ISO/IEC 27001 readiness · ISO/IEC 27001:2022
Is your ISMS ready for ISO/IEC 27001:2022 certification?
63 requirements paraphrasing ISO/IEC 27001:2022: the management-system clauses 4-10 (context, leadership, risk assessment and treatment, Statement of Applicability, objectives, support, operation, performance evaluation, improvement) and all 93 Annex A controls grouped by theme (organizational, people, physical, technological). Each requirement states what an auditor checks, the evidence expected and the audit stage (Stage 1 documentation review or Stage 2 implementation audit). You get readiness percentages by clause and control theme, prioritised gaps, guidance, a certification roadmap and a PDF report that doubles as a gap analysis for the project plan. No legal content: the assessment is about the standard itself; the NIS2, DORA and GDPR assessments of this hub cover the regulations.
No data from this assessment is transmitted to GoToCertify.
How it works
- Profile: a few facts and yes/no questions exclude non-applicable requirements.
- Assessment: a 0-4 maturity level per requirement, with evidence and notes.
- Dashboard: compliance % by area, by source and by control group; P1/P2 gaps.
- PDF report: results, prioritised action plan with guidance, control map, roadmap.
63 requirements · 15 assessment areas · clauses and controls of ISO 27001 · 60-120 minutes
ISO/IEC 27001:2022 requirementsClauses 4-10 are mandatory for every ISMS and are where Stage 1 findings concentrate: scope, policy, risk method, SoA, objectives, documented information, internal audit and management review. Annex A lists the 93 reference controls; the SoA justifies which apply.
Annex A controls and ISO/IEC 27002 guidanceThe 93 controls in four themes are assessed with the implementation guidance of ISO/IEC 27002:2022, with special attention to the 11 controls introduced in 2022 (threat intelligence, cloud services, ICT readiness, physical monitoring, configuration, deletion, masking, DLP, monitoring, web filtering, secure coding).
Prepare your teamAuditors interview the people who run the ISMS. GoToCertify offers exam preparation for PECB Certified ISO/IEC 27001 Lead Implementer (for those building and running the ISMS) and Lead Auditor (for internal auditors and supplier audits), plus a free Foundation sample test; the report's gaps show who needs which competence.
Assessment areas
- CTX – Context, interested parties and scope
Clause 4 asks for a documented understanding of the internal and external issues that affect the ISMS, the interested parties and their requirements (customers, regulators, laws such as GDPR or NIS2, contracts) and a precise scope statement with interfaces and dependencies. Auditors start here: an unclear scope or missing legal requirements analysis is a frequent Stage 1 finding. - LDR – Leadership, policy and roles
Clause 5 requires top management to own the ISMS: an approved information security policy, objectives aligned with business strategy, resources, communication of the importance of security and assigned roles with authority to report on ISMS performance. Evidence is tested through interviews with top management, not only documents. - RSK – Risk assessment and risk treatment
Clauses 6.1.2 and 6.1.3 are the engine of the ISMS: a repeatable method with criteria, risk owners, identification, analysis and evaluation, a treatment plan, the selection of controls, the comparison with Annex A and a Statement of Applicability (SoA) with justifications for inclusions and exclusions, and risk owners' approval of residual risk. Most major nonconformities at Stage 2 trace back to a risk assessment that is not linked to the controls actually implemented. - OBJ – Objectives, planning of changes and operation
Clauses 6.2, 6.3 and 8 require measurable security objectives with plans to achieve them, planned changes to the ISMS, controlled operation of the processes, control of outsourced processes, and risk assessments and treatment performed at planned intervals and when significant changes occur. - SUP – Support: resources, competence, awareness, communication, documented information
Clause 7 covers the resources for the ISMS, competence of people in security roles with records, awareness of all staff, a communication plan and the control of documented information (creation, approval, versioning, distribution, protection, retention). - PRF – Performance evaluation: monitoring, internal audit, management review
Clause 9 requires defined metrics with methods, frequency and responsibilities, an internal audit programme covering the whole ISMS over the cycle, performed by objective auditors, and a management review with all the inputs the standard lists and documented outputs. A complete internal audit and management review before Stage 2 are prerequisites for certification. - IMV – Nonconformity, corrective action and continual improvement
Clause 10 requires nonconformities to be reacted to, their causes analysed, corrective actions implemented and their effectiveness reviewed, with records, and the suitability, adequacy and effectiveness of the ISMS continually improved. - GOV – Organizational controls: policies, roles, assets and classification
Annex A.5.1-A.5.14: topic-specific policies approved and communicated, roles and segregation of duties, management responsibilities, contacts with authorities and interest groups, threat intelligence, security in projects, inventory and acceptable use of assets, classification, labelling and information transfer rules. - IAM – Organizational controls: identity and access management
Annex A.5.15-A.5.18 and the technological access controls A.8.2-A.8.5: an access control policy based on business and security requirements, the full life cycle of identities, authentication information management, provisioning and review of access rights, privileged access, information access restriction, access to source code and secure authentication. - SCM – Organizational controls: supplier and cloud relationships
Annex A.5.19-A.5.23: processes to manage security in supplier relationships, security clauses in agreements, ICT supply chain security, monitoring and review of supplier services and change management, and a documented approach to acquiring, using, managing and exiting cloud services. - INC – Organizational controls: incident management, continuity and compliance
Annex A.5.24-A.5.37: incident management planning, assessment of events, response, lessons learned and evidence collection; information security during disruption and ICT readiness for business continuity; legal, regulatory and contractual requirements, intellectual property, records, privacy, independent review, compliance with policies and documented operating procedures. - PPL – People controls
Annex A.6.1-A.6.8: screening, terms and conditions of employment, awareness and training, disciplinary process, responsibilities after termination or change, confidentiality agreements, remote working and the reporting of security events by staff. - PHY – Physical controls
Annex A.7.1-A.7.14: perimeters, entry controls, securing offices and facilities, monitoring, protection against physical and environmental threats, working in secure areas, clear desk and clear screen, equipment siting, security of assets off-premises, storage media, supporting utilities, cabling, maintenance and secure disposal or re-use of equipment. - OPS – Technological controls: endpoints, malware, vulnerabilities, configuration, backup and logging
Annex A.8.1, A.8.6-A.8.19: user endpoint devices, capacity, malware protection, technical vulnerability management, configuration management, information deletion, data masking, data leakage prevention, backup, redundancy, logging, monitoring, clock synchronisation, control of privileged utilities, installation of software on operational systems. - NET – Technological controls: network, cryptography and secure development
Annex A.8.20-A.8.34: network security, segregation, web filtering, cryptography, secure development life cycle, application security requirements, secure architecture and coding, security testing, outsourced development, separation of environments, change management, test information and protection of systems during audit testing.
Certification path and key dates
| Date | Source | Status | |
|---|---|---|---|
| Month 0 | Certification cycle | Gap analysis against ISO/IEC 27001:2022 (this self-assessment), scope decision, sponsor and ISMS manager appointed, certification body shortlisted (accredited for ISO/IEC 27001 under ISO/IEC 17021-1 and ISO/IEC 27006-1) | Typical |
| Months 1-6 | Certification cycle | Implementation: context and scope, policy and objectives, risk method, risk assessment and treatment plan, Statement of Applicability, topic-specific policies and controls, competence and awareness, supplier agreements, records accumulating | Typical |
| Months 6-8 | Certification cycle | Full internal audit of clauses and applicable controls, corrective actions started, first management review with all Cl. 9.3 inputs, measurement results for at least one cycle | Typical |
| Month 8 | Certification cycle | Stage 1 audit: documentation and readiness review (scope, policy, risk method, SoA, treatment plan, objectives, internal audit and management review evidence, site conditions); areas of concern to fix before Stage 2 | Typical |
| Months 9-10 | Certification cycle | Stage 2 audit: implementation and effectiveness, sampling of records across all SoA controls and sites, interviews with top management, control owners, staff and suppliers; nonconformities to be corrected (major ones closed before certification) | Typical |
| Months 10-12 | Certification cycle | Certification decision and certificate issued (valid 3 years, subject to surveillance); corrective actions on minor nonconformities verified at the next audit | Typical |
| Year 1 | Certification cycle | First surveillance audit (normally within 12 months of the certification decision): internal audit, management review, complaints, use of the mark, progress on nonconformities and a sample of controls | Typical |
| Year 2 | Certification cycle | Second surveillance audit: remaining controls and sites sampled, changes to scope, risks or organisation reviewed | Typical |
| Year 3 | Certification cycle | Recertification audit before certificate expiry: full assessment of the ISMS over the cycle and of continual improvement; new 3-year cycle starts | Typical |
| 15/02/2022 | ISO/IEC 27002 | ISO/IEC 27002:2022 published: 93 controls in four themes (organizational, people, physical, technological) with attributes, replacing the 114 controls of the 2013 edition; 11 new controls | Published |
| 25/10/2022 | ISO/IEC 27001 | ISO/IEC 27001:2022 (third edition) published: Annex A aligned with ISO/IEC 27002:2022, harmonised structure updates (6.3 planning of changes, 9.3.2 c, 10.1/10.2 reordered, 4.2 c, 8.1 wording) | Published |
| 23/02/2024 | ISO/IEC 27001 | ISO/IEC 27001:2022/Amd 1:2024 (climate action changes): the organisation shall determine whether climate change is a relevant issue (4.1) and note that interested parties can have climate-related requirements (4.2) | Published |
| 31/10/2025 | IAF / certification bodies | End of the three-year transition from ISO/IEC 27001:2013 to the 2022 edition (IAF MD 26): certificates to the 2013 edition expired or were withdrawn; all audits are now against the 2022 edition | Completed |
| 2026-2028 | ISO/IEC JTC 1/SC 27 | A revision of ISO/IEC 27001 and ISO/IEC 27002 is in preparation within SC 27 (working draft stage as of 2026); no publication date is fixed and the 2022 edition remains the certification basis - monitor ISO announcements | Verify |
Frequently asked questions
Is the ISO/IEC 27001 readiness self-assessment free?
Yes. The tool is free, requires no account and stores nothing on our servers: the assessment runs entirely in your browser and you download the PDF report and an optional save file to your computer.
Which standard is the ISO/IEC 27001 readiness assessment mapped to?
Every requirement is linked to the controls of ISO/IEC 27001:2022. The coverage map produced by the tool can be used as a basis for a Statement of Applicability.
How is the compliance percentage calculated?
Each applicable requirement is scored on a maturity scale from 0 (not started) to 4 (fully compliant). The compliance percentage is the ratio between the score obtained and the maximum obtainable. Priorities P1/P2/P3 combine criticality and maturity level.
Who is the assessment for?
ISMS managers, CISOs, consultants and internal auditors preparing an ISO/IEC 27001:2022 certification, surveillance or recertification audit; it is a self-assessment and does not replace a certification audit.
Can the result be used as a certification gap analysis?
Yes. Each requirement states what an auditor checks, the evidence expected and whether it is reviewed at Stage 1 (documentation) or Stage 2 (implementation). The PDF report lists prioritised gaps, a certification roadmap and the coverage of every clause and control of ISO/IEC 27001:2022, so it can be used as the gap analysis of an implementation project or before a surveillance audit.
Other assessments
- EU AI Act – Regulation (EU) 2024/1689 as amended by the Digital Omnibus – mapped to ISO/IEC 42001:2023
- GDPR – Regulation (EU) 2016/679 with EDPB guidance – mapped to ISO/IEC 27701:2025
- NIS2 Directive – Directive (EU) 2022/2555 and Implementing Regulation (EU) 2024/2690 - mapped to ISO/IEC 27001:2022
- DORA – Regulation (EU) 2022/2554 on digital operational resilience for the financial sector – mapped to ISO/IEC 27001:2022 and ISO 22301:2019
- AI Act – Italia – AI Act, L. 132/2025, D.Lgs. 160/2026 e 179/2026 – mappato su ISO/IEC 42001:2023 (contenuti in italiano)
- ISO/IEC 42001 readiness – AI management system (AIMS) gap analysis against ISO/IEC 42001:2023 - clauses 4-10 and the 38 Annex A controls, in view of certification
- ISO/IEC 20000-1 / ITSM maturity – Service management system (SMS) gap analysis against ISO/IEC 20000-1:2018 and maturity of the ITSM processes, with ITIL practice cross-references, in view of certification
Self-assessment tool for information purposes only; it is not a certification audit and does not replace the judgement of an accredited certification body. GoToCertify is not affiliated with ISO or IEC; requirements are paraphrased and the official texts of ISO/IEC 27001:2022 and ISO/IEC 27002:2022 must be obtained from ISO or national standards bodies and prevail over this tool. No data from this assessment is transmitted to GoToCertify. © 2026 GoToCertify.