Loading page…
What a certification body will actually look for, organised by the clause it comes from — including the six items that most commonly produce a major non-conformity at Stage 2.
Information security managers, compliance leads and project sponsors preparing for a Stage 1 or Stage 2 certification audit against ISO/IEC 27001:2022.
Work through each section and mark each item as evidenced, partial or absent. An item is only 'evidenced' if you could produce the record today without preparing it. Anything marked partial or absent belongs in the remediation plan with an owner and a date.
This checklist covers the requirements a certification body examines. It is not a substitute for a gap assessment: scope decisions and Annex A applicability require judgement about your specific context that no checklist can make for you.
Stage 1 is largely an examination of whether the scope is coherent and defensible. A scope drawn to exclude an inconvenient part of the business is the single most common reason Stage 1 does not proceed.
Boundaries defined by location, business unit, service and technology — with exclusions justified rather than simply omitted. An auditor will test whether an excluded system supports an included service.
Clause 4.3
Regulators, customers, certification bodies, employees and suppliers, with the specific requirement each imposes. A list of parties without their requirements does not satisfy the clause.
Clause 4.2
The issues that affect the ISMS's ability to achieve its outcomes — including organisational change, regulatory change and technology dependency.
Clause 4.1
Where the scope meets systems, services or entities outside it, the interface and the control responsibility on each side are stated.
Clause 4.3
Auditors test leadership commitment by asking senior people direct questions. Evidence that exists only in documents fails this section.
Approved at the right level, available to those who need it, and communicated in a way you can evidence — not simply published to an intranet nobody visits.
Clause 5.2
Named individuals rather than job families, and the people named can describe their responsibility when asked. This is verified by interview.
Clause 5.3
Objectives with a measure, a target, an owner and a review point. 'Improve security posture' is not an objective a certification body will accept.
Clause 6.2
Evidence that the resourcing decision was made — budget, headcount or external support — not just that work happened.
Clause 7.1
The risk process is where most Stage 2 findings originate. Auditors test whether it was followed as documented, not whether it is sensible.
Impact and likelihood scales, risk acceptance criteria, and the method for producing consistent, comparable and valid results. The process must be repeatable by someone other than its author.
Clause 6.1.2
Each risk has a named owner who has accepted the risk and the treatment plan. Ownership assigned without acknowledgement is a common finding.
Clause 6.1.2
Treatment options selected, controls determined, and the plan approved by risk owners along with acceptance of residual risk.
Clause 6.1.3
All 93 Annex A controls addressed, each with a determination of applicability, a justification for inclusion or exclusion, and whether it is currently implemented. Exclusions with no justification are a reliable major non-conformity.
Clause 6.1.3 d)
Evidence of repetition, not a single assessment dated at project start. Also required when significant change occurs.
Clause 8.2
The 2022 revision restructured 93 controls into four themes. What changed materially is the attribute-based structure and eleven new controls — most implementations already did much of this, but under different names.
Policies, roles, supplier relationships, information classification, incident management, continuity and legal requirements. The largest theme and the one most often under-evidenced at the supplier-management end.
A.5
Screening, terms of employment, awareness and training, disciplinary process, post-employment responsibilities, and remote working.
A.6
Perimeters, entry, equipment, secure disposal and clear desk. Where operations are cloud-hosted or remote, applicability still needs a stated determination rather than a blanket exclusion.
A.7
Endpoint, access, cryptography, secure development, logging, monitoring and network security.
A.8
Threat intelligence, cloud service security, ICT readiness for continuity, physical security monitoring, configuration management, information deletion, data masking, data leakage prevention, monitoring activities, web filtering and secure coding.
A.5.7, A.5.23, A.5.30, A.7.4, A.8.9, A.8.10, A.8.11, A.8.12, A.8.16, A.8.23, A.8.28
This is where documented systems and operating systems diverge. Auditors sample records; a control that operated without producing a record cannot be evidenced.
Version, approval, distribution and retention managed. Documents of unclear currency are a routine minor finding.
Clause 7.5
Required competence identified per role, with training records, qualifications or experience evidencing it per person.
Clause 7.2
Evidence that planned processes were carried out as planned, and that outsourced processes are controlled.
Clause 8.1
What is monitored, by what method, when, by whom, and what the results were. The method must produce comparable and reproducible results.
Clause 9.1
These three are frequently attempted a fortnight before Stage 2. All three must have genuinely occurred, with records, before the certification audit.
An audit programme covering the whole ISMS, conducted by auditors who are objective and impartial with respect to what they audit, with results reported to management.
Clause 9.2
Including status of prior actions, changes in issues and interested parties, performance and monitoring results, audit results, risk assessment status, and opportunities for improvement — with decisions recorded as outputs.
Clause 9.3
Not just corrected. The clause requires evaluation of the need to eliminate the cause so it does not recur, and evidence of effectiveness review.
Clause 10.2
Closure supported by evidence the action worked, not by a status change. Actions closed on assertion is one of the most common findings at surveillance.
Clause 10.2
Next step
Send us what the assessment surfaced and we will give you a view on which items are genuine blockers, which matter less than they look, and what closing them realistically takes.