ISO 27001 Certification Checklist

Define the scope

Have you clearly defined the scope of your ISMS, including locations, departments and systems?

Document interfaces and exclusions

Are interfaces to areas outside the scope, and any justified exclusions, documented in writing?

Identify internal and external issues

Have you identified relevant internal and external issues that affect your ISMS, such as market requirements or your IT landscape?

Identify interested parties and their requirements

Are interested parties such as customers, regulators or employees, along with their information security requirements, identified?

Visible commitment from top management

Does top management demonstrably support the ISMS, for example through resources, communication and active involvement?

Information security policy approved

Is there a policy approved by top management that sets out the objectives and framework for information security?

Roles and responsibilities assigned

Are roles such as ISO, process owners and risk owners named, with their tasks clearly described?

Risk assessment methodology defined

Have you defined a traceable methodology for identifying, assessing and comparing risks?

Risks identified and assessed

Are risks to confidentiality, integrity and availability systematically captured and rated by likelihood and impact?

Risk treatment plan created

Does a plan define how each risk is treated, for example through avoidance, mitigation, transfer or acceptance?

Statement of Applicability (SoA) created

Does the SoA document, for every Annex A control, whether it is applied and, if not, why?

Information security objectives defined

Are measurable security objectives defined that align with the policy and are reviewed regularly?

Resources provided

Are sufficient people, time and budget available to build and operate the ISMS?

Competence and training ensured

Do responsible people have the necessary competence, and are training needs identified and planned?

Awareness program established

Do all employees know their role in information security, and are they regularly made aware of it?

Documented information controlled

Are policies and records versioned, approved and protected against unauthorized changes?

Applicable controls implemented

Are the Annex A controls marked as applicable in the SoA actually implemented and effective?

Supplier and vendor security addressed

Are there information security requirements and agreements in place with suppliers and vendors?

Change management established

Are security-relevant changes to systems and processes planned, controlled and tracked?

Evidence collected continuously

Do you continuously collect evidence for implemented controls, instead of gathering it right before the audit?

Monitoring and metrics established

Is the effectiveness of the ISMS measured regularly against defined metrics?

Internal audit conducted

Is an internal audit covering all relevant ISMS areas planned and documented with results?

Management review conducted

Does top management review the ISMS at regular intervals, based on audit results, risks and objective achievement?

Nonconformities and corrective actions tracked

Are deviations documented, root causes analyzed and corrective actions tracked to closure?

Continual improvement demonstrable

Can you show, with examples, that the ISMS is deliberately improved over time?

Stage 1 audit prepared

Is your ISMS documentation and maturity ready for the auditor's review in Stage 1?

Stage 2 audit prepared

Can you demonstrate the effectiveness of your controls in the on-site audit through evidence and interviews?

Certificate validity understood

Are you aware that an ISO 27001 certificate is valid for three years and requires recertification afterwards?

Surveillance audits scheduled

Are annual surveillance audits planned throughout the three-year certification cycle?