ISO 27001 Readiness Checklist

Mark each item complete, partial, or missing. Assign owners. Use it to gauge readiness for an ISO/IEC 27001 certification audit — not as a substitute for the purchased standard and not as copied control text from Annex A.

Edition context: ISO/IEC 27001:2022. ISO/IEC 27001:2022 is the current ISMS requirements standard. Transition timing depends on certification-body and accreditation rules — verify with the CB.

Beyond Carbon can facilitate a formal readiness assessment. We do not issue certificates.

□ Internal/external issues affecting information security determined □ Interested-party requirements relevant to the ISMS identified □ ISMS scope defined (locations, systems, processes, cloud boundaries) □ Interfaces and dependencies with outsourced providers understood □ Scope statement approved and communicated to those who need it

□ Information security policy established and available as required □ Roles, responsibilities, and authorities for ISMS assigned □ Information security objectives set and monitored □ Risk and opportunity process defined for the ISMS □ Risk assessment method documented and applied consistently □ Risk treatment plans owned with target dates □ Statement of Applicability (SoA) produced and maintained (your decisions — not a copied control list from elsewhere)

□ Competence for ISMS roles determined; evidence retained □ Awareness of policy and contributions achieved for relevant personnel □ Internal/external communication rules for information security defined □ Documented information controlled (creation, update, protection) □ Resources for operating the ISMS identified

□ Operational planning and control implemented for ISMS processes □ Risk assessment/treatment results kept up to date after significant change □ Outsourced processes affecting the ISMS controlled

□ Monitoring and measurement of ISMS performance underway □ Internal ISMS audits conducted by competent, impartial auditors □ Management review completed with ISMS inputs and decisions □ Nonconformities and corrective actions managed with effectiveness checks □ Continual improvement evidenced through changes and risk updates

□ CB shortlist with accreditation/competence checked by you □ Stage 1 pack: scope, policy, risk process, SoA, key documented information indexed □ Process owners briefed (IT, HR, facilities, vendors as applicable) □ Prior findings closed or actioned □ Cloud/shared-responsibility diagrams ready if in scope □ Multi-site / remote workforce sampling understood with the CB

Pair with the generic certification preparation checklist for logistics.

This is an editorial readiness aid. It does not reproduce ISO/IEC 27001 requirements or Annex A control wording. Completing it does not guarantee certification. Certification decisions are made by independent CBs.

Beyond Carbon provides ISO consultancy, implementation support, documentation assistance, and audit preparation support. Independent certification bodies issue certificates after successful certification audits. Beyond Carbon does not present itself as a certification body or accreditation body.