ISO 27001 checklist: every requirement in clauses 4 to 10, point by point
An ISO 27001 checklist for the 2022 edition: each requirement in clauses 4 to 10, the Statement of Applicability, the risk treatment plan, management review and the documents an accredited auditor will ask for. Collected in one table you can copy, no PDF download form.
Most ISO 27001 checklists you can download are a list of ten sensible steps: get management on board, run a risk assessment, train your staff. None of that is wrong, but it is not what an auditor looks for. The auditor opens the standard, works through it clause by clause from 4.1 to 10.2 and asks for documented information against each requirement.
This ISO 27001 checklist is built the same way. It follows ISO/IEC 27001:2022, covers every requirement in clauses 4 to 10, explains the three documents most often missing when organisations believe they are ready, and ends with a single table of mandatory documented information you can copy into your own working document. There is no gated PDF. Everything is on this page.
The article is about the requirements, not the certification journey. What ISO 27001 is and what compliance means in practice is covered in our article on ISO 27001 compliance. The certification process itself, with Stage 1 and Stage 2 audits, costs and timelines, is covered in our guide to ISO 27001 certification.
The short answer: what should an ISO 27001 checklist contain?
A usable ISO 27001 checklist covers three layers. The first is the management system requirements in clauses 4 to 10. All of them are mandatory and none can be excluded. The second is the 93 reference controls in Annex A, which you compare your own controls against and decide on one by one in the Statement of Applicability (SoA). The third is the documented information the standard explicitly requires: scope, policy, risk process, SoA, risk treatment plan, objectives, evidence of competence, monitoring results, audit programme, management review and nonconformities.
If one of the three layers is missing, the checklist is not complete. The three items most often skipped are the Statement of Applicability, the risk treatment plan and management review. Each has its own section further down.
Standard, checklist, SoA and certificate: four things that get mixed up
Searches for "ISO 27001 checklist" and "ISO 27001 requirements checklist" typically blend four things that belong to different categories. It is worth separating them before you start ticking boxes.
| Term | What it is | Who produces it |
|---|---|---|
| ISO/IEC 27001:2022 | The standard itself, with the requirements in clauses 4 to 10 and Annex A. Copyrighted and sold by ISO and national standards bodies such as BSI, DIN or Dansk Standard. | ISO/IEC JTC 1/SC 27. National editions by the national standards body. |
| ISO 27001 checklist | A working tool that translates the requirements into items you can tick off. Not part of the standard and not something the auditor approves. | You, a consultant or a platform. |
| Statement of Applicability (SoA) | Mandatory document under clause 6.1.3 d). Lists the necessary controls, justifies inclusions and exclusions and states implementation status. | The organisation. The auditor uses it to steer the audit. |
| ISO 27001 certificate | Evidence issued after a two-stage audit. Valid for three years with an annual surveillance audit. | A certification body, accredited by a national accreditation body such as UKAS in the UK. |
The point is simple. The checklist is yours, the SoA is mandatory, the standard has to be bought, and the certificate comes from a third party. A completed checklist proves nothing to an auditor on its own. It shows you where the evidence is missing.
How ISO 27001:2022 is structured
The current edition is ISO/IEC 27001:2022, published in October 2022. The transition period from the 2013 edition closed on 31 October 2025, so every valid certificate today is issued against the 2022 edition. In February 2024, Amendment 1 added climate change as an issue the organisation must consider under clause 4.1 and as a possible expectation of interested parties under 4.2. Annex A was not changed. ISO/IEC 27000, the vocabulary standard for the whole 27000 family, appeared in a new edition on 3 July 2026, but that does not alter the requirements in 27001. As of 24 September 2026, no new edition of ISO/IEC 27001 has been published.
The standard has two parts, and the checklist needs to cover both:
| Clause | Topic | What the auditor typically asks for |
|---|---|---|
| 4 | Context of the organisation | Analysis of internal and external issues, list of interested parties, documented scope |
| 5 | Leadership | Approved information security policy, role descriptions, minutes showing top management involvement |
| 6 | Planning | Risk assessment process, risk treatment process, SoA, risk treatment plan, measurable objectives, planning of changes |
| 7 | Support | Resources, evidence of competence, awareness activities, communication plan, document control |
| 8 | Operation | Process descriptions, control of outsourced processes, completed risk assessments and risk treatment results |
| 9 | Performance evaluation | Monitoring results, internal audit programme and reports, management review minutes |
| 10 | Improvement | Nonconformity log, corrective actions with effectiveness review |
| Annex A | 93 reference controls in 4 themes | SoA with a justification per control and evidence for the ones marked implemented |
ISO 27001 checklist: clauses 4 to 10, point by point
Here is the checklist. Each item refers to the clause the requirement sits in, so you can look it up in the standard and use the same numbering in your SoA and audit preparation. Change ☐ to ✓ when you have both the document and evidence that it is used.
Clause 4: Context of the organisation
Clause 4 decides what the ISMS protects and who has requirements of it. Everything else builds on that.
☐ 4.1: Internal and external issues relevant to information security are identified and documented, including whether climate change is a relevant issue (requirement added by Amendment 1:2024).
☐ 4.2: Interested parties and their requirements are mapped, and it is recorded which of those requirements the ISMS will address (item c) is new in the 2022 edition). Legal requirements such as GDPR Article 32, and for in-scope entities the national NIS2 legislation, belong here.
☐ 4.3: The scope of the ISMS is determined, including interfaces and dependencies with other organisations, and is available as documented information.
☐ 4.4: The ISMS is established with the processes needed and their interactions.
Clause 5: Leadership
The auditor will want to speak with top management, not only with the information security lead. Clause 5 is about what management itself must be able to show.
☐ 5.1: Top management can demonstrate its commitment: policy and objectives are established, resources are allocated, the ISMS is integrated into business processes, and management follows up on results.
☐ 5.2: An information security policy is approved, communicated internally, available to relevant interested parties and held as documented information.
☐ 5.3: Roles, responsibilities and authorities are assigned and communicated, including who reports on ISMS performance to top management.
Clause 6: Planning
Clause 6 is the heart of the standard and the place where most gap analyses find the biggest gaps.
☐ 6.1.1: Risks and opportunities for the ISMS as a whole are identified and actions planned.
☐ 6.1.2: A risk assessment process is documented with criteria for accepting risk and for performing assessments, and the process produces consistent, valid and comparable results. Risks are identified with risk owners, analysed for consequence and likelihood, and prioritised.
☐ 6.1.3: A risk treatment process is documented. Necessary controls are determined, compared with Annex A, recorded in a Statement of Applicability and built into a risk treatment plan approved by the risk owners together with acceptance of residual risks.
☐ 6.2: Information security objectives are established at relevant functions and levels. They are consistent with the policy, measurable where practicable, monitored, communicated and held as documented information. There is a plan for what will be done, with what resources, by whom, by when and how results are evaluated.
☐ 6.3: Changes to the ISMS are carried out in a planned manner (new clause in the 2022 edition).
Clause 7: Support
☐ 7.1: The resources needed to establish, operate and improve the ISMS are determined and provided.
☐ 7.2: Necessary competence is determined for people whose work affects information security, and evidence of competence exists, such as training certificates and evaluations.
☐ 7.3: Staff are aware of the policy, their own contribution and the implications of not conforming. This is where your awareness training lands.
☐ 7.4: It is determined what is communicated about information security, when, with whom and how.
☐ 7.5: Documented information is created with identification, format and approval (7.5.2) and controlled for access, versioning, retention and disposal (7.5.3). This covers both the documents the standard requires and those you have judged necessary yourselves.
Clause 8: Operation
☐ 8.1: Processes needed to meet the requirements and carry out the actions from clause 6 are planned with criteria and controlled against them. Externally provided processes, products and services are identified and controlled. This is where supplier management becomes an ISMS requirement and not only an Annex A control.
☐ 8.2: Risk assessments are performed at planned intervals and when significant changes occur, and the results are retained as documented information.
☐ 8.3: The risk treatment plan is implemented, and the results of risk treatment are retained as documented information.
Clause 9: Performance evaluation
☐ 9.1: It is determined what is monitored and measured, by which methods, when, by whom and when the results are analysed. Results are documented.
☐ 9.2: There is an internal audit programme covering frequency, methods, responsibilities, planning requirements and reporting. Audit criteria and scope are defined for each audit, auditors are objective and impartial, and results are reported to relevant management. Programme and results are documented.
☐ 9.3: Top management reviews the ISMS at planned intervals using the inputs listed in clause 9.3.2, and the results, including decisions on improvements and changes, are documented.
Clause 10: Improvement
☐ 10.1: The suitability, adequacy and effectiveness of the ISMS are continually improved.
☐ 10.2: When nonconformities occur, the organisation reacts, investigates causes, takes corrective action, reviews its effectiveness and documents both the nonconformity and the action.
The three items most often missing: SoA, risk treatment plan and management review
When we look at ISO 27001 checklists organisations have used ahead of a first audit meeting, the same three items are missing or incomplete. All three are mandatory, and they depend on each other.
The Statement of Applicability, clause 6.1.3 d)
The Statement of Applicability is the document the auditor uses to steer the whole Stage 2 audit. For each control it must contain four things: the necessary controls, the justification for including them, whether they are implemented or not, and the justification for excluding any Annex A control that is not included. An SoA that simply repeats the 93 Annex A titles with a tick does not meet the requirement. Each justification must point back to the risk assessment, to a legal requirement or to a contractual requirement.
Two points matter here. The Annex A controls are not mandatory in themselves, but you must take a position on every one of them. And you may include controls that are not in Annex A, for example from ISO/IEC 27017 for cloud services or from the NIS2 risk management measures in Article 21(2) of Directive (EU) 2022/2555. They then need to appear in the SoA as well.
The risk treatment plan, clauses 6.1.3 e) and 8.3
The risk treatment plan is the action plan for the risks above your acceptance criteria. For each risk it should show the treatment option chosen (modify, retain, avoid or share), which controls are used, who owns the action, when it is due, and that the risk owner has approved the plan and accepted the residual risk. Clause 8.3 requires the plan to be implemented and the results documented. A plan with no status and no dates is one of the most common audit findings.
Management review, clause 9.3
Management review is top management's own examination of whether the ISMS works. The standard says "at planned intervals". In practice, certification bodies expect it at least once a year, so that a full cycle of internal audit and management review is complete before the Stage 2 audit and before each surveillance audit. Clause 9.3.2 lists what the review must cover as a minimum:
| Input (9.3.2) | What you bring to the table |
|---|---|
| a) Status of actions from previous reviews | Follow-up list from the last set of minutes |
| b) Changes in external and internal issues | Updated 4.1 analysis, for example new legislation, new systems, organisational changes |
| c) Changes in needs and expectations of interested parties (new in 2022) | Updated 4.2 list, for example new customer or regulator requirements |
| d) Feedback on information security performance | Nonconformities and corrective actions, monitoring results from 9.1, audit results from 9.2, fulfilment of objectives from 6.2 |
| e) Feedback from interested parties | Customer audits, supplier incidents, complaints |
| f) Results of risk assessment and status of the risk treatment plan | Risk register and plan with status per action |
| g) Opportunities for continual improvement | Suggestions from audits, staff and incident analyses |
The outputs under 9.3.3 are decisions on continual improvement opportunities and on any need for changes to the ISMS. Minutes that only say "ISMS reviewed, no comments" are not enough. They must show that all seven inputs were considered and what management decided.
Annex A: 93 controls in four themes
Annex A in the 2022 edition contains 93 reference controls, down from 114 in the 2013 edition. They are grouped in four themes instead of 14 domains, and 11 controls are new. The full text of the controls and implementation guidance sits in ISO/IEC 27002:2022, which also gives each control five attributes (control type, information security properties, cybersecurity concepts, operational capabilities and security domains) that make them easier to sort in the SoA.
| Theme | Count | Examples | New controls in 2022 |
|---|---|---|---|
| A.5 Organisational | 37 | Policies (5.1), roles (5.2), supplier relationships (5.19 to 5.23), incident management (5.24 to 5.28), legal requirements (5.31) | 5.7 Threat intelligence, 5.23 Information security for use of cloud services, 5.30 ICT readiness for business continuity |
| A.6 People | 8 | Screening (6.1), terms of employment (6.2), awareness and training (6.3), remote working (6.7) | None |
| A.7 Physical | 14 | Physical perimeters (7.1), entry (7.2), clear desk and clear screen (7.7), secure disposal (7.14) | 7.4 Physical security monitoring |
| A.8 Technological | 34 | Privileged access rights (8.2), malware protection (8.7), backup (8.13), logging (8.15), cryptography (8.24), secure development (8.25 to 8.31) | 8.9 Configuration management, 8.10 Information deletion, 8.11 Data masking, 8.12 Data leakage prevention, 8.16 Monitoring activities, 8.23 Web filtering, 8.28 Secure coding |
The checklist item for Annex A is therefore not "have we implemented all 93". It is: have we taken a position on all 93 in the SoA, can we justify each inclusion and exclusion by reference to the risk assessment or a requirement, and can we show evidence for the controls we have marked as implemented.
Mandatory documented information: the whole ISO 27001 requirements checklist in one table
This table collects the documents and records ISO 27001:2022 explicitly requires as documented information. Copy it into your own working document, add a column for owner and status, and you have an ISO 27001 checklist template you can take straight into the Stage 1 audit. Documents that follow from the Annex A controls you select, such as an inventory of information assets (A.5.9) or acceptable use rules (A.5.10), come on top.
| Clause | Mandatory documented information | Type | Typical audit evidence |
|---|---|---|---|
| 4.3 | Scope of the ISMS | Document | Scope statement with locations, systems, interfaces and exclusions |
| 5.2 | Information security policy | Document | Approved and dated policy, evidence of communication |
| 6.1.2 | Risk assessment process | Document | Methodology with acceptance criteria, scales and frequency |
| 6.1.3 | Risk treatment process | Document | Description of treatment options and approval flow |
| 6.1.3 d) | Statement of Applicability (SoA) | Document | All 93 Annex A controls plus your own, with justification and status |
| 6.1.3 e) | Risk treatment plan | Document | Plan with owner, deadline, status and risk owner approval |
| 6.2 | Information security objectives | Document | Measurable objectives with owner, deadline and measurement method |
| 7.2 | Evidence of competence | Record | Training certificates, CVs, training log |
| 7.5 | Documented information the organisation determines necessary | Document/record | Procedures and templates under version control |
| 8.1 | Documentation to the extent needed for confidence in the processes | Record | Process descriptions, supplier register, operational logs |
| 8.2 | Results of risk assessments | Record | Dated risk register with risk owners |
| 8.3 | Results of risk treatment | Record | Completed actions and accepted residual risks |
| 9.1 | Results of monitoring and measurement | Record | KPI reports, for example patch time, completed awareness training, incidents |
| 9.2 | Audit programme and audit results | Record | Three-year programme, audit plans, reports, evidence of auditor independence |
| 9.3 | Results of management review | Record | Minutes covering all inputs in 9.3.2 and decisions under 9.3.3 |
| 10.2 | Nonconformities, actions and results of corrective action | Record | Nonconformity log with root cause analysis and effectiveness review |
One clarification, because the error appears in many guides: a record of processing activities is a requirement under GDPR Article 30, not under ISO 27001. It belongs in your GDPR documentation and can be a useful input to the asset inventory, but it is not on the ISO 27001 checklist.
Worked example: Harbourline Software runs the checklist
Harbourline Software Ltd and Priya Shah are fictional. We invented them for this article, and they are neither customers nor a case study.
Harbourline is a software supplier with 120 employees that hosts case management systems for local authorities in the UK and the Netherlands. Two customers have written ISO 27001 into their next contract renewal, and Priya Shah, the head of IT, has been made responsible for reaching the Stage 1 audit within eight months. She starts with the checklist above rather than with Annex A.
Working through clauses 4 to 10 gives 41 items. 24 are in place, 10 are partly in place and 7 are missing entirely. The 7 missing items are: documented scope (4.3), measurable objectives (6.2), planning of changes (6.3), a monitoring programme (9.1), an internal audit programme (9.2), management review (9.3) and a nonconformity log (10.2). That is a typical picture for an organisation that has taken security seriously but never run a management system. The controls exist, the cycle does not.
The risk assessment under 6.1.2 identifies 38 risks. 9 sit above the acceptance criterion and go into the risk treatment plan, each with an owner and a deadline. In the Statement of Applicability, Priya works through all 93 controls. 89 are judged necessary and 4 are excluded with a justification, for example A.8.30 on outsourced development, because all development is in-house. Of the 89, 71 are implemented and 18 sit as actions in the plan: the 9 from the risk assessment and 9 that follow from customer and legal requirements captured under 4.2.
The sequence to Stage 1 then becomes: scope and policy approved by the board in month 1, risk assessment and SoA complete in month 3, plan actions delivered in months 3 to 6, internal audit in month 6 by an external auditor because nobody in-house is independent of the ISMS, and management review in month 7 with all seven inputs. Stage 1 is booked for month 8. The numbers are invented, but the logic is what the checklist should force: the cycle must have run once before the auditor arrives.
What the ISO 27001 checklist does not do
A checklist gives you an overview. It cannot give you four things, and they are worth saying out loud.
It does not replace the standard. ISO/IEC 27001:2022 is copyrighted and has to be bought from ISO or from your national standards body, such as BSI in the UK. The auditor expects you to know the full wording, not a summary. Phrases such as "consistent, valid and comparable results" in 6.1.2 have a precise meaning.
It does not make you certified. The certificate is issued by a certification body accredited by a national accreditation body, in the UK by UKAS, against ISO/IEC 17021-1 and ISO/IEC 27006-1:2024. Be aware that "approved", "registered" or "authorised" is not the same as accredited. A certificate from a non-accredited body has limited value in tenders and supplier assessments. According to the ISO Survey 2024, there were 96,709 valid ISO 27001 certificates worldwide, 4,455 of them in the UK, and buyers increasingly check the accreditation mark on the certificate before they accept it.
It does not make you GDPR or NIS2 compliant. ISO 27001 supports security of processing under GDPR Article 32, but GDPR contains requirements on lawful basis, transparency, records of processing and data subject rights that the standard does not cover at all. The NIS2 Directive (EU) 2022/2555 requires registration, incident reporting within 24 hours, 72 hours and one month under Article 23, and management body accountability under Article 20, none of which sit inside ISO 27001. The ENISA technical implementation guidance from June 2025 maps the Article 21(2) measures to ISO 27001 and other standards and is a good starting point. In the UK, the NIS Regulations 2018 apply, and the Cyber Security and Resilience Bill was at report stage in the House of Lords on 16 September 2026 and has not yet received Royal Assent. See our comparison of NIS2 vs ISO 27001 for the full mapping.
It does not choose your method. The standard requires a risk assessment process that produces consistent and comparable results, but it does not say which. A simple risk matrix has known weaknesses, and for organisations facing several regimes a single shared method may be better. Our article on information security risk management across GDPR, NIS2, DORA and ISO 27001 walks through the options.
How .legal supports your ISO 27001 checklist
The problem with a checklist in a spreadsheet is that it is true on the day it is filled in. Three months later the risk register has changed, three actions are overdue and the SoA still says "implemented". Our information security management module is built to keep the three documents this article is about connected: the risk assessment with risk owners, the risk treatment plan with owners and deadlines, and the Statement of Applicability with a justification and status per control, so it moves when an action is closed.
Internal audits, management review and the annual policy reviews go into compliance task management, so clauses 9 and 10 become recurring tasks with an owner and evidence rather than a scramble before the surveillance audit. If you are working on NIS2 or GDPR at the same time, the Frameworks module lets you map one control to several regimes, so the supplier review or the awareness training is documented once.
The platform does not do the work for you, and it does not give you the certificate. It makes sure the checklist still holds when the auditor arrives. Book a demo if you want to see how the SoA, the risk treatment plan and the task calendar fit together in practice.
.legal compliance platform
Achieve ISO 27001 Compliance with .legal
-
Track ISO 27001 requirements and controls
-
Manage Statement of Applicability
-
Document policies and procedures
-
Prepare for certification audits
-
Monitor continuous compliance
.jpeg?width=131&height=26&name=right_people_logo%20(1).jpeg){kind=small}
.jpg?width=58&height=26&name=Praktiserende%20L%C3%A6gers%20Organisation%20(1).jpg){kind=small}
.jpg?width=108&height=26&name=finans%20danmark%20(1).jpg){kind=small}
.jpg?width=89&height=26&name=klasselotteri%20(1).jpg){kind=small}
-1.png?width=34&height=26&name=bws_shipping_rgb%20-%20Kopi%20(2)-1.png){kind=small}
.jpeg?width=135&height=26&name=AH%20industries%20(1).jpeg){kind=small}
.jpg?width=225&height=26&name=KAUFMANN%20(1).jpg){kind=small}
