Noru

Free tool

ISO 27001 readiness check

Nineteen questions in the standard's own order, the management system first and the controls auditors sample most after it. Get a gap report you can share.

Context and scope

Have you written down the ISMS scope: the services, teams, sites and systems it covers, and where the boundaries sit?
Have you listed the interested parties, such as customers, regulators and staff, and the security requirements each places on you?

Leadership and policy

Has top management approved an information security policy, and have the people it covers acknowledged it?
Is there a named ISMS owner, and does every asset, risk and control have an owner?

Risk and the Statement of Applicability

Have you run a documented risk assessment of what is in scope, with criteria, risk owners and a treatment decision for each risk?
Do you have a Statement of Applicability that decides all 93 Annex A controls, with a justification for each inclusion and exclusion?
Have you set measurable information security objectives, and are you measuring them?

People and documents

Are new joiners screened before they get access, and does everyone complete security awareness training, with records kept?
Are ISMS documents version-controlled, approved, available to the people who need them and reviewed on a schedule?

Controls in operation

Is access approved before it is granted, reviewed on a schedule and removed promptly, with multi-factor authentication on key systems?
Do you keep a supplier inventory and assess the suppliers that handle your information, including your cloud providers?
Do you scan for vulnerabilities and fix them within set timelines, and log and monitor security events?
Do production changes go through review and approval by someone other than the author, enforced by the tooling?
Do you have an incident process with defined roles, including the regulatory reporting deadlines that apply to you?
Are backups restore-tested, and have your continuity plans been tested against agreed recovery objectives?

Audit, review and improvement

Has an internal audit of the ISMS been done by someone independent of the work, or is one booked before the certification audit?
Has top management held a management review that covered the clause 9.3 inputs, with minutes and decisions?
Do you record nonconformities with their root cause and corrective action, and check that the actions worked?

Certification

Have you chosen a certification body accredited for ISO 27001 and agreed dates for Stage 1 and Stage 2?

Your gap report · 0 of 19 answered

Answer the questions above and the report builds here.

Your answers stay in this browser. The share link carries them after the #, which is never sent to our servers.

FAQ

Frequently asked questions

Talk to us

Is this an ISO 27001 gap analysis?

It is a self-check. A gap analysis by a consultant or an internal auditor inspects your documents and records; this asks whether the management system and the key controls exist and points to what is missing. Use it to plan the work before paying for one.

Why does it ask about clauses before controls?

Because the certificate is issued for the management system in clauses 4 to 10. The Annex A controls follow from the risk assessment and the Statement of Applicability, so a gap there undermines everything after it.

When does the report say ready?

Only when every question is answered and none is a no. Yes counts two points, partly one and no zero. A single missing area, such as no internal audit before Stage 1, can be a major nonconformity, so a high score with a no is never called ready.

Trust, settled.

A self-check is a snapshot. Noru keeps the answer current, control by control.

Book a demoMore free tools