ISO/IEC 27001 guide
ISO/IEC 27001 checklist: every clause requirement in order, plus the Annex A themes, with the evidence auditors ask for
Clause by clause: ISO/IEC 27001:2022 requirements: every clause explained →
Work through ISO/IEC 27001:2022 in the order an implementation meets it: 38 checks across clauses 4 to 10 and 25 across the four Annex A themes, each with the evidence an auditor asks for, and double weight on the records Stage 2 audits most often find wanting.
Key points
- This checklist has 63 items: 38 for clauses 4 to 10, which a certified ISMS must meet in full, and 25 theme-level items for the Annex A controls your Statement of Applicability includes.
- Each item names the evidence an auditor usually asks for. Tick it only when that evidence exists, is dated and can be found in minutes, not when the work is still planned.
- Thirteen items count double in the weighted score: risk assessment and treatment records, the Statement of Applicability, internal audit, management review, access reviews, supplier agreements, incident records, and logging and monitoring. In our experience, these are where Stage 2 audits most often raise nonconformities.
- A ticked list is neither a gap analysis nor a prediction of the certification decision. Sterling does not certify; an accredited certification body audits and decides.
How to use this checklist, and what it is not
The sections follow the standard's numbering, which is close to the order in which a new ISMS meets the requirements. Clauses 4, 5 and 6 come first because they fix the scope, the leadership and the risk decisions. Clause 7 runs alongside, as people are trained and documents written. Clause 8 carries out the treatment plan, and that is when you work through the Annex A items further down, for the controls your Statement of Applicability includes. Clauses 9 and 10 come last, once there is operating history to measure, audit and review.
Tick an item only when you could hand its evidence to an auditor today. The reference after each item points to the clause or Annex A theme it mainly supports. The items summarise at clause-title level, and the text of ISO/IEC 27001:2022 with its 2024 amendment is what you are audited against. The requirements guide explains each clause, and the Annex A guide takes the 93 controls one at a time.
Items labelled as a common nonconformity count double in the weighted percentage, which measures progress rather than predicting the outcome. Ticks are saved in this browser only: use Print or save as PDF to share a snapshot with your team, and Reset before you start a fresh round.
Three things this page is not. It is not the readiness check, Sterling's free online tool, and its percentage is not that tool's score. It is not a gap analysis, the first stage of a Sterling engagement, in which consultants examine your documents, practice, records and people and deliver a prioritised action plan; the gap analysis guide explains what you receive. Nor is it the Stage 1 readiness review, which only your certification body can carry out.
Clause 4 Context of the organisation
Clause 4 decides what the ISMS protects and where it stops. The risk assessment, the Statement of Applicability and the certification body's audit time all follow from these four records; the scope guide covers drawing the boundary.
Clause 5 Leadership
Leadership is tested mostly by talking to top management. Expect to show decisions taken, resources given and reports received, not only a signed statement.
Clause 6 Planning
Clause 6 holds more weighted items than any other clause. The risk register, the Statement of Applicability and the treatment plan must agree with one another and with what is actually running; the risk assessment guide and the Statement of Applicability guide show how to build them.
Clause 7 Support
Clause 7 supplies the people, skills, communication and records that everything else relies on. Most of it runs alongside the risk work rather than after it.
Clause 8 Operation
Clause 8 turns plans into routine. It is also when the Annex A items further down this page are put to work, as the treatment plan is carried out.
Clause 9 Performance evaluation
Clause 9 cannot be met on paper. Certification bodies expect an internal audit and a management review to have taken place before Stage 2, so schedule both early.
Clause 10 Improvement
Clause 10 closes what audits, incidents and monitoring find. Auditors follow a sample of findings from the day they were raised to verified closure.
A.5 Organisational controls
With 37 controls, this is the largest theme. The items below group them by topic, and apply only to the controls your Statement of Applicability includes.
A.6 People controls
Eight controls cover people before, during and after employment. Auditors usually test them through samples of joiners and leavers.
A.7 Physical controls
Fourteen controls protect sites, rooms and equipment. Where hosting is outsourced, much of this evidence comes from the provider.
A.8 Technological controls
The 34 technological controls generate most of the system evidence in an ISMS. Export it on a schedule, because many consoles keep history only for a limited period.
The double-weighted items: what an auditor samples
The thirteen weighted items share one trait: none can be produced by writing alone. Each depends on something having happened, often more than once, and a Stage 2 auditor samples what happened rather than reading what was intended. The table shows the record behind each and what makes it convincing; the common mistakes guide covers the ten errors that most often fail audits.
| Item | Record the auditor samples | What makes it convincing |
|---|---|---|
| Risk assessment (6.1.2, 8.2) | The method, the dated register and any repeat assessment | Owners who recognise their risks, ratings that follow the method, and a repeat after significant change |
| Risk treatment plan (6.1.3, 8.3) | The plan, its approvals and progress records | Approval and acceptance of residual risk by the risk owners themselves, and actions that are moving |
| Statement of Applicability (6.1.3) | The approved SoA and its version history | Each control traced to a risk or requirement, each exclusion justified, and a status that matches what the auditor finds |
| Internal audit (9.2) | The programme, the reports and the auditors' independence | Every clause and the SoA controls covered across the programme, with findings raised and taken to closure |
| Management review (9.3) | The agenda, minutes and actions | Every required input discussed, decisions recorded and top management taking part |
| Access reviews (A.5) | Completed reviews for sampled systems | The changes that followed: removals, reduced rights, or a recorded reason why none were needed |
| Supplier agreements (A.5) | Contracts and security terms for sampled suppliers | Clauses proportionate to each supplier's access, and monitoring after signature |
| Incident records (A.5) | The register and a sample of incident files | Causes found, actions closed and lessons fed back into the risks; an empty register invites questions |
| Logging and monitoring (A.8) | Log settings, retention and alert tickets | Logs someone reviews, alerts that end in a recorded decision, and enough history to sample |
When every box is ticked: what comes next
A complete list shows that the evidence exists. It does not show that the evidence would survive sampling, so before fixing audit dates, ask someone who did not build the system to test a few records behind each weighted item, the way the certification body will. That body's Stage 1 readiness review then looks at your documentation, scope and risk approach, and Stage 2 tests whether the controls are implemented and effective. The certification process guide covers both stages, and the timeline guide shows how long the road to them usually takes.
How Sterling gets you ready
From a ticked list to an ISMS an auditor can test
Sterling's expert and experienced consultants start where this checklist stops: a gap analysis tests the evidence behind each item, and every gap becomes a dated action with an owner. We build the risk assessment, the Statement of Applicability and the treatment plan with your risk owners, carry out the vulnerability assessment, conduct the internal audit and prepare the management review with you before the certification body arrives. Evidence sits in Effivity, included with the engagement at no additional cost, from the first workshop. We ensure successful certification for our clients. Sterling does not certify; an independent certification body accredited to ISO/IEC 17021-1 and ISO/IEC 27006-1 audits and decides.
Book a free discovery callISO/IEC 27001 checklist: questions buyers ask
Does the weighted percentage tell us whether we will be certified?
No. It shows how much of the evidence exists, with extra weight on the records auditors most often find weak. The decision belongs to the certification body, after a Stage 2 audit that samples what has actually happened. A high percentage built on records nobody has checked can still end in nonconformities.
Who in the organisation should work through this checklist?
One coordinator, usually the ISMS lead, owns the list but should not tick alone. Top management answers for leadership and management review, risk owners for the risk and treatment items, IT for most technological controls, HR for the people controls and facilities for the physical ones. Asking each owner to produce the evidence is itself good rehearsal for the audit.
Does a fully ticked checklist replace the internal audit?
No. Clause 9.2 calls for audits against a defined scope and criteria by auditors who are objective and impartial, with results reported to management. A list ticked by the people who built the system is a self-assessment. Use it to prepare, then let the internal audit test a sample of the evidence independently; the internal audit guide explains how.
Our systems run in the cloud and some IT is outsourced. Which items still apply?
All the clause items, and every Annex A item for controls your Statement of Applicability includes. What changes is where the evidence comes from: supplier agreements, the provider's assurance reports and the settings inside your own cloud accounts. Clause 8.1 expects outsourced processes relevant to the ISMS to be controlled, so a provider's promise needs a record behind it.
How long should records have been running before the Stage 2 audit?
ISO/IEC 27001 itself sets no minimum period, and certification bodies differ in what they expect, so ask yours early. Every body needs enough history to sample: a full risk assessment, an internal audit, a management review, and enough cycles of recurring controls, such as access reviews and log checks, for a sample to mean something. The timeline guide gives realistic ranges for each stage.
Should we use the checklist again after certification?
Yes. Reset it before each surveillance audit and before recertification, and start with the weighted items, because they depend on routine work that can lapse once the project team has moved on. Revisit the clause 4 and clause 6 items whenever the scope, services or technology change. The surveillance and recertification guide covers the three-year cycle.
More ISO/IEC 27001 guides
Every guide in the ISO/IEC 27001 series is written for one question and links back to the hub for the whole picture.
- Annex A: the 93 controls by theme, explained
- ISO/IEC 27001 for BPO and shared services
- ISO 27001 case study
- ISO/IEC 27001 certification process, step by step
- Choosing an ISO/IEC 27001 certification body
- ISO/IEC 27001 common mistakes
- ISO/IEC 27001 certification cost: what moves the price
- ISO/IEC 27001 internal audit: planning, conduct and reporting
- ISO/IEC 27001 requirements explained, clause by clause
- ISO/IEC 27001 risk assessment and treatment, step by step
- The Statement of Applicability: how to write one that survives the audit
- ISO/IEC 27001 vs SOC 2: which one, or both?
Keep exploring
Explore more about ISO/IEC 27001
Watch a video on how to implement ISO 27001 here.
Watch a video on ISO 27001 requirements here.
ISO/IEC 27001 resources
Services for ISO/IEC 27001
Talk to a consultant
Plan your ISO/IEC 27001 certification with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice