What is ISO/IEC 27001?
ISO/IEC 27001 is the international standard for information security management systems (ISMS). It sets out how an organisation identifies information security risks, chooses controls to treat them and keeps improving the system over time.
The current edition, ISO/IEC 27001:2022, contains management-system requirements in clauses 4–10 and 93 reference controls in Annex A, grouped into four themes: organisational, people, physical and technological. Certification is issued by an accredited certification body after a two-stage audit and is maintained through annual surveillance audits over a three-year cycle.
Who needs ISO 27001 certification?
- SaaS and IT companies whose enterprise customers ask for proof of security in tenders and vendor questionnaires
- Software development and outsourcing companies working with EU, UK or US clients
- Fintech, crypto and payment companies preparing for DORA or partner due diligence
- Data centres, hosting and managed service providers
- Any organisation that wants one recognised framework instead of answering every security questionnaire separately
What the free ISO 27001 self-assessment checks
The questions follow the structure an auditor uses, so your results map directly to what will be examined:
- Context, scope and interested parties (clause 4)
- Leadership, information security policy and roles (clause 5)
- Risk assessment, risk treatment and the Statement of Applicability (clause 6)
- Resources, competence, awareness and documented information (clause 7)
- Annex A controls: access control, asset management, supplier security, incident management, backup, secure development and more
- Monitoring, internal audit and management review (clause 9) and corrective action (clause 10)
Typical gaps before an ISO 27001 audit
These issues most often turn into nonconformities. The self-assessment shows which of them apply to you, so you can fix them before paying for an audit.
- A risk assessment exists, but the Statement of Applicability does not match it
- Policies are written, but there is no evidence that they are followed: logs, records, training
- No internal audit or management review before the Stage 1 audit
- The security of suppliers and cloud providers is not assessed
- Access rights are not reviewed regularly and former employees keep access
From self-assessment to certification
The self-assessment is the first step. If you want to go further, BALTUM, our AI auditor, runs a simulated audit interview: it asks for evidence behind each answer and issues a findings report with nonconformities classified the way an auditor classifies them.
baltum.ai is independent software, not a certification body. The certificate is issued by an accredited certification body of your choice, and nothing on the platform influences its decision.