ISO 27001 Readiness Check
Where do you stand?
20 questions, 5 categories, 3 minutes. Find out how close your company is to ISO 27001 certification.
How audit-ready is your company really?
ISO/IEC 27001 is the international standard for information security management systems (ISMS). It is not purely an IT matter but a management system: you decide which information is worth protecting, assess the risks systematically and show that your measures work. The check above estimates how far along that road you already are.
What the standard asks of you
ISO 27001:2022 has two parts, and both have to be satisfied:
| Part | Content | Character |
|---|---|---|
| Clauses 4–10 | Context, leadership, planning (risks), support, operation, evaluation, improvement | binding — there is no “not applicable” here |
| Annex A | 93 controls in four themes: organisational (37), people (8), physical (14), technological (34) | the selection is justified through the statement of applicability |
At its heart is the statement of applicability (SoA): there you justify, for each of the 93 controls, whether you apply it — and why, or why not. Excluding a control is allowed, but only with a reason that holds up.
A common misconception: Many start with the technical controls — firewalls, encryption, backups — and wonder why the audit still produces findings. Auditors look at the clauses first: is there a risk assessment? Are objectives measured? Did an internal audit take place? Without that management part, the best technology will not help.
How certification works
- Stage 1 — the auditor checks whether your ISMS is complete on paper: scope, policy, risk assessment, statement of applicability, internal audit, management review. The result is a list of open points.
- Stage 2 — now it is about effectiveness: is what is documented actually lived? The auditor talks to your people and asks for evidence.
- Surveillance audits — yearly, and narrower in scope.
- Recertification — in full again after three years.
Between stage 1 and stage 2 there are typically a few weeks to a few months, in which you work through the findings.
How to read your result
The check scores your answers along the structure of the standard and places you at a maturity level:
- At the beginning — the basics are still missing (scope, policy, risk method). That is entirely normal, and it is here that it is decided whether the project runs smoothly later.
- On the way — much of it is there, but the evidence has holes. A good technical level with a weak management part is typical.
- Largely audit-ready — you could tackle stage 1. What is left is usually the internal audit, the management review and evidence of effectiveness.
The check is a self-assessment and is no substitute for a gap analysis. What it does show reliably is where you should start.
Realistic effort
For a mid-sized company four to nine months to certificate is realistic — depending on size, scope and how much documentation already exists. In our experience the biggest time sink is not the technology but gathering the evidence and keeping it current. That is exactly where an ISMS tool pays off over a collection of spreadsheets and folders.
Common questions about ISO 27001
Is ISO 27001 required by law?
No. Certification is voluntary. In practice, though, customers, large groups and public bodies often require it — and it is the best foundation for meeting NIS-2, TISAX or DORA requirements in a structured way.
What changed with the 2022 version?
Annex A was restructured: instead of 114 controls in 14 chapters there are now 93 controls in four themes, eleven of them new — threat intelligence, cloud security, data masking. Clauses 4–10 stayed largely the same in substance. The transition period for certificates to the 2013 version has expired.
Do we have to implement all 93 controls?
No. You select on the basis of your risk assessment and record the decision in the statement of applicability. Exclusions are permitted but have to be justified — “we do not have that” is not enough, “not relevant for our scope, because …” is.
How large does the scope have to be?
You set it yourself — but it has to make sense and stand up to scrutiny. Too narrow a scope, one that leaves out the real core processes, gets questioned by auditors and is worth little to customers.
Do we need an external information security officer?
The standard does not require a particular role, but it does require clear responsibilities and competence. Whether you fill that internally or buy it in is a question of resources — in smaller organisations an external officer is often the faster and cheaper route.
Is an internal audit by our own IT department enough?
Only up to a point. The internal audit has to be independent and objective — checking your own work does not meet that. In small companies this is solved through another department or an external auditor.
