ISO 27001 · Implementation Checklist

The ISO 27001 checklist, from scope to certified.

An interactive walkthrough mapped against ISO/IEC 27001:2022. Clauses 4 to 10 and the four Annex A control themes, worked through step by step. Progress saved on your device.

See our ISO 27001 platform

Your progress

0 of 48 items complete

0%

Phase 1

0 / 5

Scope, context and leadership (Clauses 4 to 5).

Define the ISMS scope.
Identify interested parties and their requirements.
Map your legal, regulatory and contractual obligations (data protection law, sector regulation, client requirements).
Sign off the information security policy.
Assign the ISMS owner and roles.

Phase 2

0 / 6

Risk assessment and treatment (Clause 6, Annex A selection).

Agree a risk assessment method.
Build the asset inventory.
Run the risk assessment.
Produce the risk treatment plan.
Complete the Statement of Applicability covering all 93 controls.
Set measurable security objectives.

Annex A.5

0 / 6

Organisational controls (37).

Annex A.6

0 / 5

People controls (8).

Annex A.7

0 / 5

Physical controls (14).

Physical perimeters and entry controls.
Clear desk and clear screen.
Equipment and cabling security.
Secure disposal or reuse.
Protection of portable devices and off-site working.

Annex A.8

0 / 8

Technological controls (34).

Phase 4

0 / 6

Certification (Stage 1 and 2).

Select an accredited certification body.
Complete an internal audit and management review.
Pass the Stage 1 documentation review.
Close any Stage 1 findings.
Pass the Stage 2 evidence audit.
Close any Stage 2 findings.

Find out what's missing before your auditor does.

Learn about ISO 27001

Related resources

Learn about ISO 27001

The ISO 27001 checklist, from scope to certified.

Scope, context and leadership (Clauses 4 to 5).

Risk assessment and treatment (Clause 6, Annex A selection).

Organisational controls (37).

People controls (8).

Physical controls (14).

Technological controls (34).

Operate, measure and improve (Clauses 7 to 10).

Certification (Stage 1 and 2).

Find out what's missing before your auditor does.