An ISO 27001 checklist should follow the standard's own order, because that is the order the auditor tests. Clauses 4 to 10 are mandatory: context and scope, leadership and policy, risk assessment, treatment and the Statement of Applicability, resources and competence, operation, monitoring with internal audit and management review, and corrective action. Annex A's 93 controls are not a checklist of their own: you apply the ones your risk assessment calls for and justify the rest. The list below covers each clause, the records it produces, the four Annex A themes, and what to have ready for Stage 1 and Stage 2.
Most ISO 27001 checklists on the web are lists of Annex A controls. Those are useful for one step, control selection, and useless for the rest, because the certificate is issued for the management system described in clauses 4 to 10. This checklist follows the clauses, names the records each one produces, and ends with the two audit stages. It is the order the implementation guide follows, condensed into something you can tick off.
Clauses 4 to 10: what to have in place and the records each produces
| Clause | What to have in place | Records the auditor asks for |
|---|---|---|
| 4 Context of the organization | Internal and external issues, interested parties and their requirements, a scope with explicit boundaries | ISMS scope statement; the issues and requirements register |
| 5 Leadership | Visible management commitment, an approved information security policy, assigned roles and authorities | Signed policy; roles and responsibilities; evidence of leadership involvement |
| 6 Planning | A risk assessment method and results, risk treatment decisions, the Statement of Applicability, security objectives, planned changes | Risk assessment and treatment process; risk register; risk treatment plan; Statement of Applicability; objectives with measures |
| 7 Support | Resources, competent people, awareness, a communication plan, controlled documents | Competence records; training records; document control evidence |
| 8 Operation | Controls operating as planned, periodic and change-triggered risk assessments, treatment plan executed | Operational records per control; risk assessment results; risk treatment results |
| 9 Performance evaluation | Monitoring and measurement, an internal audit programme and audits, management reviews | Measurement results; audit programme and reports; management review minutes |
| 10 Improvement | Continual improvement, nonconformities handled with root cause and corrective action | Nonconformity log; corrective action records and their verification |
Annex A: the four themes
Once the risk assessment exists, work through Annex A theme by theme and record a decision for each of the 93 controls: applicable and implemented, applicable and planned, or excluded with a reason. The Annex A guide lists every control.
- A.5 Organizational (37 controls): policies, roles, asset handling, access management, suppliers, incident management, continuity and compliance. Mostly decided and documented.
- A.6 People (8): screening, terms of employment, awareness, discipline, leavers, confidentiality agreements, remote working, event reporting. Evidenced per person from the HR system of record.
- A.7 Physical (14): perimeters, entry, secure areas, equipment, media and disposal. Cloud-hosted companies inherit much of this from their providers and keep offices, laptops and media.
- A.8 Technological (34): endpoints, privileged access, malware, vulnerabilities, configuration, backups, logging, networks, cryptography and secure development. Mostly evidenced from connected systems.
Documented information ISO 27001 requires
The standard names the documented information it expects. Have each of these, under version control, before Stage 1:
- The ISMS scope (4.3)
- The information security policy (5.2)
- The risk assessment process (6.1.2) and the risk treatment process (6.1.3)
- The Statement of Applicability (6.1.3 d)
- The information security objectives (6.2)
- Evidence of competence (7.2)
- The documented information the organization decides is necessary for the ISMS to be effective (7.5.1 b)
- Evidence that operational processes were carried out as planned (8.1)
- The results of risk assessments (8.2) and of risk treatment (8.3)
- Monitoring and measurement results (9.1)
- The internal audit programme and audit results (9.2)
- The results of management reviews (9.3)
- The nature of nonconformities, the actions taken and their results (10.2)
Before you book the audit
- The internal audit has been done by someone independent of the areas audited, and its nonconformities are closed or have a corrective action under way.
- A management review has been held with the inputs clause 9.3 lists, and its decisions are minuted.
- Every control in the Statement of Applicability marked as implemented has at least one record showing it ran.
- The certification body is accredited for ISO/IEC 27001 by a national accreditation body, and its audit-day quote is based on the people and sites in scope.
- Stage 1 and Stage 2 dates are booked with enough gap to fix what Stage 1 finds.
Common gaps found at Stage 1
- A scope statement that names the company but not the boundaries, so the auditor cannot tell what is excluded.
- A Statement of Applicability with exclusions but no reasons, or inclusions that trace to no risk.
- Objectives that cannot be measured, so clause 9.1 has nothing to monitor.
- Policies approved but not communicated, with no record of who has read them.
- No internal audit yet, or one planned for after the certification audit.
The timeline article shows how long each of these steps usually takes, and the Stage 1 versus Stage 2 article explains what each audit stage tests.