ISO 27001 Checklist: Step-by-Step Guide

…

If you’re preparing your organization for ISO 27001 certification, you may be working from an outdated roadmap.

ISO/IEC 27001:2013 certificates expired on October 31, 2025. The current standard is ISO/IEC 27001:2022, and it’s not a minor update. It reorganizes Annex A from 114 controls to 93, introduces 11 new controls, and includes Amendment 1:2024, which adds climate-related requirements to clauses 4.1 and 4.2. If your information security management system (ISMS) was scoped and documented against the 2013 edition, parts of it need revisiting before your next audit.

This ISO 27001 checklist covers 12 concrete steps — from reading the standard to maintaining your certificate through surveillance audits. It’s written for General Counsels, Legal Operations leads, Corporate Secretaries, and compliance teams who need a clear picture of what the process actually involves.

The ISO 27001 Checklist: 12 Steps to Certification

Getting certified isn’t a quick project. For most organizations, it takes 6 to 12 months. But the path is well-defined, and knowing what’s ahead makes the difference between a structured program and a chaotic race to the audit date.

Step 1: Read the Standard

This sounds obvious. Many organizations skip it anyway, especially when they’re relying on a consultant who says “we’ll handle the documentation.” Don’t.

The ISO/IEC 27001:2022 standard has two main parts. The main body (clauses 4–10) defines the mandatory requirements for your ISMS:

• Clause 4: Context of the organization
• Clause 5: Leadership
• Clause 6: Planning (risk assessment and treatment)
• Clause 7: Support (resources, awareness, documentation)
• Clause 8: Operation
• Clause 9: Performance evaluation
• Clause 10: Improvement

Annex A contains 93 controls organized across 4 themes: Organizational (37), People (8), Physical (14), and Technological (34). These are the security measures your ISMS must address, justify, or formally exclude in your Statement of Applicability (SoA).

If your team is still referencing 2013 edition gap analysis templates or the old 14-domain control structure, discard them. The 2022 restructuring doesn’t map cleanly to what came before, and using outdated templates creates gaps you won’t catch until the audit.

One more important update: Amendment 1:2024 added climate-change considerations to clauses 4.1 and 4.2, requiring organizations to consider whether climate change is a relevant external or internal issue. If your documentation predates this amendment, it needs a review.

You can purchase the current standard directly from ISO.org or your national standards body.

Step 2: Talk to People Who’ve Already Done It

Don’t underestimate the value of a 30-minute conversation with a peer who completed this process 12 months ago. Ask the questions that don’t appear in the standard: how long did the internal audit really take? Which controls caused the most friction with employees? What surprised them on audit day?

Good places to find those people: LinkedIn groups focused on ISO 27001 or information security management, professional associations like ISACA or IAPP, and your own sector network. If you’re in legal or compliance, someone in your industry has probably been through this in the last 18 months.

Come with specific questions, real timelines, documentation bottlenecks, the biggest internal obstacles, and what they’d do differently. A conversation like that is often worth more than a paid consultation.

Step 3: Hire a Consultant (Optional)

Whether you need an external consultant depends on your internal resources. If your team has no prior experience building an ISMS from scratch, a consultant can accelerate the process significantly — particularly for the initial gap analysis, documentation framework, and audit preparation.

What a good consultant actually does:

• Runs a structured gap analysis against the Annex A controls
• Helps define the scope and formally document exclusions
• Builds or reviews your mandatory documentation set
• Prepares your team for the Stage 1 and Stage 2 audits

What a consultant doesn’t do: manage your organization’s security for you. The ISMS must be owned internally. If your consultant is producing documents that your team can’t explain to an auditor, that’s a structural problem.

If your team is experienced and well-resourced, going in-house is entirely viable. Many mid-size organizations certify without external help. The risk is underestimating the documentation burden.

Step 4: Choose an Accredited Certification Body

This step is frequently confused with Step 3. A consultant helps you prepare; a certification body conducts the actual audit and issues the certificate. These are different organizations, and you cannot use the same firm for both.

For an ISO 27001 certificate to carry international recognition, the certification body must be accredited under the International Accreditation Forum (IAF) Multilateral Recognition Arrangement (MLA). In the US, bodies accredited by ANAB or A2LA meet this requirement. In France, AFNOR. In the UK, UKAS.

Check accreditation status before signing anything. A certificate from a non-accredited body carries no weight in customer audits, contract negotiations, or RFP responses. Verify through the IAF’s publicly accessible database.

Step 5: Clearly Define Who Owns the Project Internally

“Alone we go faster, together we go further.” This African proverb captures something real about ISO 27001: security is a team effort, but without clear ownership, it becomes nobody’s job. Define accountability before the program starts.

At a minimum, you need:

• An ISMS Manager (often the CISO, IT Security Lead, or a dedicated project owner) who is accountable for implementation, documentation, and audit readiness
• An executive sponsor who can unblock resources, approve policy, and escalate when departments don’t cooperate
• A cross-functional working group that includes IT, Legal, HR, and Operations, because the controls touch all of them

Adequate resources means dedicated time, not a side project. Organizations that try to certify while everyone does it “alongside” regular work almost always run over timeline and budget.

Step 6: Take Inventory and Run a Gap Analysis Against the Annex A Controls

Before you can design your ISMS, you need to know what you’re working with. Start with a complete inventory of your information assets: systems, data stores, devices, applications, and third-party connections.

Then run a gap analysis against the 93 Annex A controls. For each one, ask: does a corresponding security measure exist? Is it documented? Is it operating effectively?

Your asset inventory should cover:

• Hardware and software (including shadow IT and unmanaged devices)
• Data classification: what’s confidential, restricted, or public
• Third-party and vendor access to your systems
• Cloud assets and SaaS applications, including data residency
• Physical access controls to facilities and equipment

The output is a gap register: a documented list of controls where you have partial or no coverage. That register feeds directly into Step 7.

Step 7: Build Your Risk Treatment Plan

A risk treatment plan is a mandatory deliverable under clause 6.1.3 of ISO/IEC 27001:2022, and it’s missing from many organizations’ first attempts.

The risk treatment plan documents, for each identified risk: which treatment option you’ve chosen (mitigate, transfer, accept, or avoid), which control addresses it, who is responsible for implementation, and the target completion date.

Step 6 tells you what’s missing. Step 7 tells you what you’re going to do about it, by whom, and by when. Auditors will review this document. Make sure it reflects your actual security decisions, not a template you downloaded and never updated.

Step 8: Prepare Leadership for Communication

Management has specific obligations under ISO 27001. Clause 5 requires top management to demonstrate leadership and commitment to the ISMS, and that means more than signing a policy document once a year.

Leadership needs to be prepared to communicate:

• The organization’s information security policy
• Security objectives and how they’re measured
• Roles and responsibilities across the business

Brief senior leadership early. Don’t wait until the audit is two months away to discover that your COO doesn’t know what the scope covers, or that your executive sponsor has never reviewed the risk treatment plan. These conversations belong at the start of the program, not the end.

Step 9: Get the Whole Company Involved in Security Awareness

You can have technically excellent controls and still fail an audit because employees don’t follow them. Clause 7.3 requires that all relevant personnel understand the information security policy, their role in the ISMS, and the consequences of non-conformity.

In practice, this means:

• Security awareness training during onboarding
• Annual refresher training for all staff
• Role-specific training for high-risk functions (IT, finance, legal, procurement)
• Phishing simulation exercises
• Clear reporting channels for suspected security incidents

Document everything. Auditors will ask for training completion records, policy acknowledgment logs, and evidence that your program is active, not a one-time slide deck from two years ago.

Step 10: Complete Your Internal Audit

Before going to an external audit, you need to run an internal audit of your ISMS. This is a mandatory requirement under clause 9.2, and one of the most commonly skipped steps in a first ISO 27001 implementation.

The internal audit checks whether your ISMS conforms to the standard’s requirements and whether it’s operating as designed. It should be conducted by someone independent of the areas being audited. Many organizations use a qualified internal auditor or bring in an external consultant specifically for this step.

Common findings at this stage:

• Controls that exist in policy but aren’t applied in practice
• Documentation gaps (missing risk assessment evidence, unsigned policies, incomplete SoA)
• Controls listed in the SoA but with no corresponding implementation evidence

Fix these before the Stage 1 external audit. Auditors won’t penalize you for finding gaps internally. That’s exactly what the internal audit is for. They will penalize you if those same gaps appear uncorrected during the external review.

Step 11: Never Take Certification for Granted

Achieving the certificate is not the finish line. Once you hold it, you enter a 3-year cycle:

• Year 1: Surveillance audit
• Year 2: Surveillance audit
• Year 3: Recertification (full re-audit)

The ISMS must be maintained and continuously improved throughout. Controls need to stay effective as your technology, organization, and threat landscape change.

Amendment 1:2024 is a concrete example of why this matters. It added climate-change-related requirements to clauses 4.1 and 4.2, requiring organizations to consider whether climate change is a relevant external or internal issue. Organizations that certified under the base 2022 standard and haven’t reviewed their documentation since may already have a gap they don’t know about.

The standard evolves. Your ISMS has to keep up.

Why Pursue ISO 27001 Certification?

If you’re weighing whether the investment is worth it, here’s an honest breakdown.

ISO 27001 certification delivers real business value:

• Customer and partner trust: It’s increasingly a procurement requirement. Enterprise clients and regulated-sector customers regularly ask vendors to demonstrate certification during RFPs, especially in financial services, healthcare, and the public sector.
• Regulatory alignment: ISO 27001 overlaps significantly with GDPR data protection obligations and supports compliance with NIS2 for organizations in scope.
• Reduced incident exposure: Organizations with a functioning ISMS tend to detect incidents faster and respond more effectively, because it forces documented, tested, and reviewed processes.
• Competitive differentiation: If your competitors aren’t certified and you are, that matters in deals where security is a buying criterion.

For organizations that handle sensitive legal, financial, or personal data, certification has shifted from a “nice to have” to a practical requirement in most enterprise sales cycles.

Common Challenges When Preparing for ISO 27001

Knowing the 12 steps doesn’t mean the process runs smoothly. These are the obstacles that slow most organizations down.

• Resource constraints: Certification requires real time from real people. Most delays come from underestimating the hours needed for documentation, gap analysis, and awareness training, not from the standard being too complex. Treat it as a dedicated project, not a background task.
• Employee buy-in: Security controls only work if people follow them. Getting HR, Finance, and Operations to change habits — password policies, clean desk rules, incident reporting — requires sustained effort and clear accountability, not a one-time email from IT.
• Documentation burden: The mandatory documentation requirements are extensive. Missing or incomplete records — risk assessment evidence, the SoA, internal audit reports, management review minutes — are among the most common reasons organizations fail their Stage 1 audit. Start documentation early.
• Scope creep: Define the ISMS scope tightly at the outset. Organizations that try to certify their entire enterprise in a single pass often run out of time and budget. A tighter scope — a specific product, service line, or data environment — is more achievable and still credible to customers.

How Long Does ISO 27001 Certification Take, and What Does It Cost?

Most organizations take 6 to 12 months from kickoff to certificate. Smaller organizations with limited scope can sometimes certify faster. Large enterprises with complex environments often take longer.

What drives your timeline:

• The size and complexity of your scope
• Whether you have existing security controls and documentation to build on
• Internal resource availability and competing priorities
• How quickly documentation is produced, reviewed, and approved

Typical cost components:

Cost component	Notes
Certification body fees	Stage 1 audit, Stage 2 audit, annual surveillance fees (varies by scope and organization size)
Consultant fees	Gap analysis, documentation support, audit prep (optional but common for first-time implementations)
Internal staff time	Often the largest cost; estimate hours across project management, documentation, training, and audit support
Technology	Tools for risk management, document control, or policy tracking (optional but can save significant time)

Published fee benchmarks vary widely depending on scope, organization size, and geography. Get quotes from at least 2–3 IAF-accredited bodies before committing.

DiliTrust holds ISO 27001 and ISO 27701 certifications and is SOC 2 Type 2 compliant. If you’re evaluating software vendors as part of your ISMS supplier assessment, that’s one line of the checklist you can confirm immediately.

See Our Security Standards →

Frequently Asked Questions

ISO 27001 Certification: The Bottom Line

Certification is a program, that requires a clear project owner, documented processes, trained staff, and a commitment to continuous improvement across a 3-year cycle.

Start by identifying who in your organization owns this. Assign real time, not good intentions. Define your scope tightly. Then work through the 12 steps in this ISO 27001 checklist in order, each one builds on the last.

The certificate matters, particularly for customer trust and regulatory positioning. But so does what you build to get there: an information security management system that actually reduces risk, not just one that passes an audit on a given day.

For a broader look at how cyber risk connects to organizational resilience, our guide to cyber resilience vs. cybersecurity covers the distinctions legal and compliance teams need to understand. And if you want to see how DiliTrust approaches data security — including our own certifications — visit our security documentation page.