How do you use this checklist?
Download the spreadsheet version of this checklist (.xlsx): sheets for clauses 4 to 10, mandatory documents, a Statement of Applicability tracker and audit readiness. It has columns for owner, target date, status and evidence.
Add an owner and a target date to every line, and keep evidence of completion. An auditor will sample the records behind each line.
The order below follows a real implementation: scope and risk decisions first, controls and evidence second, checking and audit last. My implementation guide explains the reasoning behind each stage.
1. What do clauses 4 to 10 require?
- Internal and external issues affecting information security identified (4.1)
- Interested parties and their requirements listed: customers, regulators, staff, suppliers, insurers (4.2)
- ISMS scope written, approved and defensible: services, sites, systems and people included (4.3)
- Top management commitment visible; information security policy approved and communicated (5.1–5.2)
- Roles and responsibilities for information security assigned and understood (5.3)
- Risk methodology documented: criteria, scoring, acceptance levels, repeatability (6.1)
- Risk assessment completed with risk owners; treatment plan with owners and dates (6.1)
- Statement of Applicability covering all 93 Annex A controls, with justifications (6.1)
- Measurable information security objectives set and tracked (6.2)
- Resources, competence and awareness in place, with evidence (7.1–7.3)
- Communication expectations and document control working in practice (7.4–7.5)
- Operational planning running: the risk process operates when things change, all year round (8.1–8.3)
- Performance monitored; what good looks like is measured (9.1)
- Internal audit programme planned, executed and reported (9.2)
- Management review held with the required inputs, decisions and actions recorded (9.3)
- Nonconformities handled with root-cause corrective action, effectiveness checked (10.1–10.2)
2. Which documents and records are mandatory?
- ISMS scope statement
- Information security policy (plus proportionate topic policies where your risks need them)
- Risk assessment and treatment process, risk register and risk treatment plan
- Statement of Applicability, current version
- Information security objectives and how they are measured
- Evidence of competence and awareness activity
- Internal audit programme, plans and reports
- Management review minutes with inputs, outputs and actions
- Nonconformity and corrective action records
- Supporting operating records: asset inventory, access reviews, joiners/movers/leavers, supplier assessments, incident log, backup and restore test evidence, change records
Write only what your organisation will actually operate. A slim policy that matches practice passes, and a borrowed library that does not will fail.
My mandatory documents guide explains each document in turn.
This checklist paraphrases the standard's requirements in my own words. You will need the standard itself, available from BSI or ISO, for the authoritative text.
3. How do you cover all 93 Annex A controls?
| Theme | Controls | Work through |
|---|---|---|
| A.5 Organisational (37) | Policies, roles, suppliers, incidents, legal requirements, continuity readiness | Ownership, supplier security, incident process, obligations register |
| A.6 People (8) | Screening, employment terms, awareness, remote working | HR processes, induction and training records |
| A.7 Physical (14) | Perimeters, entry, equipment, clear desk, secure disposal | Premises, devices, media handling |
| A.8 Technological (34) | Access rights, malware, backup, logging, cryptography, secure development | IT controls, evidence from systems, testing |
For each control, record four things in the Statement of Applicability: whether it applies, why, whether it is implemented, and the justification for any control you exclude. Then make sure you can evidence every control you claim as implemented, on request.
4. What should you check before booking the certification audit?
- The system has operated long enough to show dated evidence, typically around three months
- Internal audit covers the full system, findings have owners and dates
- Management review has happened, with decisions followed up
- The certification body is booked, with Stage 1 and Stage 2 dates in diaries
- People the auditor will interview can describe what they do
If several lines are missing, a focused gap analysis is usually the fastest next step. Costs for each route are set out in my guide to ISO 27001 costs in the UK, and the audit itself in Stage 1 vs Stage 2.