ISO 27001 checklist: requirements, certification cost and timeline explained

How ISO/IEC 27001:2022 is structured

ISO/IEC 27001:2022 has two parts that matter for an audit. The main body, clauses 4 to 10, contains the mandatory management-system requirements. Every clause 4-10 requirement must be met; there is no opting out. Annex A lists 93 information security controls that you select from (and justify) based on your own risk assessment. Annex A is the reference set, and ISO/IEC 27002:2022 gives implementation guidance for each control.

The 2022 edition reorganised the older 114 controls into 93, grouped into four themes instead of fourteen domains. Eleven controls are new, including threat intelligence, cloud services security, data masking, data leakage prevention, monitoring activities, web filtering and secure coding. Certificates against the 2013 edition are no longer valid, so build any new programme on the 2022 text.

• Clause 4 Context of the organisation: internal and external issues, interested parties, ISMS scope.
• Clause 5 Leadership: top management commitment, information security policy, roles and responsibilities.
• Clause 6 Planning: risk assessment, risk treatment, Statement of Applicability (SoA), security objectives, planning of changes.
• Clause 7 Support: resources, competence, awareness, communication, documented information.
• Clause 8 Operation: operational planning, performing the risk assessment and treatment at planned intervals.
• Clause 9 Performance evaluation: monitoring and measurement, internal audit, management review.
• Clause 10 Improvement: continual improvement, nonconformity and corrective action.
• Annex A themes: Organisational (37 controls), People (8), Physical (14), Technological (34).

Pre-audit checklist: clauses 4 to 6

Auditors follow the clause order, so it makes sense to prepare in that order too. The items below are the evidence a certification auditor will typically expect to see. Treat them as a starting point and adapt the wording to your own organisation; a management system that is copied from a template rarely survives a Stage 2 audit.

• Documented ISMS scope that names locations, business units, systems and the interfaces and dependencies with third parties (clause 4.3).
• A list of interested parties (customers, regulators, staff, suppliers) and their relevant requirements (4.2).
• An information security policy approved by top management, communicated and available to interested parties (5.2).
• Assigned and communicated roles: who owns the ISMS, who reports on its performance (5.3).
• A risk assessment methodology with defined criteria for likelihood, impact and acceptance (6.1.2).
• A completed risk register with owners, evaluated risks and chosen treatment options (6.1.2, 6.1.3).
• A Statement of Applicability covering all 93 Annex A controls with a justification for each inclusion and exclusion and the implementation status (6.1.3 d).
• A risk treatment plan approved by risk owners, including residual risk acceptance (6.1.3 e, f).
• Measurable information security objectives with a plan for how they will be achieved and evaluated (6.2).
• A defined process for planning changes to the ISMS (6.3, new in 2022).

Pre-audit checklist: clauses 7 to 10

Clauses 7 to 10 are where most first-time nonconformities appear, because they require the system to have actually run for a while. Plan at least one full cycle of these activities before you book Stage 2.

• Evidence of competence for people in security roles: CVs, training records, certifications (7.2).
• Awareness programme records showing staff know the policy and the consequences of not following it (7.3).
• A document-control process: version history, approval, distribution and retention of ISMS records (7.5).
• Records that the risk assessment was performed at planned intervals or after significant change (8.2).
• Evidence that risk treatment actions were carried out, not just planned (8.3).
• Control of externally provided processes, products and services, including supplier security reviews (8.1).
• Defined metrics, who measures them, how often, and the results (9.1).
• An internal audit programme, at least one completed internal audit covering all clauses, and audit reports (9.2).
• Minutes of a management review covering all inputs listed in 9.3.2 and the decisions taken (9.3).
• A nonconformity and corrective action log with root-cause analysis and verification of effectiveness (10.2).

Annex A: what auditors look at in the four themes

You do not need to implement every Annex A control, but you need a defensible reason for every one you leave out. The auditor will sample controls from the SoA and ask for evidence that each is operating, so keep the evidence trail short: a policy or configuration, and a record showing it happened.

• Organisational (A.5): policies, asset inventory, access control policy, supplier agreements, incident management, business continuity, legal and contractual requirements, cloud services, threat intelligence.
• People (A.6): screening, terms of employment, awareness training, disciplinary process, responsibilities after termination, confidentiality agreements, remote working, event reporting.
• Physical (A.7): perimeters, entry controls, securing offices and equipment, clear desk and screen, cabling, maintenance, secure disposal.
• Technological (A.8): endpoint devices, privileged access, malware protection, vulnerability management, backup, logging and monitoring, network security, secure development, change management, data masking and leakage prevention.

What drives ISO 27001 certification cost

There is no fixed price for ISO 27001 certification, and any figure quoted without knowing your organisation should be treated with caution. The cost has three components, and the certification body fee is often the smallest of them.

Audit fees are driven by audit days. Accredited certification bodies calculate the number of audit days from the number of people within the ISMS scope, the number of sites, and the complexity of the organisation and its IT environment, following the IAF MD 5 guidance. A single-site company with a few dozen staff and a cloud-based environment will need far fewer audit days than a multi-site group with legacy infrastructure and regulated data. Reducing scope artificially rarely saves money in the end, because customers will ask what was excluded.

Internal effort is usually the largest cost. Someone has to write the policies, run the risk assessment, chase evidence, train staff and prepare for the audit; for an SME this is typically a part-time project lead for several months plus time from IT, HR and management. Tooling is the third component: a compliance platform, vulnerability scanner, endpoint management, logging and backup. Much of this a well-run company should have anyway, but it is often bought or upgraded during the project.

• Headcount in scope: the primary driver of audit days.
• Number and type of sites, including remote and home working arrangements.
• Complexity: regulated data, in-house development, legacy systems, number of critical suppliers.
• Whether you use external consultants, a compliance platform, or do everything in-house.
• Ongoing cost: annual surveillance audits and a recertification audit every three years.

Timeline: Stage 1, Stage 2 and surveillance

For a small or medium-sized company starting from a reasonable baseline, four to nine months from kick-off to certificate is realistic. Companies with existing SOC 2 or strong IT governance are at the faster end; companies building policies from scratch, or with a scattered infrastructure, are at the slower end. Certification bodies are often booked several months ahead, so contact one early.

The certification audit has two stages. Stage 1 is a readiness review: the auditor checks that the mandatory documentation exists, that the scope and SoA make sense, and that you are ready for Stage 2. Stage 2 is the main audit, testing that the ISMS is implemented and effective across the scope. Major nonconformities must be closed before the certificate is issued; minor ones need a corrective action plan.

The certificate is valid for three years. During that period the certification body conducts surveillance audits, usually once a year, sampling parts of the system. At the end of year three a full recertification audit takes place. Surveillance audits are where drift shows up, so the internal audit and management review cycle needs to keep running after the initial celebration.

• Months 1-2: scope, gap assessment, risk methodology, project plan.
• Months 2-5: risk assessment, SoA, policies and controls implementation.
• Months 4-7: operate the system, collect evidence, internal audit, management review.
• Months 5-9: Stage 1, corrective actions, Stage 2, certificate.

Common reasons SMEs fail or delay the audit

Most audit findings are not about missing firewalls. They are about the management system not being lived: policies exist but nobody can show the training record, the risk register was done once and never updated, the internal audit was performed by the person who built the system, or the management review is a one-line email. Each of these is fixable well before the auditor arrives.

• Scope statements that are vague or exclude the systems customers actually care about.
• Statement of Applicability that does not match the risk assessment.
• No evidence that controls operate: the policy says quarterly access reviews, but there are no records.
• Internal audit lacking independence or not covering all clauses.
• Supplier and cloud provider controls not assessed.
• Asset inventory out of date, especially for laptops and SaaS tools.

Where to start: measure your gap before you spend

Before committing budget to consultants or a certification body, it helps to know how far you are from the standard. A structured self-assessment against clauses 4-10 and the Annex A themes gives you a readiness score, shows which areas existing practices already cover, and produces a gap list you can turn into a project plan.

The free ISO 27001 self-assessment on baltum.ai takes about 10 to 15 minutes. You answer practical questions about how your organisation actually works, and receive a readiness score, a gap report organised by clause and control theme, and AI-generated recommendations on what to prioritise. It is a self-assessment tool, not a certification or legal advice, but it is a fast and inexpensive way to replace guesswork with a plan.

This article is for general information and is not legal advice. baltum.ai is independent software, not a certification body.