ISO 27001 checklist for small teams (2022 version)

Step 1 of 7

Step 1: get leadership sign-off and name an owner

ISO 27001 is a management system standard, so the auditor starts with management. Clauses 5 and 7 ask for visible commitment, a policy, named roles and the people and budget to run the ISMS. Without these, nothing later in the list holds.

• Leadership commitment (5.1)A senior leader sponsors the ISMS, approves its budget and shows up to the management review. Proof: meeting minutes and the approved plan.
• Information security policy (5.2)A short policy that fits the business, sets the direction for objectives and is approved, published and communicated. Proof: the signed policy and where staff can read it.
• Roles and responsibilities (5.3)An ISMS owner, risk owners and control owners, named. Proof: a RACI or role list that matches the org chart.
• Resources and competence (7.1, 7.2)Time and money for the work, and evidence the people doing it are competent. Proof: training records, certificates or a skills matrix.
• Awareness and communication (7.3, 7.4)Everyone in scope knows the policy and their part in it, and you have decided what is communicated, to whom and when. Proof: an awareness training record and a communication plan.
• Documented information (7.5)Documents are versioned, approved, stored and retired on purpose. Proof: a document register with owners and review dates.

Step 3 of 7

Step 3: run the risk assessment

Clause 6.1 is where most first-time teams lose weeks. Agree the method before you score anything, then keep the register current: the auditor checks that risks were reassessed when things changed (8.2) and that the treatment plan was carried out (8.3).

• Risk assessment method (6.1.2)Criteria for likelihood, impact and acceptable risk, written so two people would score the same risk the same way. Proof: the methodology document.
• Risk register (6.1.2, 8.2)Each risk with its owner, likelihood, impact, score and date assessed. Proof: the register, with a history of reassessments.
• Risk treatment plan (6.1.3, 8.3)For each risk you will not accept, the controls that treat it, who does the work and by when. Proof: the plan and its progress.
• Residual risk accepted by owners (6.1.3 f)Risk owners approve the plan and the risk that remains. Proof: their sign-off.
• Security objectives (6.2)Measurable objectives with owners and dates, such as all laptops encrypted by a set date. Proof: the objectives and how you track them.

Step 5 of 7

Step 5: the 93 Annex A controls, by theme

ISO/IEC 27001:2022 groups Annex A into four themes. The list below names the controls small teams spend most of their time on in each; the downloadable checklist has a row for all 93. If you already run SOC 2, most of the technological theme is familiar; our SOC 2 compliance checklist covers the same ground, and ISO 27001 vs SOC 2 explains the overlap.

• Organizational controls: 37 (A.5)Policies (A.5.1), access control (A.5.15), supplier relationships and agreements (A.5.19, A.5.20), cloud services (A.5.23), incident management (A.5.24 to A.5.28), ICT readiness for business continuity (A.5.30) and legal and contractual requirements (A.5.31).
• People controls: 8 (A.6)Screening (A.6.1), terms of employment (A.6.2), awareness and training (A.6.3), the disciplinary process (A.6.4), confidentiality agreements (A.6.6) and remote working (A.6.7).
• Physical controls: 14 (A.7)Physical perimeters and entry (A.7.1, A.7.2), physical security monitoring (A.7.4), clear desk and clear screen (A.7.7), storage media (A.7.10) and secure disposal or reuse of equipment (A.7.14).
• Technological controls: 34 (A.8)User endpoint devices (A.8.1), privileged access (A.8.2), secure authentication (A.8.5), malware protection (A.8.7), vulnerability management (A.8.8), configuration management (A.8.9), backup (A.8.13), logging and monitoring (A.8.15, A.8.16), cryptography (A.8.24) and secure coding (A.8.28).
• The 11 controls new in 2022Threat intelligence (A.5.7), cloud services (A.5.23), ICT readiness (A.5.30), physical security monitoring (A.7.4), configuration management (A.8.9), information deletion (A.8.10), data masking (A.8.11), data leakage prevention (A.8.12), monitoring activities (A.8.16), web filtering (A.8.23) and secure coding (A.8.28).
• Evidence for each controlA control without evidence is a control the auditor cannot test. For every included control, note what proves it runs: a ticket, an export, a signed record or a tool report.

Step 7 of 7

Step 7: Stage 1 and Stage 2 audits

Certification is two audits by an accredited certification body. What each one costs, and the surveillance years that follow, are set out in ISO 27001 certification cost.

• Pick an accredited certification bodyA body accredited by an IAF member, such as ANAB in the US or UKAS in the UK, issues the certificate buyers accept. Get two or three written quotes.
• Stage 1: documentation and readinessThe auditor reviews the scope, the policy, the risk assessment, the SoA and your internal audit, and tells you what to fix before Stage 2.
• Fix the Stage 1 findingsBodies typically leave several weeks between the stages for this. Proof: the corrective actions, closed.
• Stage 2: the ISMS in operationThe auditor samples evidence that the controls and the management system actually run. A clean Stage 2 leads to the certificate.
• Plan the three-year cycleThe certificate lasts three years, with a surveillance audit in each of the two years between and a recertification audit after that. The internal audit and management review repeat every year.

Free download

Download the ISO 27001 checklist

Two files, no email gate. The PDF is the seven steps above on printable pages, with a box to tick for each item. The CSV opens in Excel, Google Sheets or Numbers and has one row per item, including all 93 Annex A controls, with columns for the owner, the status and the evidence. More free files, such as a vendor risk questionnaire and a SOC 2 policy list, are on our compliance templates page, and unfamiliar terms are in the compliance glossary.