ISO 27001 checklist, clause by clause

A checklist made of clause headings tells you nothing about whether you are ready. This one follows the order the work actually happens in, and every item says what done looks like and what the audit team will ask you to produce.

Last reviewed 2026-09-15Written by Jacob Masse, TrazTech Inc.

ISO/IEC 27001:2022 has two halves that behave differently. Clauses 4 to 10 carry 25 mandatory requirements, none excludable. Annex A lists 93 reference controls, and which of those apply is an output of your risk treatment rather than an input to it. Ticking all 93 before doing a risk assessment produces a Statement of Applicability nobody can defend.

The order below is the dependency order. Scope constrains the risk assessment, the assessment produces the treatment plan, the plan decides Annex A, and the rest is evidence that the system is running. The requirements are set out clause by clause on the clauses page, and the route to a certificate here is on ISO 27001 certification in Canada.

25 Mandatory requirements in clauses 4 to 10, none excludable

93 Annex A reference controls, applicability decided by risk

2 Audit stages before a certificate is issued

Each item below names an artifact, the condition that makes it done, and the question asked about it in the audit room. An item is not done because a document exists. It is done when the document is approved, dated, owned by somebody who can explain it, and matched by what happens in the business.

Clause 4: context and scope

A scope written too wide drags systems, offices and teams into an audit that did not need to be there. One written too narrow gets challenged at stage 1, or satisfies nobody in your pipeline because the certificate does not cover the product the customer buys.

0 of 5 done ·

Internal and external issues are recorded in writing. Done looks like a short register of the regulatory, contractual, market and technical factors bearing on information security. At audit you will be asked how it is kept current.
Interested parties are identified with their requirements. Done looks like a table of customers, regulators, employees and suppliers against specific requirements: a contract clause, PIPEDA and any provincial statute reaching your data, a service level commitment.
Interfaces and dependencies are mapped. Done looks like every point where work inside the scope depends on something outside it: a parent company running your identity provider, a hosting provider, a contractor network. This is the item most often missing, and the one an auditor uses to test whether the scope is honest.
The scope statement is written, approved and short. Done looks like a paragraph naming the services, locations, organizational units and technology, plus any exclusion with a reason. It is reproduced on the certificate. The scope statement page works through the wording and the ISMS scope builder drafts one.
The management system is a thing with a boundary, not a folder of policies. Done looks like answering in one sentence what is inside and what is outside.

What a certification auditor looks for in clause 4

Evidence that passes. A documented scope statement naming the organization units, locations, systems and interfaces inside the ISMS, a record of internal and external issues, and a list of interested parties with their requirements. Stage 1 reads these first.

How long. One to three weeks. The scope decision is the one that sets the cost of everything after it.

Common mistakes. A scope so narrow buyers will not accept it, or so wide the company cannot run it; interested parties listed with no requirements; and interfaces to out-of-scope systems left undescribed.

Canadian note. List the regulators that apply to you as interested parties: the Privacy Commissioner of Canada under PIPEDA, the Commission d'accès à l'information for Quebec personal information, and any sector regulator such as OSFI if you serve federally regulated financial institutions.

Clause 5: leadership

Clause 5 asks for three things and auditors test them by talking to people rather than reading documents. The evidence is whether the answers match.

0 of 4 done ·

Top management commitment is demonstrable. Done looks like a named executive who can describe the scope, the top risks and the objectives unprompted, plus minutes showing security decisions at that level. An auditor will interview them.
An information security policy is approved and published. Done looks like a document stating the commitment to meeting requirements and to continual improvement, framing the objectives, available to staff, with an approval date and an owner. Detail belongs in the supporting policies on the documentation page.
Roles, responsibilities and authorities are assigned and communicated. Done looks like named people against the duties: who maintains the risk register, who approves exceptions, who runs the internal audit.
The resourcing decision is made and visible. Done looks like budget, headcount or a contracted arrangement matching the plan. Clause 5 covers how this is tested.

What a certification auditor looks for in clause 5

Evidence that passes. A signed information security policy, documented roles and responsibilities, and minutes or emails showing top management actually made decisions about the ISMS. Auditors interview a senior leader during Stage 2.

How long. A week to draft and approve. The evidence of commitment builds over the months before the audit.

Common mistakes. A leader who cannot say what the ISMS is for in the interview, and a policy approved by the person who wrote it rather than by top management.

Tip. Put ISMS decisions on an existing leadership meeting agenda each quarter. Two lines of minutes each time is better evidence than a single long annual review.

Comparing firms for this? Tell us what you need and it goes to the ones in the directory that do this work. No charge, and no phone number required.

Clause 6: planning, risk and the Statement of Applicability

This is the largest block of work and it determines everything downstream. Do it in the stated order: a risk assessment run before the methodology is agreed produces results nobody can reproduce, and reproducibility is an explicit requirement.

0 of 6 done ·

A risk assessment methodology is documented and approved before any risk is scored. Done looks like written likelihood and impact criteria, a defined acceptance threshold, and the identification approach. The audit question is whether two people applying it to the same risk land in the same place.
The risk assessment is performed and the results retained. Done looks like a register where each risk has an owner, a cause, an effect on confidentiality, integrity or availability, scored likelihood and impact, and a treatment decision. The risk assessment page covers asset-based and scenario-based approaches.
A risk treatment plan exists with owners and dates. Done looks like each risk above the threshold carrying a chosen option, the controls implementing it, a target date and a residual score, with residual acceptance signed by the risk owner rather than the plan's author. The treatment plan page and the risk treatment planner cover the format.
The Statement of Applicability is complete and traceable. Done looks like all 93 Annex A controls listed, each marked applicable or not, each applicable one linked to the risk or requirement that made it necessary and to its status, and each exclusion justified. This is the document the audit team reads first. The Statement of Applicability page has the structure.
Objectives are set at relevant functions and levels, and they are measurable. Done looks like a number attached, and a plan naming what will be done, by whom, with what resources, by when, and how the result is evaluated.
Changes to the management system are planned rather than improvised. Done looks like pointing at a change that was considered, decided and recorded, such as a scope extension or a new hosting region.

What a certification auditor looks for in clause 6

Evidence that passes. A risk assessment method, a risk register with owners and treatment decisions, a risk treatment plan, measurable security objectives, and a Statement of Applicability covering all 93 Annex A controls with a justification for every inclusion and exclusion.

How long. Three to six weeks for a first risk assessment and Statement of Applicability. It is the largest single piece of work before Stage 1.

Common mistakes. A Statement of Applicability that excludes controls without a reason, risk owners who do not know they are risk owners, and objectives nobody measures.

2022 note. Certificates to the 2013 edition had to transition by October 31, 2025, so every audit now uses the 2022 control set. The 2024 amendment also asks you to consider whether climate change is a relevant issue in clauses 4.1 and 4.2.

The ordering trap

If your Statement of Applicability was produced by opening Annex A and marking almost everything applicable, the audit team can see it: the justifications read as generic and no control traces back to a risk. Letting the register drive control selection saves an argument at every audit that follows.

Clause 7: support

Clause 7 separates a system that exists on paper from one people use. Four of its five requirements are about human beings.

0 of 5 done ·

Resources are determined and provided. Done looks like the tooling, time and people the plan assumes being actually available, including whoever runs the internal audit.
Competence is determined, met and evidenced. Done looks like a statement of what each security role needs, and records showing the holder has it through education, training or experience.
Awareness reaches everyone working under your control, contractors included. Done looks like completion records showing people know the policy, their contribution, and what happens if they do not follow it. Gaps in contractor records are a standard finding.
Communication is planned rather than ad hoc. Done looks like a short table of what is communicated about security, when, to whom and how, including incident notification.
Documented information is controlled. Done looks like version numbers, approval, dates, an owner, defined retention, and control over access. A wiki is fine if it has history and approval. Clause 7 lists what has to be retained.

What a certification auditor looks for in clause 7

Evidence that passes. Competence records for people with ISMS roles, awareness training completion for everyone in scope, a communication plan, and document control showing versions, approvals and where the current copy lives.

How long. Two to four weeks to set up training and document control. Competence records are often the slowest part because they need CVs, certificates or training records per role.

Common mistakes. Training assigned but not completed, several versions of the same policy in circulation, and competence claimed for roles with no record behind it.

Canadian note. Where training covers personal information handling, align it with your PIPEDA and Law 25 obligations so the same record serves both.

Clause 8: operation

Clause 8 is short in the standard and long in practice. Run the processes you designed and keep the evidence that you ran them.

0 of 4 done ·

The processes needed to meet requirements are planned, implemented and controlled. Done looks like tickets, logs, approvals and review records dated across the period, not a batch created the week before the audit.
Outsourced processes are identified and controlled. Done looks like knowing which parts of your security somebody else performs, and holding the contract terms, the review record and any assurance report they issue.
The risk assessment runs at planned intervals and on significant change. Done looks like a dated reassessment after an acquisition or a move to a new hosting provider.
The risk treatment plan is implemented and the results retained. Done looks like closed actions with evidence attached, and open actions carrying a revised date and a reason rather than silently slipping.

What a certification auditor looks for in clause 8

Evidence that passes. Evidence that the risk treatment plan is being carried out: controls implemented, changes managed, suppliers assessed, and a risk assessment repeated when something significant changed.

How long. This is the operating period. Most certification bodies want to see the ISMS running for about three months before Stage 2.

Common mistakes. Treating the risk assessment as a one-off document, and supplier assessments that stop at collecting a certificate without checking what scope it covers.

Tip. Keep a simple log of significant changes and whether each triggered a risk review. Auditors ask for it, and it is easy to keep and hard to reconstruct.

Clause 9: performance evaluation

Three requirements, and the last two are the ones a certification body checks have genuinely happened before it will issue anything.

0 of 4 done ·

Monitoring and measurement are defined and performed. Done looks like a written statement of what is measured, by which method, when and by whom, plus the retained results. Patch latency, access review completion and incident response times are typical.
An internal audit program is running and covers the whole system. Done looks like a schedule, criteria and scope per audit, auditors independent of the work they audit, completed reports with findings, and results reported to management. The internal audit page covers independence and scheduling.
A management review has been held and minuted against the required inputs: status of prior actions, changes in issues and interested parties, performance feedback including audit results and nonconformities, risk and treatment status, improvement opportunities, and decisions taken. Management review lists them in order.
At least one full cycle has run before the certification audit, with the management review held after the internal audit so it has something to review.

What a certification auditor looks for in clause 9

Evidence that passes. Monitoring results against your objectives, a completed internal audit program with findings, and a management review that covers every input clause 9.3 lists, with decisions recorded.

How long. An internal audit of a small ISMS takes two to five days. A management review is a two-hour meeting with a prepared pack.

Common mistakes. An internal audit done by the person who built the ISMS, a management review that skips required inputs, and metrics with no targets.

Independence. The internal auditor must be objective and impartial. A small company can use a colleague from another function, or bring in an outside auditor for a few days.

Clause 10: improvement

Two requirements, and an empty nonconformity log is itself a signal.

0 of 3 done ·

Nonconformities are recorded and reacted to. Done looks like a log where each entry has the nonconformity, the immediate correction, the consequences dealt with, and a date.
Corrective action addresses cause, not symptom. Done looks like a documented cause analysis, a check for similar nonconformities elsewhere, the action taken, and a review of its effectiveness. That last step is most often skipped and it is checked. Nonconformity and corrective action has the sequence.
Continual improvement is evidenced. Done looks like changes you can point at, traced to audit findings, incidents or review decisions. Continual improvement covers what counts.

What a certification auditor looks for in clause 10

Evidence that passes. A nonconformity and corrective action log with root causes, the action taken and a check that it worked, plus examples of improvement you made on your own initiative.

How long. Ongoing. The log should have entries before Stage 2, usually from the internal audit.

Common mistakes. An empty log, which looks like nobody is looking, and corrective actions closed without checking they fixed the cause.

After certification. Surveillance audits happen each year and recertification every three years. The corrective action log is the first thing a surveillance auditor opens.

Annex A: 93 controls in four themes

Annex A of the 2022 edition holds 93 controls in four themes. The 2013 edition had 114 in 14 domains and nothing was removed in the rewrite. Controls were merged and regrouped by who owns them.

Annex A themes in ISO/IEC 27001:2022 and what each covers
Theme	Controls	What it covers
Organizational	37	Policies, roles, supplier and cloud relationships, threat intelligence, incident management, continuity, legal requirements
People	8	Screening, terms of employment, awareness, disciplinary process, duties after termination, remote working, reporting events
Physical	14	Perimeters, entry, secure areas, equipment siting, cabling, maintenance, secure disposal, clear desk and screen
Technological	34	Endpoints, privileged access, cryptography, secure development, logging, monitoring, backup, data masking, web filtering
Total reference controls	93	Applicability decided by risk treatment

The checklist item here is not "implement 93 controls". It is that every control has a recorded decision, every applicable control traces to a risk or a requirement and carries a status and an owner, and every exclusion has a justification that would survive being read aloud. Excluding a control because you have no on-premises data centre is defensible. Excluding one because it looked difficult is a finding waiting to happen, and the physical controls are where that shows up in remote-first companies that still keep an office.

The Annex A controls page sets out what each theme expects, and the Annex A control selector gives a first pass at applicability. Implementation guidance lives in ISO 27002, which is not itself certifiable.

Before the certification audit

Certification runs in two stages with the same audit team. Stage 1 reads, stage 2 tests, and knowing which questions belong to which stage is the difference between a clean pass and findings that delay the certificate.

What each audit stage asks for
Stage 1, documentation review	Stage 2, effectiveness audit
Scope statement, and whether it matches what you sell	Interviews to see whether the documented process is the one staff follow
Information security policy and supporting policies	Samples of records across the period: access reviews, change approvals, incident tickets
Risk methodology, risk assessment and treatment plan	Evidence that treatment actions were implemented on the dates claimed
Statement of Applicability, including exclusions	Control testing against the applicable controls in the Statement of Applicability
Internal audit plan and reports	Whether findings raised internally were actually closed
Management review minutes	Whether decisions recorded in the review led to anything
Readiness for stage 2, and a date	Nonconformities, graded major or minor, with a window to respond

The gap between stages runs from a few weeks to a few months, and a stage 1 finding that the system has not operated long enough is the usual cause of the longer gap. Evidence samples need three months of operation at the short end. The stage 1 and stage 2 page covers what happens between them, the stage 1 readiness check flags what is missing before you book a date, and a gap assessment does the same job against a longer runway.

The items that fail most often

Interfaces and dependencies missing from clause 4, which makes the scope unverifiable.
A Statement of Applicability where applicable controls trace to no risk.
Objectives that are not measurable, so clause 9 has nothing to measure against.
Internal audit performed by the person who built the system, failing the independence requirement.
Management review minutes missing two or three of the required inputs.
Corrective actions closed without an effectiveness review.
Awareness records covering employees but not contractors.

Each is cheaper to fix before stage 1 than after stage 2. The free tools on this site ask for no email address.

What to do next

This month. Settle scope and write the risk method. They drive every other clause.

Next. Run the risk assessment and draft the Statement of Applicability against the 93 Annex A controls, with a reason for every exclusion.

Before Stage 1. Operate the ISMS for about three months, complete an internal audit and a management review, and log the corrective actions.

Choosing a certification body. Use one accredited for ISO 27001 by an IAF member, such as the Standards Council of Canada, and check the accreditation on the IAF CertSearch database. Ask for Stage 1 and Stage 2 dates in writing.

Get quotes for ISO 27001 readiness

Tell us your scope, target date and position on this checklist.

Get matched

Common questions

Do we have to implement all 93 Annex A controls?

No. You have to make and record a decision about all 93. Which ones apply is determined by your risk treatment and by legal, regulatory and contractual requirements, and the Statement of Applicability is where those decisions are written down. Most organizations end up with a large majority applicable, but each exclusion has to rest on a reason that relates to your situation.

Can we do the internal audit ourselves?

Yes, as long as the auditor is independent of the work being audited. In a small company that means somebody from a different function, or an outside party. The person who wrote the policies and built the controls cannot audit them, and that is the most common way this requirement fails. Keep a record of the auditor's training or experience.

How long does the checklist take to work through?

For a company under 100 people starting from documented but informal practice, six to nine months to stage 2 is realistic, and the binding constraint is elapsed time rather than effort. Clause 9 needs an internal audit and a management review to have happened, and clause 8 needs operating history. Neither compresses by adding people.

This directory is published by TrazTech Inc.