ISO27001 2022 Self-Assessment Checklist - (9p)

ISO27001:2022 Self-Assessment Checklist
ISO27001:2022 Self-Assessment
Checklist
About this checklist
This ISO27001:2022 Self-Assessment Checklist is intended as a starting point for those considering implementing and/or certifying to ISO27001:2022 to gain
a better understanding of what requirements are met and need to be met to assess budget and resource. It can also be used as a tool for improvement for
those already aligned to ISO27001 who are wanting to see their general level of compliance.
It’s important to note that this checklist does not include all the requirements of the ISO27001:2022 standard and should be used as a general guide when
aligning to some of the main requirements that are common within many industries and organizations. We would advise always having a copy of the
standard you’re deciding to implement or certify to, this can either be purchased via the ISO website, or as an alternative, the exact text of the
ISO27001:2022 standard is included in our ISO27001 Enhanced Gap Assessment.
How to use this Self-Assessment Checklist
Going through each section of the standard: 4-10, using the requirements within the table you can decide whether this has been fully, partially, or not met
and create a plan using the columns in the table to achieve these requirements. At the end of the assessment, you will have a list of requirements met and
actions required to gain a better understanding of the work required to prepare for certification to the standard.
Note that this checklist does not cover the 93 Annex A controls at the back of the standard. As part of your implementation, you will decide which of these
are applicable to your organization.
4. Context of the organization
Req. Met? Action Date Date

Ref ISO27001 Requirement Action needed to meet requirement
Yes/Partially/No Owner Planned Achieved
1 Have the external and internal issues relevant
to the ISMS been determined?
2 Have the interested parties and their
requirements been identified?
3 Has the scope of the ISMS been determined
and documented?
4 Are the processes needed for the ISMS
determined?
5 Is adequate documented information
maintained about the processes and their
interactions?
5. Leadership

1 Does top management demonstrate leadership
and commitment with respect to the ISMS?
2 Are sufficient resources available for the ISMS?
3 Is the information security policy documented?
4 Does the information security policy include
objectives, and commitments to satisfying
requirements and continual improvement?
5 Are relevant roles, responsibilities and
authorities assigned, communicated and
understood?
6. Planning

1 Have the relevant issues and requirements
been considered as part of your risk
assessment?
2 Is there a documented risk assessment
process?
3 Has a risk treatment plan been produced?
4 Has a Statement of Applicability been created?
5 Have measurable information security
objectives been established, documented and
communicated?
6 Is there a plan to achieve the defined
objectives?
7 Are changes to the ISMS planned and managed
appropriately?
7. Support

1 Are appropriate resources provided for the
ISMS, both internally and where necessary,
externally?
2 Are all of the relevant people sufficiently
competent to perform their roles?
3 Is an awareness programme in place to cover
the relevant contents of the information
security policy and the benefits of effective
information security?
4 Is effective internal and external
communication in place?
5 Is all of the documented information required
by the standard in place?
6 Is documented information adequately
controlled and protected?
8. Operation
Ref ISO27001 Requirement Req. Met? Action Action needed to meet requirement Date Date
1 Are all of the processes needed to meet
requirements planned, implemented and
controlled?
2 Are planned changes to the ISMS controlled
effectively?
3 Do all externally provided resources meet the
defined information security requirements?
4 Are information security risk assessments
carried out when planned?
5 Is the risk treatment plan being implemented?
9. Performance Evaluation

1 Is it clearly defined what needs to be
monitored and measured to determine the
effectiveness of the ISMS?
2 Are appropriate internal audits being carried
out by suitably qualified and impartial people?
3 Are documented management reviews being
held regularly?
4 Do the outputs from the management review
cover the required areas, for example,
improvements, changes and resources?
10. Improvements

1 Are opportunities for improvement identified,
assessed and implemented on a regular basis?
2 Are nonconformities being identified,
documented, evaluated and addressed?

ISO27001 2022 Self-Assessment Checklist - (9p)

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

ISO27001 2022 Self-Assessment Checklist - (9p)

Uploaded by

Copyright:

Available Formats

ISO27001:2022 Self-Assessment Checklist

About this checklist

How to use this Self-Assessment Checklist

4. Context of the organization

Req. Met? Action Date Date

Req. Met? Action Date Date

Req. Met? Action Date Date

Req. Met? Action Date Date

Req. Met? Action Date Date

Req. Met? Action Date Date

You might also like