ISO 27001 Readiness Assessment. Are you Stage 2 audit-ready?

ISO/IEC 27001:2022 is the international standard for Information Security Management Systems (ISMS). It specifies the requirements for establishing, implementing, maintaining and continually improving an ISMS. Certification by an accredited body is widely used by SaaS, fintech, healthcare, manufacturing and professional-services organisations to prove to customers, regulators and partners that information security is managed systematically rather than ad-hoc.

The 2022 revision replaced the 2013 version. The main standard clauses 4 through 10 stayed structurally similar, but Annex A was significantly reorganised: the 114 controls of 2013 were consolidated into 93 controls across four themes (Organisational, People, Physical, Technological). The transition period ended on 31 October 2025, so ISO 27001:2022 is the only version a certification body can audit against today.

• Clause 4 Context of the organisation. Scope, interested parties, boundaries, interfaces.
• Clause 5 Leadership. Top-management commitment, information security policy, roles and responsibilities.
• Clause 6 Planning. Risk assessment and risk treatment, information security objectives, Statement of Applicability.
• Clause 7 Support. Resources, competence, awareness, communication, documented information.
• Clause 8 Operation. Operational planning and control, operational risk assessments, risk treatment implementation.
• Clause 9 Performance evaluation. Monitoring and measurement, internal audit, management review.
• Clause 10 Improvement. Nonconformity and corrective action, continual improvement.

These seven clauses define the management system. Failure to implement them properly is the most common source of major non-conformities at Stage 1. In particular, Clauses 6.1.3 (Statement of Applicability), 9.2 (internal audit) and 9.3 (management review) are examined in detail by every certification body.

1. A.5 Organisational controls (37). Policies, roles, assets, access control, information transfer, supplier relationships, incident management, legal and contractual obligations, privacy.
2. A.6 People controls (8). Screening, employment terms, awareness training, disciplinary process, remote working, event reporting.
3. A.7 Physical controls (14). Perimeters, entry, monitoring, equipment, cabling, storage media, secure disposal.
4. A.8 Technological controls (34). Endpoints, privileged access, cryptography, backups, logging, monitoring, network security, secure development, change management.

Our assessment covers every single Annex A control. We weight each one by priority (how often it drives a major non-conformity at audit) and ask for an honest implementation state. The output tells you which controls to fix first.

The SoA is the mandatory document that lists all 93 Annex A controls and states whether each is applicable or justifiably excluded, with a reason for each decision. It is one of the first documents an auditor asks for and failure to maintain it accurately is a common major non-conformity.

The Excel attachment produced by this tool is structured as a working SoA: it lists every Annex A control with your implementation state and leaves a Notes column for your justification. Use it as the starting point for a formal SoA document.

A certification audit happens in two stages. At Stage 1, the auditor reviews ISMS documentation (scope, policies, risk assessment, SoA, risk treatment plan, procedures, management review records). The output is a report identifying gaps that must be closed before Stage 2.

At Stage 2, the auditor verifies that the ISMS is actually operating. They interview staff, sample evidence, observe controls, and look for proof that every applicable Annex A control is implemented and effective. Certification is awarded after a successful Stage 2 and lasts three years with annual surveillance audits.