Toolkit
ISO/IEC 27001 readiness cheat sheet
A one-page summary to work from, not a substitute for the full guide or the official text.
Saves a one-page PDF straight to your device. It is put together by your browser, on this page — nothing is uploaded.
Who it's for. Any organisation building or certifying an information security management system (ISMS) — most often SaaS and technology vendors, and outsourced or managed-service providers answering customer security questionnaires.
Scope
- Voluntary and international; certified by accredited bodies, not by ISO itself
- Applies to whatever the organisation sets as its ISMS scope (Clause 4.3) — one product, one site, or the whole company
- A certificate only covers what's inside that scope statement, so always check it before relying on someone else's certificate
Key requirements
- Define the ISMS scope and secure top-management commitment (Clauses 4–5)
- Run a repeatable risk assessment and treatment process that produces comparable results (Clause 6.1)
- Produce a Statement of Applicability covering all 93 Annex A controls, each included or excluded with a reason
- Set measurable security objectives and keep evidence of staff competence and awareness (Clause 7)
- Operate the ISMS long enough to generate real records, not paperwork written just before the audit (Clause 8)
- Run internal audits and a management review on a planned schedule (Clause 9)
- Track nonconformities through to corrective action (Clause 10)
Evidence to gather
- ISMS scope statement and information security policy
- Risk assessment, treatment plan and Statement of Applicability
- Security objectives and the records of monitoring them
- Internal audit reports and management review minutes
- Competence and awareness records
- Nonconformity and corrective-action log
Common gaps
- Treating Annex A as a checklist rather than a risk-based selection
- Scope set too narrow for what customers actually ask about in due diligence
- Policies with no operating records behind them — this is what fails a Stage 2 audit
- Internal audit and management review run as a formality rather than a real check
This is general educational information, condensed by MajorCyber™ in its own words, not legal, audit or certification advice, and not a compliance assessment, certification or attestation of any kind. It is a starting checklist, not a complete statement of the framework's requirements — confirm anything material against the full ISO/IEC 27001 guide, the official text, or a qualified adviser.