Free tools/ISO readiness

Check readiness for ISO 27001 and ISO 42001

Select one standard or both. See which controls are in place, where evidence is missing and what to do before an audit.

Start the readiness check See a sample result

Readiness at a glance

ISO 27001—

Shared management system

ISO 42001—

One standard or both

15 practical questions

Answers stay in this browser

About eight minutes

The checker

Rate the statement that sounds most like your organisation

Three context questions choose which areas you see. The seven core areas are shared by both standards because they use the same management system skeleton. Rate each one honestly rather than kindly, because auditors will. The full report unlocks when every visible area is answered.

Check your evidence

About your organisation

Which certification are you heading for?

ISO 27001 ISO/IEC 42001 Both together

What do you already hold?

No ISO certification yet ISO 27001, already certified Another ISO standard, such as 9001

What is driving the timetable?

Nothing fixed yet A customer or tender deadline A board or regulatory commitment

The management system core. Shared by both standards

Leadership and policy

Does leadership own the system?

1No policy exists and no executive owns the system2A policy template was downloaded. Nobody signed it and nobody follows it3A policy is signed but leadership involvement ends at the signature4A named executive owns the system and the policy shapes real decisions5Leadership sets objectives, reviews performance and funds the system like any other business capability

Scope and context

Is the scope of the system defined?

1No scope exists. Nobody has defined what the certificate would cover2A rough idea of scope exists in conversation. Nothing is written down3A draft scope exists but misses locations, services or systems it should cover4The scope is documented, sensible and matches how the business runs5The scope is documented, reviewed and tested against customers, regulators and other interested parties

Risk management

How are risks assessed and treated?

1No risk assessment has ever been done2Risks were listed once in a meeting, with no method and no follow up3A risk assessment exists but is out of date or has no treatment plan4A current risk assessment with owners and a treatment plan is in place5Risk assessment runs on a cycle and every treatment decision is evidenced and tracked

Objectives and planning

Are there measurable objectives with plans behind them?

1No objectives exist beyond getting certified2Objectives exist but nobody measures them3Objectives are set and reviewed now and then4Measurable objectives have owners and plans5Objectives drive improvement and are reported on

Roles and ownership

Does everyone know who owns the management system?

1Nobody owns it2One person carries it informally3An owner is named and known4Roles are defined, resourced and deputised5Ownership is reviewed and survives staff changes

The management system core. Shared by both standards

Documented information

Does the work leave evidence?

1Almost nothing is written down2Documents sit in scattered places with no versions and no owner3Core documents exist but records of day to day operation are thin4Documents are controlled and operations leave the records the standard expects5Documentation is lean and current, and audit evidence is a by product of normal work

Competence and awareness

Do people know what the system asks of them?

1Nobody has been trained and no competence records exist2Some training happened once. Nothing was recorded3Training exists for some roles and records are patchy4Roles are defined, training runs on a schedule and records are kept5Competence is planned and measured, and anyone in scope can say what the system asks of them

Internal audit

Has the system been checked?

1There has never been an internal audit or a management review2Something audit shaped happened once, with no records3An internal audit or a management review has run, but not both, or without follow up4Internal audits and management reviews run and produce actions that get closed5A full audit cycle and a management review rhythm run, with closed actions and evidence

Management review

Does leadership review the system and act on it?

1Leadership has never reviewed it2It gets a mention when something goes wrong3A review happens but actions drift4Reviews run on schedule with tracked actions5Reviews change budgets, priorities and the plan

ISO 27001 security controls

Asset and information scope

Policies, suppliers and incidents

1No security policies, supplier checks or incident process exist2A few policies exist on paper. None are operated3Policies are operated in places. Suppliers and incident response are the weak spots4The key controls operate: incident management, supplier security and asset ownership5Organisational controls are operated, measured and evidenced across the business

Annex A controls

Access, encryption, logging and backup

1No access management, encryption, logging or tested backups2Basic IT hygiene exists. Nothing is documented or checked3Key controls exist with uneven coverage. Logging, encryption or backups have gaps4Access control, encryption, logging, backup and vulnerability management operate5Technical controls are monitored, tested and evidenced, including restore tests

The management system core. Shared by both standards

Security incidents

What happens when something goes wrong?

1Problems are fixed informally and forgotten2Incidents get discussed but nothing is recorded or tracked3Some nonconformities are recorded. Root causes rarely are4Nonconformities are logged with root cause and corrective action5Improvement is systematic. Trends are analysed and corrective actions are verified as effective

ISO/IEC 42001 AI controls

AI system inventory

Do you know your AI systems?

1No list of AI systems exists anywhere2A partial list exists and is maintained informally3An inventory exists but lifecycle records from design to retirement are thin4A current inventory with owners and lifecycle documentation is in place5The inventory drives reviews and every lifecycle stage leaves records

AI impact assessment

Are AI risks and impacts assessed?

1No AI risks or impacts have ever been assessed2Risks were discussed once. Nothing was written down3Some AI risks are assessed. Impacts on individuals and society are not4Risk and impact assessments run for each significant AI system5Assessments run on a cycle, gate real decisions and are evidenced to the standard

Responsible AI controls

Who checks the machine and the suppliers?

1There are no human review points and no view of supplier AI2Oversight relies on individuals noticing problems. Suppliers are unexamined3Review points exist for some systems. Third party AI is mostly unmanaged4Oversight is defined for significant decisions and supplier AI is assessed5Oversight, transparency and supplier obligations are operated and evidenced

Your readiness crosswalk

ISO 27001—

ISO 42001—

ISO 27001

Asset and information scope

Annex A controls

Security incidents

Shared management system

Leadership and policy

Scope and context

Risk management

Objectives and planning

Roles and ownership

Documented information

Competence and awareness

Internal audit

Management review

ISO 42001

AI system inventory

AI impact assessment

Responsible AI controls

✓Working!Needs evidence

Prepare for audit

Complete the shared evidence that affects both standards, then close each standard specific gap.

Review the evidence plan

Your readiness

0of 11 answered

Your score and verdict appear when every area is answered.

Progress0 answered

Average score by group

Management system core

–

ISO 27001 controls

–

ISO/IEC 42001 controls

–

Book an Intelance review This is a self assessment. In our experience a certification auditor lands about one level below the self view, so treat your result as an upper bound before you book Stage 1.

What this checks

Management system controls and evidence.

How the standards work together

One shared foundation with distinct controls.

Speak to an assessor

Test the result with an experienced adviser.

Your report

What your answers say

The full report unlocks when every visible area is answered.

Answer the areas above and this section builds your report: your readiness verdict, scores by clause, your biggest gaps, a realistic timeline, itemised costs and a 90 day plan.

Scores by area

Leadership and policy–

Scope and context–

Risk management–

Objectives and planning–

Roles and ownership–

Documented information–

Competence and awareness–

Internal audit–

Management review–

Asset and information scope–

Annex A controls–

Security incidents–

AI system inventory–

AI impact assessment–

Responsible AI controls–

Your biggest gaps

Ranked by score, then by how hard each gap fails an audit. Fix these in order.

Your route to certification

The stages every certification follows, sized from your answers.

The first weeks

Prepare

The middle months

Build and evidence

The final weeks

Audit and certify

What it honestly costs

Three separate numbers get mixed together in most quotes. Here they are apart.

Certification body fees

£4,000 to £12,000

Across a typical three year certification cycle for a small or mid sized organisation, paid to the certification body. Choose a UKAS accredited body and get two or three quotes.

Your internal effort

The real cost

Plan for the system owner spending one to two days a week during the build, and everyone in scope giving hours rather than days.

Specialist support, if you want it

Optional

Do it yourselves or get help?

–

One system or two?

–

How ISO/IEC 42001 implementation works

Recommended next step

ISO 27001 Readiness Assessment

A senior led gap analysis against the full standard, priced and sequenced so the build starts from evidence.

From £8,500 + VAT

See how it works or call +44 20 3985 5809

Want these results checked? A senior adviser reviews your answers, corrects the optimism and gives you an independent two page verdict within five working days. From £750 + VAT, deducted from any full engagement within three months. How the expert review works

Method

How the checker works

Both standards are built on the same management system skeleton, clauses 4 to 10. The checker scores that shared core once, then adds the control areas specific to the standard you are heading for. Every statement, gate and source is set out below so you can challenge the method or rerun it as a workshop.

ISO 27001 readiness is scored across eleven areas: seven management system clauses shared with every modern ISO standard, and four control themes matching Annex A. ISO/IEC 42001 readiness uses the same seven core clauses plus four AI specific control areas. Each area is rated 1 to 5, giving a readiness score out of 100 per standard. Most uncertified organisations score between 35 and 60 on a first pass, and what stands between them and certification is usually the evidence trail rather than the controls themselves.

The verdict and its gates

The verdict is banded by score: 75 or above is ready for Stage 1, 50 to 74 is close with gaps to fix, 30 to 49 needs a structured build, and below 30 means starting from the foundations. Two areas act as gates on top of the banding: risk assessment, and internal audit with management review. No certification body will pass an organisation that has never assessed its risks or checked its own system, however strong the rest looks, so a critically low score in either holds the verdict below ready regardless of the average.

The timeline

Timeline estimates use the readiness band, your size and what you already hold. An organisation already certified to ISO 27001 reaches ISO/IEC 42001 substantially faster because the shared clauses are already evidenced, and building both standards together typically adds weeks to a single build rather than doubling it. The estimates run to the end of Stage 2, after which certificates are usually issued within a few weeks.

The sources

What we reference

Source

Certificate numbers and growth

The ISO Survey, which recorded 96,709 valid ISO 27001 certificates in 2024, up from 48,671 the year before.

Information security standard

ISO/IEC 27001, the certifiable standard for information security management systems, 2022 edition.

AI management standard

ISO/IEC 42001, the certifiable standard for AI management systems, published December 2023.

Accreditation

UKAS, the UK national accreditation body. A certificate from a UKAS accredited certification body is the one customers and regulators recognise.

Certificate verification

IAF CertSearch, the global database where any accredited certificate can be verified, and the source behind the 2024 survey figures.

Security practice

NCSC guidance, which underpins how the Annex A control themes are described in plain language.

Certification body fees

Published UK certification pricing across UKAS accredited bodies, typically £4,000 to £12,000 across a three year cycle for a small or mid sized organisation.

Method and sources last reviewed 18 July 2026. Scores are calculated in your browser and never leave this page.

Where this sits against other assessments

Most free ISO readiness checkers online are ten to twenty questions for one standard, gated behind an email address, built to generate sales calls. The large consultancies assess readiness through paid engagements. This checker covers the full clause structure of two standards, shows every result on the page, explains its gates and takes about six minutes. The honest trade off is depth: a self assessment cannot read your documents or test your controls, which is why the recommended follow up for most scores is an independent gap analysis.

Questions

Questions about the readiness checker

Plain answers on ISO 27001, ISO/IEC 42001 and certification. If the question is specific to your organisation, speak to an adviser.

What is an ISO 27001 readiness check?

A structured comparison of how your organisation runs today against what ISO 27001 requires: the management system clauses 4 to 10 and the Annex A controls. It tells you whether you could face a certification audit, where the gaps are and how long closing them will take. This page runs that check across eleven areas in about six minutes.

How long does ISO 27001 certification take?

A typical uncertified organisation takes four to nine months from starting work to passing Stage 2, driven mostly by how quickly evidence accumulates: the standard requires an internal audit and a management review to have happened. Organisations that already run another ISO standard move faster. The checker gives you an estimate matched to your answers.

How much does ISO 27001 certification cost in the UK?

Three separate costs get mixed together. Certification body fees typically run £4,000 to £12,000 across a three year cycle. Your internal effort is the largest cost and the most underestimated, with the system owner giving one to two days a week during the build. Specialist support is optional: a gap analysis from £8,500 + VAT or a full implementation from £25,000 + VAT at published Intelance prices.

What is ISO/IEC 42001 and who needs it?

The certifiable management system standard for artificial intelligence, published in December 2023. It matters to organisations whose customers, regulators or boards want proof that AI is governed: AI in products, AI in decisions about people, or AI used at scale on sensitive data. It shares its clause structure with ISO 27001, so organisations holding 27001 extend rather than restart.

Can we get ISO 27001 and ISO 42001 together?

Yes, and doing so is usually cheaper than two separate projects because the management system core, clauses 4 to 10, is built once and audited once. Certification bodies increasingly offer combined audits. Building both together typically adds weeks to a single standard build rather than doubling it.

What score means we are ready for Stage 1?

Seventy five or above, provided neither gate area scores critically low. Stage 1 is a documentation and readiness review, so what matters is that the system exists, the risk assessment is real and at least one internal audit and management review have run. Below 75, book the audit only once the plan on this page is under way.

Can we do ISO 27001 ourselves without consultants?

Yes, if someone senior has genuine time and the score to build from. Above 75 you mostly need independent eyes before the audit, which is what an internal audit from £4,500 + VAT provides. Between 50 and 74 it is a real project but doable in house. Below 50, budget either for help or for a longer road, and be honest with yourself about which is cheaper.

How accurate is this checker?

Directionally accurate and optimistic, like every self assessment. Certification auditors and independent reviewers consistently land about one level below the self view, because documents are thinner and records patchier than they feel from inside. Treat your score as an upper bound, and treat the gaps it finds as real.

Get the independent version of this verdict

Thirty minutes with a senior adviser on your answers, your target standard and whether the timeline holds up. If the self assessment flattered you, better to find out now than at Stage 1. A reply within one UK business day.

Book a strategy call or call +44 20 3985 5809 · info@intelance.co.uk

Keep reading

Related guides and services

ISO 27001 Readiness Assessment

The independent gap analysis this checker points to, from £8,500 + VAT in one to two weeks.

ISO 27001 cost UK

What certification really costs, with every component priced and the traps named.

How long does ISO 27001 take?

Realistic timelines by starting position, and what sets the pace.

ISO/IEC 42001 implementation

The certifiable AI management system, built on the ISMS you already run.

All Intelance tools

Every free calculator and scorecard in one place.

About this checker

Written and maintained by the Intelance advisory team. Method and sources last reviewed on 27 July 2026. Intelance provides ISO 27001 and ISO/IEC 42001 readiness assessment, implementation, internal audit and managed ISMS services to UK organisations.