgment records.
A.5.10, A.6.2
Establish a disciplinary process for security policy violations.
Proof: Documented disciplinary process referenced in HR policy.
A.6.4
Build security into onboarding and offboarding.
Proof: Onboarding checklist and access removal records.
A.6.1, A.6.5, A.5.18
Plan what gets communicated, to whom, when, and by whom.
Proof: Communication plan.
7.4

Phase 5 · Weeks 10–12

First release walkthrough

Prove the ISMS runs: measure it, audit it, review it, and fix what you find.

0 of 6

Walk the live registers end to end with control owners: assets, risks, SoA, suppliers, incidents.
Proof: Walkthrough record with attendees and actions.
8.1
Report on objectives and control performance from current data.
Proof: Monitoring report showing each measure and its data date.
9.1
Run an internal audit with auditors who did not build the area they audit.
Proof: Audit program, plan, and report with findings.
9.2
Hold a management review covering every required input.
Proof: Minutes with decisions, actions, and resource commitments.
9.3
Log every nonconformity with root cause and corrective action.
Proof: Corrective action log with closure evidence.
10.2
Plan how changes to the ISMS will be controlled from here on.
Proof: Change planning record.
6.3

Certification · After week 12

External audit

Let an accredited certification body confirm what your evidence already shows.

0 of 4

Select an accredited certification body.
Proof: Signed certification agreement.
Complete the Stage 1 audit: documentation and readiness review.
Proof: Stage 1 report with any areas of concern addressed.
Complete the Stage 2 audit: auditors test that controls are implemented and operating.
Proof: Stage 2 report.
Close each nonconformity with root cause analysis and evidence the fix works.
Proof: Accepted corrective action plan and closure evidence.
10.2

Sustain · Ongoing

Continual improvement

Certification is the start. Keep the data current and the ISMS improving.

0 of 5

Prepare for surveillance audits in years one and two, and recertification in year three.
Proof: Three-year audit calendar.
Refresh control data on a set cadence so no score goes stale.
Proof: Each control shows when its data last updated.
9.1
Reassess risk at planned intervals and when significant changes occur.
Proof: Dated risk register revisions.
8.2
Run management reviews and internal audits on schedule.
Proof: Annual audit program and review minutes.
9.2, 9.3
Track improvements as well as fixes.
Proof: Improvement log.
10.1

Want to know where you stand today?

Start with a Gap Assessment. We score your controls from the systems that run them, so you see the gaps before an auditor, insurer, or attacker does.

Start with a Gap Assessment Book a demo

Portal demos follow a mutual NDA.

This checklist is guidance, not a substitute for the ISO/IEC 27001:2022 standard. Purchase the standard from ISO or your national standards body. Certification decisions are made only by accredited certification bodies.