Checklist
ISO 27001 Checklist: What an Auditor Checks, Clause by Clause
SecureRoot Risk Advisory LLP's checklist for ISO/IEC 27001:2022: clauses 4 to 10 with the evidence an auditor samples, the mandatory documents, the 93 Annex A controls and what each audit stage needs. All on this page, no form.
What an ISO 27001 checklist is for, and what it cannot do
In short: An ISO 27001 checklist is a list of what ISO/IEC 27001:2022 requires and the evidence that proves each item. It has two parts. Clauses 4 to 10 are the management system itself: every one applies and none can be excluded. Annex A lists 93 controls, which you select by risk and record in a Statement of Applicability. A completed checklist measures how ready you are. It does not certify you: only a certification body issues a certificate, after its own audit, so choose one accredited for ISO/IEC 27001.
SecureRoot is not an accredited ISO certification body; certificates come from the certification body. Costs are in ISO 27001 certification cost in India; durations are in the ISO 27001 certification timeline.
Before you start
Settle the version, the scope and the certification body first
- Work to the 2022 edition, with its 2024 amendment
- Amendment 1 of 2024 asks you, under 4.1, to decide whether climate change is a relevant issue, and notes under 4.2 that interested parties can have climate requirements. Record the decision either way.
- Treat the 2013 edition as closed
- The transition set by IAF MD 26 ended on 31 October 2025, when 2013 certificates expired or were withdrawn. A checklist built on the old 114-control Annex A is out of date.
- Choose an accredited certification body
- In India, NABCB accredits ISMS certification bodies and is a signatory to the international recognition arrangement, the IAF MLA until 2026 and now run by the Global Accreditation Cooperation. Confirm that ISO/IEC 27001 is inside the body's accredited scope, not just that it is accredited for something.
- Write the scope statement first
- Clause 4.3 sets the boundary every later line is measured against: the locations, teams, systems and services inside it, and where you depend on others.
Check a body’s accredited scope in the accreditor’s directory, and an issued certificate on IAF CertSearch or with the issuing body.
Clauses 4 to 10
What are the clauses of ISO 27001? The mandatory checklist, with the evidence behind each
| Clause | What the auditor asks | Evidence they usually sample |
|---|---|---|
| 4.1 Context | Which issues affect the ISMS, climate change included. | An issues register with a recorded climate decision. |
| 4.2 Interested parties | Who has a stake in your security, what they require, and which requirements the ISMS addresses. | A register of laws, regulators and contract terms. |
| 4.3 and 4.4 Scope and the ISMS | Where the boundary sits and why, and how the processes connect. | The scope statement and a process map. |
| 5.1 and 5.3 Leadership and roles | Whether top management directs the ISMS, and who answers for it. | Approvals, budget decisions, a roles list. |
| 5.2 Policy | A policy fit for your purpose, committing to requirements and improvement. | The approved policy and proof it reached staff. |
| 6.1.2 Risk assessment | A method with acceptance criteria that gives comparable results and names risk owners. | The methodology, the criteria and the risk register. |
| 6.1.3 Risk treatment | Treatment choices, needed controls checked against Annex A, the SoA, a plan, owners' sign-off. | The SoA, the treatment plan, residual-risk acceptance. |
| 6.2 and 6.3 Objectives and changes | Measurable objectives with owners; ISMS changes made in a planned way (6.3, new in 2022). | An objectives tracker; approved ISMS change records. |
| 7.1, 7.3 and 7.4 Resources, awareness, communication | Whether the ISMS is resourced, staff know their part, and communication is planned. | Budget, training completion, a communication plan. |
| 7.2 Competence | The competence each security role needs, and action where it fell short. | Training records, certificates, a competence matrix. |
| 7.5 Documented information | Whether documents are approved, versioned, protected and available where needed. | A document register and version history. |
| 8.1 to 8.3 Operation | Processes run to criteria, outsourced ones included; risk work repeats after major change. | Change tickets, supplier reviews, dated risk results. |
| 9.1 Monitoring and measurement | What is measured, how, when, and who evaluates it. | Metrics and dated reports. |
| 9.2 Internal audit | A programme covering the whole ISMS, objective auditors, results reported. | Programme, audit plans, reports. |
| 9.3 Management review | Planned reviews by top management, with set inputs and recorded decisions. | Minutes with inputs, decisions and actions. |
| 10.1 and 10.2 Improvement | Nonconformities fixed at the root and checked; the ISMS improving. | A nonconformity log with causes and effectiveness checks. |
Clause numbers and titles follow ISO/IEC 27001:2022 with Amendment 1:2024; the requirements are paraphrased. The evidence column is common audit practice, not text of the standard.
Documented information
What documents does ISO 27001 require?
| Document or record | Clause |
|---|---|
| Scope of the ISMS | 4.3 |
| Information security policy | 5.2 |
| Risk assessment process | 6.1.2 |
| Risk treatment process | 6.1.3 |
| Statement of Applicability | 6.1.3 d) |
| Information security objectives | 6.2 |
| Evidence of competence | 7.2 |
| Documents the organisation decides the ISMS needs | 7.5.1 b) |
| Records showing processes ran as planned | 8.1 |
| Results of risk assessments | 8.2 |
| Results of risk treatment | 8.3 |
| Monitoring and measurement results | 9.1 |
| Audit programme and audit results | 9.2.2 |
| Management review results | 9.3.3 |
| Nonconformities, actions taken and corrective action results | 10.2 |
The risk treatment plan required by 6.1.3 e) is normally kept with these records.
Annex A documents are conditional
Some controls expect something written, such as an asset inventory (5.9), documented legal requirements (5.31) or operating procedures (5.37). You need them only where your Statement of Applicability applies the control.
Annex A
How many controls are in ISO 27001:2022, and how do you work through them?
Annex A of the 2022 edition has 93 controls in four themes, down from 114 in 2013. Do not work through them in order. Start from the risk register: name the controls each treated risk needs, then compare the list with Annex A to catch omissions. Every control ends up in the Statement of Applicability with a decision and a reason.
Test reports usually land under 8.8, management of technical vulnerabilities, and 8.29, security testing in development and acceptance. How an auditor reads a test report is covered in ISO 27001 penetration testing.
Annex A
The four themes of Annex A
| Theme | Controls | Evidence an auditor typically sees |
|---|---|---|
| Organisational (5.1 to 5.37) | 37 | Policies, asset inventory, supplier agreements, incident records, legal register. |
| People (6.1 to 6.8) | 8 | Screening, signed terms and NDAs, awareness training. |
| Physical (7.1 to 7.14) | 14 | Entry records, maintenance, secure disposal. Firms without premises may exclude several. |
| Technological (8.1 to 8.34) | 34 | Access reviews, logs, restore tests, vulnerability scans, change tickets, test reports. |
93 controls in all. You must consider every one; you implement the ones your risk treatment needs.
New in 2022
The eleven new controls, and what proves each
| Control | Title | Evidence that usually satisfies it |
|---|---|---|
| 5.7 | Threat intelligence | The advisories you follow, CERT-In's among them, and a record of acting on one. |
| 5.23 | Information security for use of cloud services | A cloud services register, responsibility splits and exit terms. |
| 5.30 | ICT readiness for business continuity | Recovery objectives for ICT and a recovery test with results. |
| 7.4 | Physical security monitoring | Camera or alarm coverage and review records. |
| 8.9 | Configuration management | Hardening baselines and a check for drift. |
| 8.10 | Information deletion | Retention rules and deletion records, suppliers included. |
| 8.11 | Data masking | Where masking applies, and how test data is handled. |
| 8.12 | Data leakage prevention | Controls on the channels data leaves by, and alert handling. |
| 8.16 | Monitoring activities | Monitoring for anomalous behaviour, with alerts triaged. |
| 8.23 | Web filtering | Rules for risky sites and how they are enforced. |
| 8.28 | Secure coding | A coding standard, review records and static analysis results. |
The SoA
The Statement of Applicability checklist
Clause 6.1.3 d) fixes the first four columns below; auditors use the other three to trace a control to its risk and its evidence. What the SoA is, and where it comes from, is on our ISO 27001 certification services page.
- Every Annex A control, plus any control you added from another source.
- Whether it is needed, and the reason it is included: the risk, law or contract it answers.
- Whether it is implemented yet.
- For each excluded control, the reason it is excluded.
- The risk register and treatment plan entries it serves.
- Where the evidence lives, and who owns it.
- The version, the approver and the date.
Three ways an SoA fails an audit
- Controls marked implemented that nobody can evidence when the auditor asks.
- Exclusions with no reason, or a reason the risk register or a customer contract contradicts.
- An SoA approved once and never revised after the scope, systems or suppliers changed.
Clause 9.2
What is checked in an ISO 27001 internal audit?
The certification auditor audits your internal audit. These are the points they test, and the points your own audit should cover.
- A programme covering every clause and applicable control over the cycle, more often where risk or past findings call for it.
- Criteria and scope written for each audit before it starts.
- Auditors who do not audit their own work. An outside auditor is one option, not a requirement.
- Working papers showing what was sampled, and from when.
- A report to the management responsible for the area audited.
- Each finding logged as a nonconformity under 10.2, with a root cause, a correction and a later check that it worked.
- Results carried into the management review, with objectives, risk status and earlier actions.
Audit readiness
Stage 1 and Stage 2: what to have ready for each
Stage 1 asks whether the system exists. Stage 2 asks whether it has run. ISO/IEC 27001 sets no minimum operating period before Stage 2; your certification body judges whether there is enough record, so ask it what it expects.
Stage 1: documents in place
- Scope statement, policy and objectives, approved.
- Risk method, risk register, treatment plan and SoA, consistent with one another.
- Procedures the SoA relies on, and the requirements register behind clause 4.2.
- Competence records for the roles that matter.
- A completed internal audit report and management review minutes.
Stage 2: controls operating, with records
- Access reviews done on schedule, with the changes they triggered.
- Logs reviewed and alerts handled, with tickets to show it.
- Awareness training completed by the people in scope.
- Supplier reviews done; scan findings tracked to closure.
- Backups restored in a test, not only taken.
- Changes through change control; incidents handled by the procedure.
- Corrective actions from the internal audit and Stage 1 closed.
- Control owners able to explain their part in an interview.
India
The India items to add to your checklist
An Indian ISMS has legal requirements to list under clause 4.2. SecureRoot is not CERT-In empanelled; where a regulator or tender needs an empanelled auditor’s signature, that auditor signs. If your customers ask about privacy management rather than security, see ISO 27701.
India
Indian requirements, and where each lands in the ISMS
| Requirement | Source | Where it lands |
|---|---|---|
| Report listed cyber incidents to CERT-In within 6 hours of noticing them | CERT-In Directions of 28 April 2022, direction (ii) | 4.2; 5.5 contact with authorities; 5.24 to 5.26 incident management |
| Keep logs of all ICT systems securely for a rolling 180 days, within India | Same Directions, direction (iv) | 8.15 logging; 5.31 legal and regulatory requirements |
| Synchronise clocks to NIC or NPL time servers, or traceable sources | Same Directions, direction (i) | 8.17 clock synchronisation |
| Name a point of contact for CERT-In | Same Directions, direction (iii) | 5.2 roles and responsibilities; 5.5 |
| Protect personal data with reasonable security safeguards to prevent a breach | DPDP Act, 2023, section 8(5); DPDP Rules, 2025, rule 6 (applies from 13 May 2027) | 4.2; 5.34 privacy and protection of PII; the risk assessment |
| Your sector regulator's cyber security directions, where you are regulated | The regulator's own circular or master direction | 4.2; 5.31; the SoA's reasons for inclusion |
ISO 27001 names no Indian law; clause 4.2 makes you list the ones that bind you.
How SecureRoot helps
Have us run this checklist against your scope
We start with a gap assessment against every clause and all 93 Annex A controls, and you receive a gap assessment report, a Statement of Applicability, a risk treatment plan, an ISMS policy set and support through both audit stages, as listed on our ISO 27001 service page. SecureRoot is not an accredited ISO certification body; your certification body issues the certificate. If a customer has asked for SOC 2 as well, read ISO 27001 vs SOC 2 first. SecureRoot is not a CPA firm and does not issue SOC 2 reports.
Questions
What teams ask about the ISO 27001 checklist
Is ISO 27001 mandatory in India?
No general Indian law makes ISO 27001 certification compulsory for a private company. The pressure usually comes from contracts: an enterprise customer's security questionnaire, a vendor onboarding policy or a tender that lists it as a qualification. Where a regulator or tender asks for it, read that clause itself. The laws that do bind you, such as the CERT-In Directions of 28 April 2022, and from 13 May 2027 section 8(5) of the DPDP Act, 2023 with rule 6 of the DPDP Rules, ask for outcomes rather than a certificate: reporting incidents within six hours, keeping logs, and taking reasonable security safeguards. An ISMS is a sound way to organise those duties, because clause 4.2 makes you list them and Annex A gives each one a control to evidence. The certificate then shows a customer that an accredited body has checked the whole arrangement.
Can we exclude Annex A controls?
Yes, provided each exclusion survives the justification test. Clause 6.1.3 asks you to compare the controls your risk treatment needs with Annex A, so that nothing necessary is missed, and to record in the Statement of Applicability why each excluded control is excluded. A good reason points at something the auditor can check: no premises of your own, so some physical controls sit with the landlord or the data centre; no in-house development, so secure coding is governed through the supplier controls instead. A weak reason says only that the control is not applicable, or contradicts your own risk register, interested-party list or customer contracts. What you cannot exclude are clauses 4 to 10, because they are the management system itself and a certificate claims conformity with all of them. Exclusions also move with the business, so revisit them whenever you add an office, a product or a supplier.
If we complete this checklist, will we be certified?
Not on the strength of the checklist, and nobody can promise you a certificate. Only a certification body issues one, after its Stage 1 review and Stage 2 audit, and its auditors decide on what they sample. A completed checklist tells you whether each requirement has an owner and a record. It cannot tell you whether the record is good enough, whether the control actually operates, or whether the people who run it can explain it in an interview, which is where many findings start. A major nonconformity has to be closed before the certificate issues. Use the checklist as a readiness measure instead: mark every line as missing, documented, or operating with a record, and spend your effort on the first two. SecureRoot Risk Advisory LLP is not an accredited ISO certification body; certificates come from the certification body you appoint, under its own accreditation.
Is an ISO 27001:2013 certificate still valid?
Not any more. IAF MD 26, the International Accreditation Forum's mandatory document for this transition, gave certified organisations until 31 October 2025 to move to ISO/IEC 27001:2022, and says certificates against the 2013 edition expire or are withdrawn when the transition period ends. A supplier showing you a 2013 certificate today is showing you one that is no longer current, so ask for the 2022 certificate or a written status from the issuing body. The same applies to checklists and templates. A list still organised around the 2013 Annex A, with its 114 controls in 14 groups, misses the four themes, the eleven new controls and clause 6.3 on planning changes. When you check a certificate, look it up on IAF CertSearch or with the issuing body, and confirm the body was accredited for ISO/IEC 27001 by an IAF signatory such as NABCB.
Does a checklist replace a gap assessment?
It does part of the job. A checklist tells you what the standard asks for. A gap assessment tells you, for your scope, which items are missing, which exist only on paper and which operate with a record, and ranks the gaps by effort and risk. The difference is judgement on evidence: whether your risk method gives consistent results, whether an exclusion would survive an auditor, whether an access review really covered every system in scope. Teams that self-score against a checklist first usually get a shorter, sharper gap assessment. SecureRoot Risk Advisory LLP runs gap assessments against every clause from 4 to 10 and all 93 Annex A controls, interviews control owners and samples evidence the way a certification auditor would, then hands over a written report with the gaps ranked. We prepare you for the audit; we do not issue the certificate. Request an assessment below to have this checklist run against your scope.
Primary Sources
Where the Figures on This Page Come From
Every deadline, threshold and control count above is taken from the instrument itself. These are links to the primary text, not to a summary of it.
- ISO/IEC 27001:2022 - Information security management systems (catalogue entry)
International Organization for Standardization · Link checked 2026-10-16
- IAF/ISO Joint Communiqué on the addition of climate change considerations to management system standards, 22 February 2024 (lists ISO/IEC 27001:2022)
International Organization for Standardization and International Accreditation Forum · Link checked 2026-11-10
- IAF MD 26:2023, Transition Requirements for ISO/IEC 27001:2022 (Issue 2)
International Accreditation Forum · Link checked 2026-11-10
- Accreditation Criteria for Information Security Management Systems Certification, BCB 125 (Jan 2026)
National Accreditation Board for Certification Bodies (NABCB) · Link checked 2026-11-10
- Digital Personal Data Protection Rules, 2025: rule 6 and its commencement
Ministry of Electronics and Information Technology, Gazette of India · Link checked 2026-11-10
- IAF CertSearch: verify an accredited management system certificate
International Accreditation Forum · Link checked 2026-11-10
- Directions under section 70B(6) of the IT Act, 2000, No. 20(3)/2022-CERT-In, 28 April 2022
Indian Computer Emergency Response Team (CERT-In), MeitY · Link checked 2026-11-10
- The Digital Personal Data Protection Act, 2023 (No. 22 of 2023), section 8(5)
Gazette of India · Link checked 2026-11-10
Mark each line missing, documented or operating, then send us the result
Bring your scope and your customer’s date. You get a written scope, a fixed price for the gap assessment, and a straight answer on which lines take longest to close.