All services Every engagement has a fixed, published price. Book a strategy call
An ISO 27001 readiness assessment checklist built the way auditors think: clause by clause, with the evidence an auditor accepts, the gaps UK organisations usually have, an honest scoring system, and a printable one page version.
This is an ISO 27001 readiness assessment checklist built the way auditors think: not “do you have a policy” but “what evidence exists, and would it survive questioning”. It is written by a firm whose auditors deliver ISO/IEC 27001:2022 audits for a UKAS accredited certification body and whose consultants build management systems for clients, so both sides of the audit table are represented in what follows.
The short version. Readiness for ISO 27001 comes down to three questions. Is your scope decided and defensible? Does evidence exist for every mandatory element of clauses 4 to 10 and every applicable Annex A control, in a form an auditor can examine? And is the system alive, meaning risk assessments, internal audits and management reviews have happened rather than merely been templated? This checklist works through all three, clause by clause, with the evidence an auditor accepts and the gaps we most often find in UK organisations.
Work through each table and score every line one of three ways: evidence exists and is current. Something exists but is incomplete or stale. Nothing exists. Be brutal, because the audit will be. A useful discipline: for every item you mark green, name the file, system or record where the evidence lives. If you cannot name it in ten seconds, it is amber. The scoring section at the end converts your results into a realistic timeline.
Every failed readiness effort we have seen went wrong here first. Write down why the organisation is pursuing ISO 27001, in one sentence, naming the customer, tender or regulator driving it, because that answer decides your scope. Then define scope deliberately: which legal entities, sites, services, people and systems are inside the management system. Whole-organisation scope is simpler to defend and increasingly what buyers expect. A narrower scope must be explainable without embarrassment, because procurement teams have learned to read scope statements. Document what is excluded and why, and check the exclusion would survive the buyer whose contract started all this reading it aloud.
Clauses 4 to 10 of ISO/IEC 27001:2022 define the management system itself. This is where certification is won or lost, because Annex A controls can be fixed quickly while a dead management system cannot be faked. For each row, the middle column is what an auditor will ask to see.
| Checklist item | Evidence an auditor accepts | The gap we usually find |
|---|---|---|
| Clause 4: context and interested parties analysed | A short documented analysis of internal and external issues, and of interested parties (customers, regulators, staff, suppliers) with their requirements | A generic template naming no real customer or regulator the organisation has |
| Clause 4: scope documented | A scope statement covering entities, locations, services and systems, with exclusions justified | Scope written to dodge the hard systems, visible to any experienced reader |
| Clause 5: information security policy | A policy approved by top management, communicated to staff, with evidence of communication | A policy nobody below the IT manager has seen |
| Clause 5: roles and responsibilities assigned | Named owners for the ISMS, risk decisions, and each control area. People who can describe their role when asked | An org chart drawn for the audit that interviews immediately contradict |
| Clause 6: risk assessment methodology | A documented method for identifying, analysing and evaluating information security risks, with criteria for acceptance | A methodology copied from a template that does not match how the risk register was built |
| Clause 6: risk register populated and used | A register of real risks to your actual systems and data, each with an owner, evaluation and treatment decision | Twenty generic risks, none mentioning the systems the business runs |
| Clause 6: Statement of Applicability (SoA) | All 93 Annex A controls listed, each marked applicable or not with justification, traceable to the risk assessment | An SoA written before the risk assessment, so nothing traces to anything |
| Clause 6: risk treatment plan and objectives | A plan showing which risks are being treated, how, by whom and by when. Measurable security objectives | Objectives that cannot be measured and a plan with no dates |
| Clause 7: competence and awareness | Records that people in security-relevant roles are competent, and that staff have had awareness training | One induction slide deck from two years ago and no records of who saw it |
| Clause 7: documented information controlled | Documents versioned, owned and reviewed. Obsolete versions withdrawn | Three versions of every policy in a shared drive, none marked current |
These clauses are where auditors separate real management systems from paperwork exercises, because each one requires something to have happened, dated and recorded, before the audit.
| Checklist item | Evidence an auditor accepts | The gap we usually find |
|---|---|---|
| Clause 8: risk assessment performed in practice | Dated risk assessment results, refreshed after significant change, matching the documented methodology | One risk assessment, done the month the project started, never revisited |
| Clause 8: treatments implemented | Evidence that planned treatments happened: configurations, contracts, records rather than intentions | Treatment plan rows marked complete with nothing behind them |
| Clause 9: monitoring and measurement | Defined measures for the objectives, with results collected and reviewed | Objectives set in month one and never measured again |
| Clause 9: internal audit done | An audit programme, at least one completed internal audit by someone independent of the work audited, findings recorded | No internal audit yet, or one done by the person who built the ISMS marking their own homework |
| Clause 9: management review held | Minutes of a management review covering the standard’s required inputs, with decisions and actions | A meeting that discussed security generally, minuted after the fact for the audit |
| Clause 10: nonconformities and corrective action | A log of nonconformities with root cause and corrective actions, some closed | An empty log, which auditors read as a system nobody uses rather than as perfection |
Timing matters here more than anywhere: the internal audit and management review must have happened before the certification audit, which means your readiness plan needs them scheduled weeks before the auditor arrives rather than days.
ISO/IEC 27001:2022 reorganised the reference controls into four themes. Readiness does not mean implementing all 93. It means having decided, in the Statement of Applicability, which apply to your risks, and having evidence for the ones that do. This ISO 27001 gap analysis checklist view shows where UK organisations most often fall short.
| Theme | Controls | The readiness questions | Usual gaps |
|---|---|---|---|
| Organisational | 37 | Policies in force? Supplier security in contracts? Incident process tested? Cloud services governed? Business continuity thought through? | Supplier management on paper only. Incident process never exercised. Cloud services adopted faster than governed |
| People | 8 | Screening proportionate to role? Confidentiality agreements signed? Training done and recorded? Disciplinary process defined? | Training records missing. Leavers keeping access because HR and IT never agreed a process |
| Physical | 14 | Sites and equipment protected proportionately? Clear desk and screen where it matters? Secure disposal of media and kit? | Old laptops in cupboards with data intact. Server room keys nobody has inventoried |
| Technological | 34 | Access control and MFA enforced? Logging and monitoring real? Backups tested by restoring? Vulnerabilities managed on a clock? Development securely managed? | Backups never test-restored. Admin rights accumulated over years. Logs collected but never looked at |
The standard explicitly requires certain documented information, and its absence is a finding regardless of how good everything else is. The essential set: the ISMS scope, the information security policy, the risk assessment methodology and the results of risk assessments, the Statement of Applicability, the risk treatment plan, security objectives, evidence of competence, the operational planning and control records clause 8 requires. Monitoring and measurement results. The internal audit programme and results. Management review results, and records of nonconformities and corrective actions. Templates can start these documents, but every one must describe your organisation specifically enough that an auditor interviewing your staff hears the same story the paper tells.
Before any pre audit checklist is declared complete, walk the floor on six technical questions, because these are where paper systems meet reality and where certification audits find their favourite nonconformities. Multi-factor authentication: enforced on every remote access route and cloud service, or just available? Backups: when did you last restore one, and is there a record? Access: does the joiner-mover-leaver process remove accounts, and can you show the last leaver’s timeline? Patching: what is the real latency on high-risk updates, measured rather than believed? Logging: if a mailbox was compromised last Tuesday, could you reconstruct what happened? Cloud responsibility: for each major service, is it written down what the provider secures and what you must? Organisations holding Cyber Essentials start well here, because the schemes overlap on exactly these basics, an overlap our Cyber Essentials vs ISO 27001 guide covers in detail.
| Your honest result | What it means | Realistic path |
|---|---|---|
| Mostly green: evidence exists and is current across clauses and applicable controls | You are close. The risk is stale evidence and interview surprises | An independent gap assessment to catch blind spots, then book the certification audit. Weeks rather than months |
| Mixed: the system exists but clauses 8 to 10 are thin and evidence is patchy | The skeleton is there. The system is not yet alive | Run the missing cycle: refresh the risk assessment, hold the internal audit and management review, close gaps. Typically three to six months |
| Mostly red: documents are templates and little has happened | You are at the start, whatever the folder of policies suggests | A structured implementation. Typically six to nine months done properly, faster only by cutting corners an auditor will find |
Buying templates and renaming them. Auditors read hundreds of ISMS documents a year and recognise every template on the market. Templates are fine as scaffolding. The finding comes when interviews reveal the organisation does not do what its beautifully formatted documents say.
Writing the SoA before the risk assessment. The Statement of Applicability is supposed to be a conclusion drawn from your risks. Written first, it turns the risk assessment into decoration, and experienced auditors trace the thread within the hour.
Marking your own homework. The internal audit must be independent of the work it audits. The consultant who built your ISMS auditing that ISMS, or the IT manager auditing IT, invites a finding against clause 9 itself.
Scope gerrymandering. Excluding the messy systems makes certification easier and the certificate worthless, because buyers now read scope statements. If the service your customer buys is not inside the scope, expect them to notice.
Treating readiness as a documentation sprint. The standard certifies a management system, which is a set of behaviours: assessing, deciding, checking, correcting. The last month before an audit is far better spent running the system than polishing its paperwork.
This checklist is designed to be usable without us. A capable organisation with time before its deadline can self-assess honestly, fix what it finds and go to audit. External help earns its fee in three situations: a contract deadline that removes slack, a first-time certification where nobody has seen an audit from the inside, and a mixed or red score where you need a credible plan quickly. Our ISO 27001 gap assessment is £8,500 + VAT, fixed, and produces exactly this checklist completed against your organisation, with evidence reviewed rather than self-declared, and a sequenced plan to close every gap.
Scope: reason documented · entities, sites, systems defined · exclusions justified.
Clauses 4 to 7: context and interested parties · policy approved and communicated · roles owned by named people · risk methodology · real risk register · SoA traced to risks · treatment plan with dates · measurable objectives · competence and awareness records · documents controlled.
Clauses 8 to 10: risk assessment performed and refreshed · treatments evidenced · objectives measured · internal audit done independently · management review minuted · nonconformity log in use.
Annex A: all 93 controls dispositioned in the SoA · evidence for every applicable control · suppliers, incidents, continuity covered · people controls recorded · physical checks done · technical controls verified in reality.
Reality check: MFA enforced everywhere · a backup restored recently · leavers removed · patch latency measured · logs usable · cloud responsibilities written down.
Before the audit: internal audit and management review completed and dated · evidence locations named for every green item · nobody surprised by an interview.
Everything is published, so this stays short. The gap assessment is £8,500 + VAT and completes this checklist against your organisation with evidence reviewed. Implementation is from £25,000 + VAT, fixed by scope. Internal audits are £4,500 + VAT, delivered by auditors who audit for a UKAS accredited certification body in their day job, and a managed ISMS runs the system for £2,500 per month after certification. Your certification body stays fully independent of us, as the standard intends.
A structured check, before the certification audit, that the management system required by clauses 4 to 10 exists with evidence, that all 93 Annex A controls have been dispositioned in the Statement of Applicability, and that the system has run: risk assessment, internal audit and management review completed and dated.
In practice they are the same exercise viewed from different ends: a gap analysis catalogues what is missing against the standard, and a readiness assessment judges whether you would pass an audit today. A good engagement does both and ends with a sequenced closure plan.
From a standing start, typically six to nine months to build and run the management system properly. Organisations with mature security practice and evidence discipline can be audit-ready in three to six months. The unavoidable constraint is that the internal audit and management review must have genuinely happened before certification.
The explicitly required set includes the scope, the information security policy, the risk assessment methodology and results, the Statement of Applicability, the risk treatment plan, security objectives, competence evidence, monitoring results, the internal audit programme and results, management review records, and nonconformity and corrective action records.
Annex A contains 93 reference controls in four themes: 37 organisational, 8 people, 14 physical and 34 technological. Not all must be implemented. Each must be dispositioned in the Statement of Applicability with justification traced to your risk assessment.
Yes, if you have time before your deadline and someone able to be honest about gaps. External assessment earns its fee when a contract deadline removes slack, when nobody in the organisation has seen a certification audit from the inside, or when you need a credible closure plan quickly.
Scope, the Statement of Applicability, and whether the system is alive: the risk assessment, internal audit and management review, dated and evidenced. Interviews then test whether staff behaviour matches the documents.
Self-assessment costs internal time. Our independent gap assessment is £8,500 + VAT, fixed. Full implementation, where needed, is from £25,000 + VAT by scope, with certification body audit fees on top, commonly £4,000 to £12,000 across the three year cycle.
Written by Emmanuel Olatunji, Chief Enterprise Architecture Partner at Intelance, whose auditors deliver ISO/IEC 27001:2022 audits for a UKAS accredited certification body. Last reviewed 8 July 2026.
Emmanuel Olatunji
Chief Enterprise Architecture Partner
Emmanuel founded Intelance in 2017 and has led architecture, AI governance, cyber and deal engagements across the UK, Europe, the Middle East and Africa. Every Intelance engagement runs under his direction, and every guide he publishes comes from that work.
See his record on LinkedIn About IntelanceThirty minutes with a licensed assessor. You leave knowing which route applies to you, what it costs and what to do first.
Talk to a senior adviser
