ISO 27001 Readiness Checklist — a realistic path to certification.

Test procedureAsk to see the signed/approved policy and how it was communicated to staff.

Practical example / evidenceApproved policy document with sign-off date; intranet post or email announcing it; policy acknowledgement log

Test procedureReview the scope statement against your actual org chart, system inventory and physical locations.

Practical example / evidenceWritten ISMS scope statement naming in-scope business units, locations and systems, with exclusions justified

Test procedureInterview named role-holders and cross-check against the RACI or org chart.

Practical example / evidenceRACI matrix or role descriptions naming the ISMS owner, risk owner and control owners

Test procedureAsk for the approved budget line or resourcing plan tied to the ISMS.

Practical example / evidenceBudget approval record, resourcing plan, or minutes showing resource allocation

Test procedureWalk through the documented methodology and confirm it was applied the same way across all assessed assets.

Practical example / evidenceRisk assessment methodology document; risk scoring criteria; sample risk assessments showing consistent application

Test procedureSample the asset inventory and confirm each entry has a named owner and current classification.

Practical example / evidenceAsset register/inventory with owner, classification and location fields populated

Test procedureCheck that residual risk after treatment was explicitly accepted, by name, by an accountable manager.

Practical example / evidenceRisk treatment plan; signed residual risk acceptance record

Test procedureCheck version history or review log for evidence of regular updates.

Practical example / evidenceRisk register with revision history; review cadence documented in a policy or calendar

Test procedureSample a cross-section of controls and confirm each has an applicability decision and justification.

Practical example / evidenceStatement of Applicability listing all 93 controls, applicability status and justification per control

Test procedureFor a sample of "applicable" controls, ask for operational evidence — not just the policy that mentions them.

Practical example / evidenceOperational artifacts (logs, screenshots, configs, tickets) demonstrating the control is actually running

Test procedureTrace each exclusion back to the risk assessment that justifies it.

Practical example / evidenceRisk assessment entries or rationale notes directly referenced in the SoA exclusion justification

Test procedureShow me your policy set and how staff were told.

Practical example / evidenceApproved policy set, acknowledgement records, review log

Test procedureWho owns security for this system, and where is that written?

Practical example / evidenceRACI, job descriptions

Test procedureHow do you stop one person requesting and approving the same change?

Practical example / evidenceConflict matrix, role design, compensating control records

Test procedureHow do you know managers require compliance?

Practical example / evidenceBriefing records, manager objectives, enforcement records

Test procedureWho would you notify after a breach and when?

Practical example / evidenceAuthority contact register, reporting procedure

Test procedureHow do you keep up with new threats?

Practical example / evidenceMembership list, briefing notes

Test procedureShow a threat item and what you did about it.

Practical example / evidenceSource list, threat briefs, resulting actions

Test procedureShow security evidence for a recent project.

Practical example / evidenceProject security checklists, risk assessments

Test procedurePick an asset and show me its owner and classification.

Practical example / evidenceAsset register

Test procedureHow do staff know the rules?

Practical example / evidenceAcceptable use policy, acknowledgements

Test procedureShow a leaver and how assets were recovered.

Practical example / evidenceCompleted leaver checklists

Test procedureHow is this data classified and who decided?

Practical example / evidenceClassification scheme, classified inventory

Test procedureShow a labelled document and the handling rule.

Practical example / evidenceLabelling procedure, labelled samples

Test procedureHow do you send confidential data to a customer?

Practical example / evidenceTransfer policy, agreements, sample logs

Test procedureShow how access to this system is decided.

Practical example / evidenceAccess control policy, role matrix

Test procedureShow a leaver's accounts being removed.

Practical example / evidenceIdentity lifecycle procedure, JML records

Test procedureHow are credentials issued and reset?

Practical example / evidenceAuthentication standard, vault configuration

Test procedureShow your last access review and what it removed.

Practical example / evidenceAccess requests, signed review records

Test procedureHow did you assess this supplier?

Practical example / evidenceSupplier register, assessments

Test procedureShow the security clauses in this contract.

Practical example / evidenceContract clauses, signed agreements

Test procedureWhich fourth parties matter to your critical service?

Practical example / evidenceDependency map, flow-down clauses

Test procedureShow a supplier review and the actions taken.

Practical example / evidenceReview records, SLA reports

Test procedureWho is responsible for what in this cloud service?

Practical example / evidenceCloud policy, provider assessments, responsibility matrix

Test procedureWhen did you last test your incident plan?

Practical example / evidenceIncident plan, roles, exercise records

Test procedureShow how a reported event was triaged.

Practical example / evidenceTriage records

Test procedureWalk me through your last incident.

Practical example / evidenceIncident records and timelines

Test procedureWhat changed after your last incident?

Practical example / evidencePost-incident reports, action tracker

Test procedureHow do you preserve evidence from a compromised device?

Practical example / evidenceEvidence procedure, custody records

Test procedureWhich controls must keep working in a disaster?

Practical example / evidenceContinuity plans with security content, test results

Test procedureShow a DR test result against your RTO.

Practical example / evidenceBIA, DR plan, test reports

Test procedureWhich laws and contracts apply and who tracks them?

Practical example / evidenceLegal and contractual register

Test procedureHow do you control software licences?

Practical example / evidenceLicence register, audit results

Test procedureShow the retention rule for this record type.

Practical example / evidenceRetention schedule, disposal logs

Test procedureHow do you protect personal data in this system?

Practical example / evidencePII register, privacy procedures

Test procedureWhat independent assurance do you have?

Practical example / evidenceReview reports, findings log

Test procedureHow do you check policy compliance?

Practical example / evidenceCompliance check results

Test procedureShow the procedure for this operation.

Practical example / evidenceProcedure library

Test procedureHow are new hires screened?

Practical example / evidenceScreening policy, completion records

Test procedureShow the security terms in an employment contract.

Practical example / evidenceContract templates, signed contracts

Test procedureHow do you know staff understand security?

Practical example / evidenceTraining content, completion rates

Test procedureWhat happens when someone breaches policy?

Practical example / evidenceDisciplinary procedure, case log (anonymised)

Test procedureShow the exit process for a leaver.

Practical example / evidenceExit checklist

Test procedureShow NDAs for a contractor.

Practical example / evidenceSigned NDAs, register

Test procedureHow is remote access secured?

Practical example / evidenceRemote working policy, configuration evidence

Test procedureHow would a user report a phishing email?

Practical example / evidenceReporting channel, reports log

Test procedureShow how this secure area is bounded.

Practical example / evidenceSite plans, inspection records

Test procedureShow last quarter's physical access review.

Practical example / evidenceAccess lists, visitor logs

Test procedureHow is the server room protected?

Practical example / evidenceRoom risk assessment, key register

Test procedureShow how you detect unauthorised entry.

Practical example / evidenceMonitoring records, test logs

Test procedureHow did you assess flood and fire risk?

Practical example / evidenceThreat assessment, test records

Test procedureWhat are the rules inside this area?

Practical example / evidenceSecure area rules

Test procedureShow screen-lock enforcement.

Practical example / evidencePolicy, MDM lock configuration, spot-check results

Test procedureHow is equipment protected from theft and damage?

Practical example / evidenceLayouts, inspection records

Test procedureWhat happens if a laptop is lost?

Practical example / evidencePolicy, encryption evidence

Test procedureHow is removable media controlled?

Practical example / evidenceMedia register, disposal records

Test procedureWhen did you last test backup power?

Practical example / evidenceTest records, maintenance logs

Test procedureHow are patch panels secured?

Practical example / evidenceInspection records

Test procedureShow maintenance records.

Practical example / evidenceMaintenance logs

Test procedureShow disposal evidence for a retired device.

Practical example / evidenceDestruction certificates, inventory updates

Test procedureShow endpoint compliance across the fleet.

Practical example / evidenceMDM compliance report

Test procedureWho has admin rights and why?

Practical example / evidencePrivileged account list, reviews, logs

Test procedureShow that a user cannot access something they should not.

Practical example / evidenceConfiguration exports, test results

Test procedureWho can change production code?

Practical example / evidenceRepository permission export

Test procedureShow MFA enforcement for admins.

Practical example / evidenceMFA enforcement configuration

Test procedureHow do you avoid capacity-related outages?

Practical example / evidenceCapacity reports

Test procedureWhat proportion of devices have protection?

Practical example / evidenceCoverage reports

Test procedureShow critical vulnerabilities and how fast they closed.

Practical example / evidenceScan reports, patch SLAs, exception log

Test procedureShow the baseline for this server type.

Practical example / evidenceBaselines, drift reports

Test procedureHow do you delete customer data after contract end?

Practical example / evidenceDeletion procedures, logs

Test procedureWhere do you mask data and how?

Practical example / evidenceMasking rules, samples

Test procedureHow do you stop confidential data leaving by email?

Practical example / evidenceDLP configuration, alerts

Test procedureShow a successful restore test.

Practical example / evidenceBackup configuration, restore test reports

Test procedureHow does this service survive a failure?

Practical example / evidenceArchitecture, failover tests

Test procedureShow logs for this privileged action.

Practical example / evidenceLogging standard, log samples

Test procedureShow an alert and what happened next.

Practical example / evidenceMonitoring rules, alert handling records

Test procedureHow do you ensure consistent timestamps?

Practical example / evidenceTime-sync configuration

Test procedureWho can run system-level utilities?

Practical example / evidenceUtility list, restrictions

Test procedureHow do you stop unapproved software?

Practical example / evidenceApproved software list

Test procedureShow the latest firewall rule review.

Practical example / evidenceNetwork diagrams, firewall review

Test procedureWhat security is required of your network provider?

Practical example / evidenceSLAs, service reviews

Test procedureShow how production is separated from corporate.

Practical example / evidenceSegmentation design, test results

Test procedureHow do you block malicious sites?

Practical example / evidenceFilter configuration

Test procedureHow are encryption keys managed?

Practical example / evidencePolicy, key management records

Test procedureShow security gates in your pipeline.

Practical example / evidenceSDLC procedure

Test procedureShow security requirements for this application.

Practical example / evidenceRequirements, test results

Test procedureHow do design reviews consider security?

Practical example / evidencePrinciples, design review records

Test procedureShow scan results and how findings are handled.

Practical example / evidenceStandards, scan results, review records

Test procedureShow testing evidence for the last release.

Practical example / evidenceTest reports, fix records

Test procedureHow do you assure outsourced code?

Practical example / evidenceContracts, review records

Test procedureCan developers change production directly?

Practical example / evidenceEnvironment diagram, access lists

Test procedureShow a change from request to closure.

Practical example / evidenceChange records

Test procedureIs real data used in testing?

Practical example / evidenceTest data procedure

Test procedureHow do you control auditor access?

Practical example / evidenceAudit test agreements

Test procedureReview the internal audit plan, schedule and completed audit reports.

Practical example / evidenceInternal audit plan; completed audit report(s) covering all applicable clauses and controls

Test procedureSample internal-audit findings and confirm each has a documented corrective action and closure evidence.

Practical example / evidenceCorrective action log; closure evidence for each internal-audit finding

Test procedureReview management review meeting minutes against the required agenda items in Clause 9.3.

Practical example / evidenceManagement review meeting minutes covering ISMS performance, audit results, and improvement decisions

Test procedureConfirm your Stage 1 report from the certification body and that every finding was addressed before Stage 2.

Practical example / evidenceStage 1 audit report; evidence that findings were closed before the Stage 2 date

Test procedureWalk through a sample of controls end-to-end exactly as an auditor would, using real operational evidence.

Practical example / evidenceOperational evidence packs per control — logs, tickets, access reviews, training records

Test procedureConfirm there's an owner and a dated action plan for any nonconformity raised.

Practical example / evidenceCorrective action plan with named owner and deadline, tracked against the certification body's required timeline