Tick what is genuinely in place today. Each line points to the ISO 27001:2022 clause or Annex A control it relates to. Your ticks live only on this page: nothing is stored, so reloading clears them.

Overall readiness

Just starting

0%

ISMS foundations (clauses 4-10) 0 / 5

The scope of the information security management system is written down (4.3) There is a documented risk assessment method and a current risk register (6.1.2) A Statement of Applicability lists which Annex A controls you use and why (6.1.3) Management reviews the ISMS at planned intervals and records decisions (9.3) Internal audits of the ISMS run on a schedule (9.2)

Organisational controls (Annex A.5) 0 / 7

An information security policy is approved by management and communicated (5.1) Information assets are inventoried and each has an owner (5.9) Access control rules are defined, and access is reviewed regularly (5.15) Suppliers are assessed and security requirements are in their contracts (5.19, 5.20) An incident response process exists with named roles (5.24) Business continuity plans exist and restoring from backup has been tested (5.29, 5.30) Legal, regulatory and contractual requirements are identified and tracked (5.31)

People controls (Annex A.6) 0 / 5

Staff are screened before hiring, as far as the law allows (6.1) Employment terms include information security responsibilities (6.2) Everyone gets security awareness training, repeated regularly (6.3) There are clear rules for remote working (6.7) Staff know how to report a security event, and can do so easily (6.8)

Physical controls (Annex A.7) 0 / 3

Offices and server rooms have controlled entry (7.2) A clear desk and clear screen rule is followed (7.7) Old equipment and media are wiped or destroyed securely (7.14)

Technological controls (Annex A.8) 0 / 9

Privileged accounts are limited and protected (8.2) Strong authentication, including multi-factor, protects important systems (8.5) Malware protection is in place on endpoints and servers (8.7) Vulnerabilities are tracked and patched within defined timeframes (8.8) Backups run automatically and are kept offline or immutable (8.13) Logs are collected and monitored for unusual activity (8.15, 8.16) A cryptography policy covers encryption in transit and at rest (8.24) Networks are secured and segmented (8.20, 8.22) Changes and software development follow a controlled process (8.25, 8.32)

Read the ISO 27001 guide

A self-assessment to start a conversation. It is not a certification audit, does not cover every Annex A control, and a high score does not mean you would pass one.

PRIVACY & COOKIES