Readiness for ISO/IEC 27001 — Information Security

4.1 Have you recorded the internal and external issues (e.g. market, competition, technology, legislation) that affect your information security management system?

4.2 Have you identified the interested parties (customers, employees, authorities, suppliers, etc.) and their requirements?

4.3–4.4 Has the scope of your information security management system been defined in writing (activities, sites, any exclusions), and have the main processes been mapped?

5.1 Is top management actively involved in the information security management system, providing resources and building it into business decisions?

5.2 Is there an approved information security policy that suits the business, has been communicated to staff and is available to those who need it?

5.3 Have roles, responsibilities and authorities for the system been defined and communicated?

6.1 Have you assessed the risks and opportunities related to your information security management system and planned actions to address them?

6.1.2 Do you have an information security risk assessment methodology, and have you assessed the risks to your information assets (data, systems, suppliers)?

6.1.3 Is there a risk treatment plan and a Statement of Applicability (SoA) that justifies which Annex A controls are applied?

6.2 Are there measurable information security objectives with owners, resources, a timeline and a way of monitoring them?

6.3 Are changes to the system (organisational, process, infrastructure) planned and controlled before they are made?

7.1–7.2 Have you defined the competence required for each relevant role, and do you keep records of training, experience or qualifications?

7.3–7.4 Are staff aware of the information security policy and of their contribution to the system, and is there a defined way of communicating internally and externally?

7.5 Are the system's documents and records controlled (approval, versions, distribution, storage, retention)?

8.1–8.3 Are risk assessment and risk treatment repeated at planned intervals or when significant changes occur?

A.5 Are there organisational controls: an inventory of information assets, information classification, acceptable-use rules and role-based access control?

A.5 Is information security covered in relationships with suppliers and cloud providers (contracts, evaluation, monitoring)?

A.5 Is there an information security incident management process (reporting, assessment, response, lessons learned) and provision for business continuity?

A.5 Have you recorded the legal and contractual requirements (e.g. GDPR, NIS2 where applicable), and do you protect personal data?

A.6 Are there people controls: pre-employment screening, confidentiality terms, awareness training and a leaving process?

A.7 Are premises and equipment physically protected (entry control, a secure server room, secure disposal of media)?

A.8 Are technical controls in place: identity management and strong authentication (MFA), malware protection, updates and vulnerability management?

A.8 Are backups taken and tested, and are there event logging and monitoring, and network security?

A.8 Are secure software development, testing and separation of environments applied? If this does not apply to you, choose “Not applicable”.

9.1 Do you monitor, measure and analyse indicators of information security performance and evaluate the results?

9.2 Is there an internal audit programme, and has at least one full internal audit of the system been completed by a competent person?

9.3 Has a management review of the system been held and recorded, with decisions and actions?

10 Are nonconformities recorded, their causes analysed, and corrective actions taken and checked for effectiveness?

10 Are there documented examples of continual improvement of the system?