--- title: "ISO 27001 Checklist: Free Excel Download (2026)" description: "Free ISO 27001 checklist spreadsheet: clauses 4-10, mandatory documents, SoA tracker and audit-readiness sheets, in implementation order. Download it free." canonical: https://www.isosecurity.co.uk/resources/iso-27001-checklist updated: 2026-11-10 --- # ISO 27001 checklist: clauses, documents and controls Work through three layers in order: the mandatory management-system requirements in clauses 4 to 10, the documented information the standard explicitly requires, and a justified position on each of the 93 Annex A controls in your Statement of Applicability. You need to consider everything on this list, and much of it is proportionate to your size. ## How do you use this checklist? [Download the spreadsheet version of this checklist (.xlsx)](/downloads/iso-27001-checklist.xlsx): sheets for clauses 4 to 10, mandatory documents, a Statement of Applicability tracker and audit readiness. It has columns for owner, target date, status and evidence. Add an owner and a target date to every line, and keep evidence of completion. An auditor will sample the records behind each line. The order below follows a real implementation: scope and risk decisions first, controls and evidence second, checking and audit last. My [implementation guide](/resources/iso-27001-implementation-guide) explains the reasoning behind each stage. ## 1. What do clauses 4 to 10 require? - Internal and external issues affecting information security identified (4.1) - Interested parties and their requirements listed: customers, regulators, staff, suppliers, insurers (4.2) - ISMS scope written, approved and defensible: services, sites, systems and people included (4.3) - Top management commitment visible; information security policy approved and communicated (5.1–5.2) - Roles and responsibilities for information security assigned and understood (5.3) - Risk methodology documented: criteria, scoring, acceptance levels, repeatability (6.1) - Risk assessment completed with risk owners; treatment plan with owners and dates (6.1) - Statement of Applicability covering all 93 Annex A controls, with justifications (6.1) - Measurable information security objectives set and tracked (6.2) - Resources, competence and awareness in place, with evidence (7.1–7.3) - Communication expectations and document control working in practice (7.4–7.5) - Operational planning running: the risk process operates when things change, all year round (8.1–8.3) - Performance monitored; what good looks like is measured (9.1) - Internal audit programme planned, executed and reported (9.2) - Management review held with the required inputs, decisions and actions recorded (9.3) - Nonconformities handled with root-cause corrective action, effectiveness checked (10.1–10.2) ## 2. Which documents and records are mandatory? - ISMS scope statement - Information security policy (plus proportionate topic policies where your risks need them) - Risk assessment and treatment process, risk register and risk treatment plan - Statement of Applicability, current version - Information security objectives and how they are measured - Evidence of competence and awareness activity - Internal audit programme, plans and reports - Management review minutes with inputs, outputs and actions - Nonconformity and corrective action records - Supporting operating records: asset inventory, access reviews, joiners/movers/leavers, supplier assessments, incident log, backup and restore test evidence, change records Write only what your organisation will actually operate. A slim policy that matches practice passes, and a borrowed library that does not will fail. My [mandatory documents guide](/resources/iso-27001-mandatory-documents) explains each document in turn. This checklist paraphrases the standard's requirements in my own words. You will need the standard itself, available from BSI or ISO, for the authoritative text. ## 3. How do you cover all 93 Annex A controls? | Theme | Controls | Work through | | ----------------------- | ------------------------------------------------------------------------------- | -------------------------------------------------------------------- | | A.5 Organisational (37) | Policies, roles, suppliers, incidents, legal requirements, continuity readiness | Ownership, supplier security, incident process, obligations register | | A.6 People (8) | Screening, employment terms, awareness, remote working | HR processes, induction and training records | | A.7 Physical (14) | Perimeters, entry, equipment, clear desk, secure disposal | Premises, devices, media handling | | A.8 Technological (34) | Access rights, malware, backup, logging, cryptography, secure development | IT controls, evidence from systems, testing | For each control, record four things in the Statement of Applicability: whether it applies, why, whether it is implemented, and the justification for any control you exclude. Then make sure you can evidence every control you claim as implemented, on request. ## 4. What should you check before booking the certification audit? - The system has operated long enough to show dated evidence, typically around three months - Internal audit covers the full system, findings have owners and dates - Management review has happened, with decisions followed up - The certification body is booked, with Stage 1 and Stage 2 dates in diaries - People the auditor will interview can describe what they do If several lines are missing, a focused gap analysis is usually the fastest next step. Costs for each route are set out in my guide to [ISO 27001 costs in the UK](/resources/iso-27001-cost-uk), and the audit itself in [Stage 1 vs Stage 2](/resources/iso-27001-stage-1-stage-2-audit). ## Frequently asked questions about the ISO 27001 checklist ### What documents are mandatory for ISO 27001? The standard explicitly requires, among others: the ISMS scope, the information security policy, the risk assessment and treatment process and its results, the Statement of Applicability, and security objectives. It also requires evidence of competence, the internal audit programme and results, management review records, and records of nonconformities and corrective actions. ### Do we need to implement all 93 Annex A controls? Every control needs a justified position in your Statement of Applicability: implement those your risk assessment, legal duties and contracts require, and document why any control is excluded. The checklist below treats Annex A as four themes to work through in order. ### Can we use this checklist without a consultant? Yes, it is the same sequence I work through with clients. The two places organisations most often need experienced help are the risk methodology (it must be repeatable and defensible) and the internal audit, which must be impartial; everything else is within reach of a capable internal owner with time. ### Is a downloadable version available? Yes: a spreadsheet version of this checklist, with sheets for clauses 4 to 10, mandatory documents, a Statement of Applicability tracker and audit readiness, is available to download from this page. Add an owner, a date and a status against every line, and keep the evidence location alongside it. ## Contact Worked through the checklist and found gaps? Arrange a readiness discussion: [contact ISO Security](/contact) or email info@isosecurity.co.uk.