ISO 27001 Compliance Checklist

Clause 4 — Context of the Organization

• Internal and external issues identified (4.1)
• Interested parties and their requirements documented (4.2), including which requirements the ISMS addresses (4.2 c)
• ISMS scope documented and available (4.3)
• ISMS established, implemented, maintained, and continually improved (4.4)

Clause 5 — Leadership

• Top management commitment evidenced (5.1)
• Information security policy established, documented, communicated (5.2)
• Roles, responsibilities, and authorities assigned (5.3)

Clause 6 — Planning

• Risk assessment process defined and retained (6.1.2)
• Risk treatment process and Statement of Applicability complete (6.1.3)
• Information security objectives set and planned (6.2)
• Changes to the ISMS planned (6.3)

Clauses 7–10 — Support, Operation, Performance, Improvement

• Resources, competence, awareness, communication, documented information controlled (Clause 7)
• Operational planning and control; risk assessment/treatment performed at planned intervals (Clause 8)
• Monitoring, internal audit, management review running (Clause 9)
• Nonconformity and corrective action process evidenced (Clause 10)

Annex A Controls

After the ISMS clauses are green, walk your SoA themes: Organizational (A.5), People (A.6), Physical (A.7), Technological (A.8). See 93 controls in 4 themes.

Frequently Asked Questions

Is this an official ISO checklist?

No. It is a practical readiness checklist aligned to the ISO/IEC 27001:2022 management-system clauses. Certification bodies use their own audit plans.

Do I need an Excel file?

This page works as an on-page checklist. Request a spreadsheet pack from CyberSilo if your team prefers Excel tracking.

Does completing the checklist equal certification?

No. Certification requires an accredited certification body Stage 1 and Stage 2 audit of your implemented ISMS.

Related ISO 27001 Resources

Gap analysis · Mandatory documents · Stage 1 vs Stage 2 · ISO 27001 hub