On this page
Fast prep list before your ISO 27001 engagement.
Use this checklist to gather evidence and align your team before starting an ISO 27001 build-out.
ISO 27001 readiness checklist
- Scope & context
- Confirm in-scope products, locations, and key suppliers
- Identify interested parties and requirements
- Document ISMS objectives
- Asset inventory
- Maintain asset list (systems, data stores, SaaS, code, keys)
- Assign owners and criticality
- Risk & SoA
- Baseline risk assessment approach
- Initial risk register (even draft)
- List of applicable Annex A controls (draft SoA)
- Policies & procedures
- Access control, backup/restore, logging/monitoring, incident handling
- Change management and SDLC
- Evidence you can gather now
- MFA/SSO status, backups/screenshots, logging configuration
- Vendor reviews/DPAs for critical suppliers
- Sample training/awareness proof
- Governance
- Defined roles for ISMS lead, risk owner(s), control owners
- Plan for management review and internal audit cadence
Need help filling gaps or collecting evidence? Contact me and I’ll tailor a readiness plan to your environment.
