Free · ten minutes
How ready are you for ISO/IEC 27001 certification?
Answer 25 questions on the requirements of ISO/IEC 27001:2022 Annex A, in four steps. Your readiness report, with your score for each area and your priority actions, is sent to your e-mail.
Standard: ISO/IEC 27001:2022 Annex AChoose a different standard
Keep exploring
More quick readiness checks
What the ISO/IEC 27001 Annex A readiness check covers
The check measures the information security controls you operate against ISO/IEC 27001:2022 Annex A. Its twenty-five questions are grouped into four areas: Organisational controls (Annex A 5); People controls (Annex A 6); Physical controls (Annex A 7); and Technological controls (Annex A 8). Each answer is scored and weighted; the questions marked “Double weight” are the ones certification bodies examine first.
What you get
A readiness report sent to your e-mail: an overall score with one of four readings — Audit-ready, Nearly there, Gaps to close or Starting out — a score for each of the four areas, your priority actions, a suggested order of work and a table of all your answers.
How to use it
Answer from evidence rather than intention: if a control or requirement exists on paper but is not operating, score it as not operating. Share the report with the people who own each area, and use the ISO/IEC 27001 hub for the requirements, the route to ISO/IEC 27001 certification and what it costs.
Questions people ask
Is the ISO/IEC 27001 Annex A readiness check free?
Yes. It is free, takes about ten minutes and carries no obligation. Your readiness report is sent to your e-mail when you submit your answers.
Is this a certification audit or a certificate?
No. It is a self-assessment that shows where your controls stand before the real thing. Certification is granted by an accredited certification body after its own audit of the whole management system, clauses 4 to 10 as well as Annex A. Sterling's expert and experienced consultants prepare organisations for that audit; Sterling does not certify.
What happens after I submit my answers?
Your readiness report is sent by e-mail: your overall score and reading, a score for each of the four areas, your priority actions, a suggested order of work and a table of all your answers. If you want help with the result, a Sterling consultant can walk through it with you in a free discovery call.
Who should answer the questions?
Your information security lead, with input from IT, HR, facilities and the owners of key suppliers. Where a control does not apply to you, answer from the justification in your Statement of Applicability.
How is the score worked out?
Each answer is scored, and the questions marked “Double weight”, the ones certification bodies examine first, count twice. The total gives one of four readings: Audit-ready, Nearly there, Gaps to close or Starting out.
Does this check cover the ISO/IEC 27001 management system clauses?
No. It covers a selection of the Annex A controls, grouped into the four themes. For scope, risk assessment, the Statement of Applicability, internal audit and management review, use the ISO/IEC 27001 readiness check alongside this one.