ISO/IEC 27001:2022 · READINESS CHECK
HOW READY ARE YOU FOR ISO 27001?
Answer 15 questions about your information security management system. You get an indicative readiness score and a clear list of what is still missing.
- 4.3CRITICAL
ISMS scope
Have you defined and documented which parts of the organisation the ISMS covers?
Evidence: Approved scope statement - 5.2CRITICAL
Information security policy
Is there an information security policy approved by top management?
Evidence: Signed or approved policy - 5.3
Roles & responsibilities
Are information security roles, responsibilities and authorities assigned?
Evidence: Role descriptions or RACI - 6.1.2 / 8.2CRITICAL
Risk assessment
Have you carried out an information security risk assessment with a defined method?
Evidence: Risk methodology and risk register - 6.1.3 / 8.3CRITICAL
Risk treatment
Is there a risk treatment plan with owners and decisions for each relevant risk?
Evidence: Risk treatment plan - 6.1.3 dCRITICAL
Statement of Applicability
Have you determined which Annex A controls apply and why?
Evidence: Statement of Applicability (SoA) - 6.2
Security objectives
Are measurable information security objectives defined and monitored?
Evidence: Objectives with owners and targets - 7.2 / 7.3
Awareness & training
Do employees receive information security awareness training?
Evidence: Training records - A.5.9
Asset inventory
Is there an up-to-date inventory of information and related assets with owners?
Evidence: Asset register - A.5.15 / A.8.5
Access control
Are access rights managed and is multi-factor authentication used for critical systems?
Evidence: Access policy, access reviews, MFA - A.5.19–5.22
Supplier security
Are security requirements agreed and monitored with key suppliers and cloud providers?
Evidence: Supplier list and agreements - A.5.24–5.28
Incident management
Is there a process to report, handle and learn from security incidents?
Evidence: Incident procedure and log - A.8.13 / A.5.30
Backup & continuity
Are backups tested and is information security covered during disruptions?
Evidence: Backup tests, continuity plan - 9.2CRITICAL
Internal audit
Has an internal audit of the ISMS been planned or performed?
Evidence: Audit programme and report - 9.3CRITICAL
Management review
Has top management reviewed the ISMS performance?
Evidence: Management review minutes
YOUR RESULT
Answer all questions to see your result.
Indicative self-assessment only. It is not an audit, not advice and no guarantee of certification.