An ISO 27001 checklist is only useful if it follows the standard's own structure: the mandatory clauses 4 to 10, then the 93 Annex A controls in four themes. Below are working checklists for a gap analysis, Annex A, Stage 1 and the internal audit, plus what the core policies should say. ERS IT Solutions, in Blanchardstown, Dublin 15 since 1983, does not certify or hold ISO 27001, but we run many of the technical controls these documents describe for Irish clients.
What documents does ISO 27001 require?
ISO/IEC 27001:2022 requires certain "documented information". If any of these is missing at Stage 1, you are not ready.
- The scope of the ISMS (clause 4.3).
- The information security policy (clause 5.2).
- The risk assessment process (clause 6.1.2).
- The risk treatment process (clause 6.1.3).
- The Statement of Applicability (clause 6.1.3).
- Information security objectives (clause 6.2).
- Evidence of competence (clause 7.2).
- Documented information needed to run processes as planned (clause 8.1).
- Results of risk assessments and risk treatment (clauses 8.2 and 8.3).
- Monitoring and measurement results (clause 9.1).
- The internal audit programme and results (clause 9.2).
- Management review results (clause 9.3).
- Nonconformities and corrective actions (clause 10.2).
Anything else, including most policies, is required only if your risk assessment and Statement of Applicability say you need it. In practice most organisations need a standard set of policies, listed below.
ISO 27001 gap analysis checklist
Run this first. For each line, mark "in place", "partly" or "missing", and note the evidence.
- Is there a written ISMS scope covering people, sites, systems and suppliers?
- Has leadership approved an information security policy and assigned roles?
- Is there a documented risk assessment method, and has it been used?
- Is there a risk register with owners and treatment decisions?
- Is there a Statement of Applicability covering all 93 controls?
- Are security objectives set and measured?
- Have staff had security awareness training, with records?
- Are technical controls (MFA, patching, backups, logging, device management) in place and evidenced?
- Has an internal audit been carried out by someone independent of the work?
- Has a management review been held and minuted?
- Is there a log of incidents, nonconformities and corrective actions?
ISO 27001 Annex A controls: the 2022 structure
The 2022 version reorganised Annex A into 93 controls in four themes. NSAI confirms the 93 controls and four themes.
| Theme | Clause | Number of controls | Examples |
|---|---|---|---|
| Organisational | 5 | 37 | Policies, roles, asset inventory, supplier security, incident management, business continuity, legal requirements |
| People | 6 | 8 | Screening, terms of employment, awareness and training, remote working |
| Physical | 7 | 14 | Secure areas, desk and screen rules, equipment security, secure disposal |
| Technological | 8 | 34 | Endpoint devices, privileged access, authentication, malware protection, vulnerability management, backup, logging, monitoring, network security, secure development |
The 2022 version also added new controls such as threat intelligence, information security for cloud services, ICT readiness for business continuity, configuration management, data masking, data leakage prevention, monitoring activities, web filtering and secure coding.
ISO 27001 Annex A checklist
For each of the 93 controls, record:
| Column | What to write |
|---|---|
| Control number and name | e.g. 8.13 Information backup |
| Applicable? | Yes or no |
| Reason | The risk it treats, or why it is excluded |
| Status | Implemented, partly, planned |
| Owner | A named person |
| Evidence | Policy, screenshot, report, log or record |
| Last reviewed | Date |
This table is, in effect, your Statement of Applicability. A spreadsheet (the "ISO 27001 audit checklist xls" many people search for) works well for a small organisation. Keep it under version control, because auditors will ask when it last changed.
ISO 27001 Stage 1 audit checklist
Stage 1 is a documentation and readiness review. According to NSAI's certification guide, it looks at your proposed scope, how far the management system is implemented, legal and regulatory requirements, policies and objectives, whether the system addresses the key areas of the business, and your internal audits, reviews and complaints procedures. Before Stage 1, check you have:
- All 13 mandatory documents listed above.
- A completed risk assessment and risk treatment plan.
- A signed-off Statement of Applicability.
- A register of legal, regulatory and contractual requirements, including GDPR.
- At least one completed internal audit and one management review.
- Records showing the ISMS has been running for a period, not created last week.
ISO 27001 internal audit checklist and audit plan
The internal audit must cover the whole ISMS over the audit programme. A simple internal audit plan for a small organisation:
- Set the programme: which clauses and Annex A controls are audited when, across the year.
- Choose an auditor who does not audit their own work.
- For each area, write questions that test evidence, not opinions, for example "show me last month's patch report" or "show me the access review for the finance system".
- Record findings as conformity, nonconformity or opportunity for improvement.
- Agree corrective actions with owners and dates.
- Report the results to the management review.
ISO 27001 risk assessment template
A risk register needs at least these columns: asset or process, threat, vulnerability, existing controls, likelihood, impact, risk score, risk owner, treatment decision (reduce, accept, avoid, transfer), Annex A controls chosen and residual risk. Use the same scoring method every time, and write it down, because clause 6.1.2 requires assessments that produce "consistent, valid and comparable results".
ISO 27001 policy list
Most small and medium ISMSs end up with these policies. Combine them where it makes sense. Short policies people actually read are better than long ones nobody does.
- Information security policy (mandatory).
- Acceptable use policy.
- Access control and password policy.
- Asset management policy.
- Backup policy.
- Incident response plan.
- Business continuity and disaster recovery plan.
- Supplier security policy.
- Remote working and mobile device policy.
- Data protection policy (linked to GDPR).
- Cryptography and encryption policy.
- Secure development policy, if you build software.
What should an ISO 27001 password policy template say?
Follow current guidance rather than old habits. The UK NCSC's Cyber Essentials requirements v3.3 and the Irish Data Protection Commission point the same way:
- Use MFA wherever it is available, and always for cloud services and admin accounts.
- Without MFA, require at least 12 characters, or 8 with automatic blocking of common passwords.
- Do not force regular password changes. Change them when there is a sign of compromise.
- Do not rely on complexity rules. Encourage long passphrases.
- Provide a password manager.
- Never share credentials, and change all vendor default passwords.
What should an ISO 27001 backup policy say?
State what is backed up, how often, where copies are kept, how long they are retained, who checks them and how often restores are tested. Ireland's NCSC recommends the 3-2-1 rule: three copies, on two separate systems, with one offline. Record each restore test as evidence for Annex A control 8.13. ERS runs this for clients through backup and disaster recovery.
What should an ISO 27001 asset management policy say?
Who keeps the asset inventory, what goes in it (devices, servers, cloud services, software, data sets), who owns each asset, how assets are classified, how they are returned when staff leave and how they are securely disposed of. An up-to-date inventory is also the starting point for Cyber Essentials, so one piece of work serves both. Mobile device management keeps the device part of the inventory accurate automatically.
What should a data protection policy for ISO 27001 cover?
The legal basis for processing, retention periods, who can access personal data, how data subject requests are handled and how breaches are reported. In Ireland, a personal data breach that risks people's rights must be reported to the Data Protection Commission within 72 hours. ISO 27001 helps structure this, but NSAI notes certification does not in itself demonstrate legal compliance. See our page on cyber security compliance.
ISO 27001 incident response plan template
A usable incident response plan fits on a few pages:
- Roles. Incident lead, deputy, IT contact, communications, legal or DPO, and their phone numbers.
- Severity levels. What counts as low, medium, high and critical.
- First steps. Contain (isolate devices, disable accounts), preserve evidence, call your IT provider.
- Notifications. DPC within 72 hours for personal data breaches. Your insurer as early as the policy requires. Gardaí for crime. The NCSC for significant incidents, and under NIS2 within 24 hours once Irish law is in force.
- Recovery. Restore from clean backups, reset credentials, confirm the attacker is gone.
- Review. Record what happened and the corrective actions.
Our ransomware guide walks through the first hours in more detail.