ZCybersecurity

Compliance › ISO 27001 › Checklist

ISO 27001 checklist

ISO 27001 checklist: 39 steps from first scope to certificate and beyond

A working checklist, not a blog list. Tick off 39 steps in six phases, each mapped to the clause it comes from and the evidence an auditor will ask for. It is free, needs no email and your progress stays in your browser.

Open the checklistTell Us What You Need

Free for buyers · provider-funded introductions · Updated October 2026

The checklist at a glance
Steps39 in six phases
StandardISO/IEC 27001:2022
Mapped toClauses 4 to 10 and the audits
You leadPhases 1 to 4 and the upkeep
Body leadsPhase 5, the certification audits
CostFree. No sign-up. Print or save as PDF
The short answer

What is on an ISO 27001 checklist?

An ISO 27001 checklist follows the standard in order: get leadership commitment and set the scope, assess risk and select controls, build and implement the ISMS, check it with an internal audit and a management review, pass the Stage 1 and Stage 2 audits, then maintain it through surveillance audits and recertification. Below are 39 steps in those six phases, each tagged with the clause that requires it.

  • Phases 1 to 4 are yours. The certification body only joins in phase 5.
  • The clause tags let you check any step against the standard. See our requirements guide for what each clause demands.
  • No duration or price is attached to any step, because both depend on your scope and readiness.
The plan

The ISO 27001 checklist in six phases

Work through the phases in order. Later phases depend on the evidence from earlier ones.

The ISO 27001 checklist in six phasesThe ISO 27001 checklist as six phases and 39 steps. Phase 1, Prepare: 6 steps, clauses 4 and 5, led by you. Phase 2, Assess risk: 9 steps, clause 6, led by you. Phase 3, Build and implement: 8 steps, clauses 6.3, 7 and 8, led by you. Phase 4, Check: 6 steps, clauses 8.2, 9 and 10, led by you. Phase 5, Certify: 5 steps, the Stage 1 and Stage 2 audits, led by the certification body. Phase 6, Maintain: 5 steps, clause 10 and the surveillance and recertification audits, shared.1Prepare6stepsClauses 4, 5You2Assessrisk9stepsClause 6You3Build andimplement8stepsClauses 6.3, 7, 8You4Check6stepsClauses 8.2, 9, 10You5Certify5stepsStage 1 and Stage 2Body leads6Maintain5stepsClause 10 and auditsBoth39 steps in six phases. Tick them off below; your progress is saved in this browser.
Six phases and 39 steps. Colour shows who leads each phase.
The checklist

ISO 27001 checklist: tick off all 39 steps

Tags show the clause a step comes from. Progress is saved in this browser only.

0 of 39 done

Phase 1: Prepare

0 of 6

Leadership, context and scope. Nothing else holds without these.

Evidence to have: Scope statement, approved policy, list of interested parties, named roles.

Phase 2: Assess risk

0 of 9

The risk work decides your control set.

Evidence to have: Risk assessment process and results, Statement of Applicability, treatment plan with owner approvals, objectives.

Phase 3: Build and implement

0 of 8

Put the controls, people and paperwork in place.

Evidence to have: Implemented controls, procedures, competence and training records, document control, supplier records.

Phase 4: Check

0 of 6

Prove the ISMS works before an outside auditor does.

Evidence to have: Monitoring results, internal audit programme and report, management review record, corrective action log.

Phase 5: Certify

0 of 5

The certification body leads. You bring the evidence.

Evidence to have: Audit plan, Stage 1 report and your responses, Stage 2 findings and closure evidence, the certificate.

Phase 6: Maintain

0 of 5

The certificate lasts only if the ISMS keeps running.

Evidence to have: Surveillance schedule, ongoing audit and review records, updated Statement of Applicability, recertification plan.

Before you book

Are you ready for the Stage 1 audit?

Seven quick questions. Any no is a reason to wait.

Readiness questions before an ISO 27001 Stage 1 audit
QuestionIf the answer is no
Is the scope written and approved by top management?Finish the scope statement under 4.3 first
Is the Statement of Applicability complete, with a reason for every decision?Complete it under 6.1.3 before booking audits
Are the risk results kept and the treatment plan approved by risk owners?Finish 6.1.2 and 6.1.3 so the audit has something to test
Has an internal audit been run and reported?Run it. Certification bodies generally expect one before the certification audit
Has a management review happened and been recorded?Hold it and keep the results under 9.3
Can staff show training or awareness records?Close the gap under 7.2 and 7.3
Is there a log of nonconformities and corrective actions?Start one under 10.2

Ask your certification body what it expects before Stage 1. The certification process guide explains both audits.

Avoid these

Five ways a checklist goes wrong

  • Ticking boxes without evidence: an auditor tests what happened, not what you ticked.
  • Starting with controls: pick controls from the risk work, not from a list. See the Annex A controls guide.
  • Leaving the check phase until last: the internal audit and management review find problems while they are cheap to fix.
  • Copying another company checklist: your scope and risks differ, so your steps will too.
  • Stopping at the certificate: surveillance audits arrive every year.
FAQ

ISO 27001 checklist: common questions

What should an ISO 27001 checklist include?
Leadership commitment, context and scope, a risk assessment and treatment plan, a Statement of Applicability, implemented controls, policies and training, an internal audit, a management review, the Stage 1 and Stage 2 certification audits, and a plan for surveillance audits and recertification.
How many steps are in an ISO 27001 checklist?
There is no official number. Our checklist has 39 steps in six phases. Other guides group the same work into a smaller number of broader steps, commonly 13 to 17.
Is there an official ISO 27001 checklist?
No. The standard gives requirements in clauses 4 to 10 and a list of controls in Annex A. Any checklist, including this one, is a reading aid built from them.
What is the first step in ISO 27001 implementation?
Get top management commitment, name an owner and define the scope of the ISMS. Everything else depends on a scope you can defend.
What documents does ISO 27001 require?
The clauses name specific documented information, including the scope, policy, risk assessment and treatment process, Statement of Applicability, objectives and several records. See the requirements guide for the full list.
Do I have to implement all 93 Annex A controls?
No. You select controls through your risk assessment and record each decision in the Statement of Applicability. See the Annex A controls guide.
Do I need an internal audit before certification?
Clause 9.2 requires internal audits at planned intervals, and certification bodies generally expect one to have been done before the certification audit. Ask yours what it expects.
How long does it take to finish the checklist?
There is no fixed time. It depends on your scope, how mature your controls already are, how much time your owner has and when the certification body can schedule audits.
What happens after I finish the checklist?
The certification body runs the Stage 1 and Stage 2 audits and issues the certificate, followed by annual surveillance audits and recertification. See the certification process guide.
Is the checklist free, and is my progress stored by you?
It is free with no sign-up. Progress is saved only in your own browser. It is not sent to us, and clearing your browser data removes it.
Can a consultant complete the checklist for me?
A consultant can help with design and preparation, but your organisation stays accountable for running the ISMS. See the ISO 27001 consultants page.
Does this checklist work for SOC 2?
No. SOC 2 uses different criteria. See our SOC 2 readiness checklist.
Start here

Checklist done? Now get matched with the right provider.

Requirement→Scope→Price→Matched provider
Tell Us What You Need

Free for buyers · provider-funded introductions · Reviewed October 2026 by the ZCyberSecurity compliance team

Scroll to Top