ISO 27001

ISO 27001 checklist: documents, tasks and audit evidence

You do not have to arrange everything at once. Start with scope, risks, ownership and evidence.

De Compliance Afdeling
De Compliance AfdelingPractical guidance · 5-minute readOriginal contribution: Aileen · Business Analyst
Updated on

Use these questions in an initial workshop with management, the coordinator and process owners. Record each topic as in place, partly in place or still to be investigated. Read the ISO 27001 guide and use the roadmap to plan the actions.

Use the seven-question self-check to identify your first points to consider. Read the explanation and examples for each topic below.

1. Have the direction and scope been agreed?

  • What do we want the ISMS to achieve, and who decides?
  • Which services, locations, systems, information and outsourced activities are within scope?
  • Which requirements from customers and other stakeholders are relevant?
  • Who coordinates, who implements and how much time do they have available?

Make the scope and objectives accessible and record responsibilities. Context and boundaries form the basis of the ISMS. ISO describes the scope of the standard.

2. Are risks linked to controls?

  • Which information and processes are we examining, and what could go wrong?
  • Do we use consistent assessment criteria that can be reused in the next assessment?
  • Who owns each risk, and who may accept the residual risk?
  • Have treatment decisions been translated into controls, actions and owners?
  • Is the Statement of Applicability justified, and does it reflect actual implementation?

The risk register, treatment plan and Statement of Applicability should make sense together. Check that changes in one have also been reflected in the others. See the BSI self-assessment on risk treatment.

3. Can day-to-day implementation be demonstrated?

Choose examples from your own processes and ask who can explain how they operate. Possible working questions include:

  • Can we trace a request for access rights, a change and a revocation?
  • Where are the outcomes and follow-up of supplier assessments recorded?
  • Who records an incident and assesses the improvement action?
  • What demonstrates that an agreed recovery test has been carried out?
  • How do staff know which arrangements apply to their role?

4. Which documents and records should you collect?

Create an evidence file overview linking the standard's requirements to existing information. It need not become a collection of new, separate files. A practical structure is:

  • Direction: scope, policies, objectives and responsibilities.
  • Risk decisions: assessment method, results, treatment plan, approvals and Statement of Applicability.
  • Implementation: work instructions and appropriate records from daily operations.
  • Evaluation: measurements, internal audit results and management review.
  • Improvement: findings, causes, actions and checking the outcome.

This structure is an aid to organising your evidence file. Always check the required records against the official standard. The BSI implementation guide describes documentation and evaluation.

5. Are assessment and improvement organised?

Plan internal audits, management review and follow-up of nonconformities. Record who assesses and how objectivity is maintained. For each outstanding finding, identify the cause, the action needed and who will check whether it works.

A completed checklist is not a certificate. The certification body assesses your ISMS independently. ISO explains the role of certification.

Who carries out the actions and what does it cost?

Let the coordinator maintain consistency across the work. Management and process owners provide information, decide on risks and organise implementation. Explicitly allocate their time; a standard or software licence does not automatically provide that capacity.

DCA can support analysis, planning, implementation and audit preparation. Use the pricing calculator to compare internal capacity and support hours. The starting point of 4 support hours per week is not a benchmark for internal effort or a guarantee of a particular completion time.

Budget separately for internal time, software, support, any improvements and audits. The article on ISO 27001 certification costs explains how to compare these items.

Frequently asked questions

Is this checklist sufficient for certification?+

No. It is a preparation aid. The official standard, scope and organisational context determine what the certification body assesses.

Does every topic need a separate document?+

Not necessarily. Make the required information accessible and manageable, and reuse existing records where they are sufficient. Check the detail against the standard.

How many internal hours should I allocate?+

Estimate the time needed for interviews, decisions, implementation, checks and follow-up for each work package. There is no universal number of internal hours; the scope and starting point determine the effort.

Want to fill in an initial overview? Use the free online audit preparation checklist for scope, ownership and evidence. This general resource is not a full ISO 27001 assessment and does not provide a certificate.

Where are you with ISO 27001 preparation?

Answer seven questions. Partly, No or I do not know shows the corresponding action and explanation. Yes hides that point; it does not verify your evidence. You receive no score or conformity decision.

Answers stay in this page’s memory and disappear on reload. You do not need an email address to view the result. Do not enter names, incident details or other confidential information here.

1. Is it clear which services, locations and systems your ISMS covers?

Define the scope and discuss what falls outside it. Read about direction and scope.

2. Have you agreed an owner and the time available?

Agree ownership and capacity with management and process owners. Allocate tasks and internal time.

3. Have you assessed and recorded your information security risks?

Assess risks in the context of your information and processes. Connect risks to controls.

4. Have you agreed how to treat risks and which controls apply?

Explain your choices in the treatment plan and Statement of Applicability. Explain your risk decisions.

5. Can you show recent examples of controls being implemented?

Collect relevant evidence of implementation, with an owner and date. Demonstrate implementation.

6. Have you organised an objective internal audit and management review?

Plan assessment and decisions with an appropriate scope and objectivity. Organise internal assessment.

7. Are findings followed up and improvements checked for effectiveness?

Record the cause, action, owner and effectiveness check for each finding. Follow up improvements.

Discuss my ISO 27001 project

Tell us where you are and what support you need. After submission, a colleague will contact you to discuss your question, scope and next step. An enquiry is not an engagement or certification.

We use your details to handle your enquiry and contact you. Read our privacy policy for more information.

No automatic quotation, score or certification decision.

Your enquiry has been received

We will contact you to discuss your ISO 27001 question.

Sources for this article

Explore this topic further

Further readingISO 27001 certification: roadmapRead the guide →Further readingISO 27001 certification costsRead the guide →Further readingISO 27001: the standard and our supportRead the guide →

This is general guidance and does not replace an assessment of your situation or the official standard.

With your permission, we share usage data with Microsoft Clarity to analyse clicks, scrolling and sessions. We do not load Clarity without consent. You can change your choice at any time through Cookie preferences. Read our cookie policy.

We remember your cookie choice and display preferences. This storage is necessary for the website and your settings to work.

Clarity records clicks, scrolling and page interactions for usage analysis and session recordings. Form fields are masked. The cookies _clck (up to 1 year) and _clsk (1 day) link page views to a visit or session. This choice also lets us remember the first observed page or a newly recognised campaign in this tab for up to 30 minutes, to understand the source of a request.

We also use Plausible for aggregated, cookieless statistics. This measurement continues if you reject cookies.

We store your choice in this browser for 30 days. Withdrawing consent may reload the page to stop tracking software that has already loaded. Read our cookie policy.